epic: enable store native symbolication

[ovitrif]

Goal

Ship every Bitkit-owned Rust Android library with a stable ELF build ID and a matching native debug symbol artifact so Google Play can resolve production native frames directly.

Verified baseline

Checked on July 23, 2026 with NDK llvm-readelf -n against the AARs consumed by Bitkit Android:

Packaged library	Dependency	Current version	Published ABIs	NT_GNU_BUILD_ID
libldk_node.so	com.synonym:ldk-node-android	0.7.0-rc.52	arm64-v8a, armeabi-v7a, x86_64	absent on all
libbitkitcore.so	com.synonym:bitkit-core-android	0.4.1	arm64-v8a, armeabi-v7a, x86, x86_64	absent on all
libvss_rust_client_ffi.so	com.synonym:vss-client-android	0.5.20	arm64-v8a, armeabi-v7a, x86, x86_64	absent on all
libpaykit.so	com.synonym:paykit-android	0.1.0-rc33	arm64-v8a, armeabi-v7a, x86, x86_64	absent on all

The release-symbol pipeline currently collects bitkit-core, ldk-node, and VSS classifier artifacts. Paykit is absent from that collection, and the consumer validation checks DWARF metadata without checking build-ID presence or packaged-to-symbol identity.

Workstreams

• fix: add Android ELF build IDs ldk-node#95 — producer PR fix: verify android elf build ids ldk-node#98
• fix: add Android ELF build IDs bitkit-core#130 — producer PR fix: verify android elf build ids bitkit-core#131
• fix: add Android ELF build IDs vss-rust-client-ffi#17 — producer PR fix: verify android elf build ids vss-rust-client-ffi#19
• fix: add Android ELF build IDs pubky/paykit-rs#121 — producer PR fix: verify android elf build ids pubky/paykit-rs#124
• fix: verify native symbol build IDs #1104 — consumer draft fix: verify native release build ids #1106

GitHub's native sub-issue hierarchy tracks completion of these workstreams. Dedicated isolated worktrees coordinate the four producer changes and the Android consumer integration.

Implementation status

• Five pushed PRs are available for colleague review.
• Every locally built published ABI reports a non-empty SHA-1 NT_GNU_BUILD_ID.
• Every stripped local AAR library matches its full-DWARF symbol artifact.
• The Android release build consumes all four task-local producer artifacts.
• The final local symbol archive contains all four Rust libraries for both release ABIs.
• The release path fails before archive creation or upload on an absent or mismatched build ID.
• The four producer PRs have exact-head non-author human approval.
• The four producer versions are merged and published.
• The Android draft resolves the released artifacts and has exact-head non-author human approval.
• The Play-distributed build accepts the symbols archive and resolves Bitkit-owned Rust frames by build ID.

Epic requirements

• Every Rust producer links all published Android targets with a SHA-1 GNU build ID.
• Every producer preserves the same build ID through stripping into the final AAR.
• Every producer fails its release path when the packaged and symbol libraries have absent or different build IDs.
• Every producer creates a versioned cross-platform release containing the corrected Android artifact.
• Bitkit Android collects symbols for all four Bitkit-owned Rust libraries.
• Bitkit Android validates build-ID presence and parity against the packaged release artifact before Play upload.
• Bitkit Android proves the four local producer artifacts work together before the child issues close.

Acceptance criteria

• All five native sub-issues are complete.
• Every published ABI reports a non-empty NT_GNU_BUILD_ID.
• Every stripped AAR library matches the build ID in its unstripped symbol artifact.
• The final Bitkit native debug symbols archive contains all four Rust libraries for every release ABI.
• The release workflow fails before upload on any absent or mismatched build ID.
• The next Play-distributed build accepts the symbols archive and resolves Bitkit-owned Rust frames by build ID.

Remaining post-approval order

1. Approve, merge, and publish fix: verify android elf build ids ldk-node#98 as 0.7.0-rc.58.
2. Approve, merge, and publish fix: verify android elf build ids bitkit-core#131 as 0.4.4.
3. Approve, merge, and publish fix: verify android elf build ids vss-rust-client-ffi#19 as 0.5.21.
4. Approve, merge, and publish fix: verify android elf build ids pubky/paykit-rs#124 as 0.1.1.
5. Resolve the four released Maven artifacts in fix: verify native release build ids #1106 and rerun the release AAB/APK and native-symbol parity checks.
6. Approve and merge fix: verify native release build ids #1106, run the internal release workflow, and validate the Play-distributed build.
7. Close the five implementation issues and this epic after the Play gate passes.

Related tracking

• [Bug]: Production SIGABRT in arm64 native code (Play 2.2.0 / build 181) #982
• [Epic] Play production crashes vitals triage #986