Release to Production v2.9.28 - 2026-08-23 - #2276
Conversation
* clean up * pr feedback
Release to Staging v2.9.28 - 2026-08-14
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 44d7ddb5a9
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| The field set is the raw union of `VerificationRequest` + the | ||
| `QueryParamsBuilder`-encoded `SelfSdkConfig` fields — **delivered raw, not | ||
| pre-derived**. EM-02 feeds this object through the (refactored) | ||
| `parseVerificationRequestContext` so all normalization/derivation is preserved. |
There was a problem hiding this comment.
When EM-01 is resumed and implemented from this contract, the KMP/Swift response will not actually match the live RN host: LifecycleHandler.getConfig returns config.request wholesale, whose VerificationRequest includes proofItems, documentType, documentTypes, and ids, while the listed “raw union” omits them and explicitly excludes proofItems. In particular, requestRequiresUnavailableCapability reads the three document constraints, so dropping them makes the embed boot capability guard treat a constrained request as unconstrained and proceed toward unavailable NFC/MRZ handlers instead of failing closed. Include the complete canonical request shape in the contract, builder, and tests.
AGENTS.md reference: AGENTS.md:L34-L36
Useful? React with 👍 / 👎.
| @@ -0,0 +1,196 @@ | |||
| # MRZ Scan: Black Viewfinder / Apparent Hang (Android demo) | |||
There was a problem hiding this comment.
Adding SPEC-MRZ-PREVIEW.md creates a second subject-named spec inside an existing workstream, contrary to the repository convention that documents use doc-type names and workstream context lives at workstreams/<scope>/SPEC.md. Since this is explicitly a parked debugging record rather than the workstream spec, name it by an allowed type such as REVIEW.md and update the new index link so future navigation and spec tooling do not treat it as another authoritative spec.
AGENTS.md reference: AGENTS.md:L81-L86
Useful? React with 👍 / 👎.
| | `src/components/InitialRouteRedirect.tsx` | Make doc-aware + async with a loading state; defer to the shared embed-entry decision instead of the unconditional jump. | | ||
| | `src/utils/resolveEmbedEntry.ts` (new) | Extract `loadSelectedDocument → isRegistered ? '/disclose/request' : '/tour/1'`; reused by `InitialRouteRedirect` and `embed/TourScreen`. | | ||
| | `src/screens/embed/TourScreen.tsx` | Replace the inline branch (`:29-39`) with the shared helper. | |
There was a problem hiding this comment.
If this table is followed for a host that successfully reports embed mode, resolveEmbedEntry returns /tour/1 when no document is registered and the same helper is then reused by screens/embed/TourScreen. At the final tour step that user still has no document, so the helper sends them back to /tour/1 instead of continuing to capture—the current screen deliberately uses /capture/kyc for that case. Separate the initial entry decision from the post-tour destination, or parameterize the helper, so a real getConfig host cannot loop through the tour indefinitely.
Useful? React with 👍 / 👎.
| 1. **CANONICAL HOME is still undecided (WIA-17).** The split between this repo's `packages/kmp-sdk/` and `selfxyz/self-webview-sdk`'s `kmp-sdk/` has no written convergence plan. See [WIA-17 open questions](../../webview-in-app/plans/SPIKE-rn-wraps-kmp.md): one live option is the **opposite** of this spec — keep kmp-sdk in _this_ repo behind `self.sdk.optional.*` build flags and **retire `self-webview-sdk`** ([WIA-17-open-questions.js](../../webview-in-app/plans/WIA-17-open-questions.js)). SD-07 is only valid if `self-webview-sdk` is confirmed canonical. **Resolve this first; it gates everything below.** | ||
| 1. **CANONICAL HOME — EXPLICITLY UNRESOLVED as of 2026-08-09. Owner: Seshanth Saravanakumar.** The split between this repo's `packages/kmp-sdk/` and `selfxyz/self-webview-sdk`'s `kmp-sdk/` has no written convergence plan. See [WIA-17 open questions](../../webview-in-app/plans/SPIKE-rn-wraps-kmp.md): one live option is the **opposite** of this spec — keep kmp-sdk in _this_ repo behind `self.sdk.optional.*` build flags and **retire `self-webview-sdk`** ([WIA-17-open-questions.js](../../webview-in-app/plans/WIA-17-open-questions.js)). SD-07 is only valid if `self-webview-sdk` is confirmed canonical. **Resolve this first; it gates everything below.** | ||
|
|
||
| This was carried as a silent blocker until [SELF-3708](https://linear.app/selfprotocol/issue/SELF-3708) named an owner; it is now an open decision with one, not an unowned gap. What it gates: SD-06 vs SD-07 (mutually exclusive — see the parent [SPEC.md](../SPEC.md)) and cutover item B3 ([WIA-APP-CUTOVER.md](../../webview-in-app/plans/WIA-APP-CUTOVER.md)). What is _not_ in dispute: the vendored `packages/kmp-sdk` is a **stale mirror** — **no functional/source changes since 2026-04-30** (`1ba722fe0`); its only later commit is `04b3bb86f` (2026-06-12, pnpm migration), a one-line `gradle/libs.versions.toml` edit. Do not edit it — active KMP work happens in `self-webview-sdk`. De-facto practice therefore already favors external-canonical; this decision is the formal ratification of that plus the cost of a tagged release, not a coin flip. |
There was a problem hiding this comment.
The parent sdk-distribution/SPEC.md now says to avoid speculative feature work in the vendored tree while explicitly allowing compatibility fixes required by current monorepo consumers, but this execution plan gives the unconditional instruction “Do not edit it.” Before the canonical-home decision, a compatibility break in the currently consumed packages/kmp-sdk would therefore either be left unfixed or patched only in the external tree that the build does not resolve. Align this sentence with the parent rule by prohibiting new feature development while retaining the compatibility-fix exception.
AGENTS.md reference: AGENTS.md:L89-L89
Useful? React with 👍 / 👎.
| ### P1 — web-side resilience (webview-app / webview-bridge) — WRITTEN 2026-07-02, UNMERGED | ||
|
|
||
| > Written and validated on `justin/wia-demo-rd1` only; none of it is on `dev` | ||
| > (`webview-bridge/src/adapters/camera.ts` on `dev` has no scan timeout and no | ||
| > unmount `stopCamera`). Reviving this means porting the items below, not | ||
| > re-deriving them. |
There was a problem hiding this comment.
At this reviewed commit, both passport/CodeScanViewfinderRoute.tsx and eu-id/ViewfinderRoute.tsx already send camera.stopCamera from their deferred unmount cleanup, so the claim that none of this work is on dev and that unmount cleanup is absent is false. The subsequent instruction to sync all listed route files from the parked branch can cause an engineer to overwrite landed logic while trying to port the genuinely missing timeout/rejection handling. Record the status per subitem and limit the recovery instructions to the deltas that are actually absent.
Useful? React with 👍 / 👎.
| > draft). Neither is merged. This document and the `plans/` beneath it were | ||
| > cherry-picked onto `self-3708` for landing on `dev`, so the track's written | ||
| > record survives branch deletion — see | ||
| > [SELF-3708](https://linear.app/selfprotocol/issue/SELF-3708). Until that lands, | ||
| > `justin/wia-demo-rd1` is still the only other copy. |
There was a problem hiding this comment.
This commit itself adds the embed-mode record to the repository, so after applying it the statement that the document is merely queued on self-3708 and that justin/wia-demo-rd1 is still the only other copy is no longer true; the MRZ record repeats the same stale wording. Anyone recovering the work after the parked branches are deleted may waste time looking for a supposedly unlanded copy or misread the repository version as provisional. Update both headers to record the actual landing commit/branch rather than retaining the pre-landing handoff text.
Useful? React with 👍 / 👎.
1 participant
🎯 Production Release
Release Date: August 23, 2026
Commits ahead: 2
This automated PR promotes tested changes from
stagingtomainfor production deployment.What's Included
All changes that have been verified in the staging environment.
Note: This PR is directly from
staging, so new commits merged tostagingwill automatically appear here.Pre-Deployment Checklist
Deployment Notes
Merging this PR will trigger production deployment.
This PR was automatically created by the Release Calendar workflow on August 23, 2026