Repository navigation
iPhone app M1: pairing, Now, car, price widgets, ready for TestFlight - #14
Merged
Merged
Conversation
Taken as they stand from claude/native-swift-ftw-app-d7j9w4 (dbfce65): appleApp/, .github/workflows/apple.yml, .gitignore and the KMP change that removes the iOS targets. iosApp/ and shared/src/iosMain go, as in #5. protocol/registry.yaml stays as it is on main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
iPhone only, iOS 26. Pairing, Now with the price card, and the demo stay. History, Plan, Box admin, escrow, spoken box codes, the macOS target and menu bar, swift-crypto, the Linux job and PlainWebSocket go. The charger sheet goes too; the car view replaces it next. - One Swift package, three modules: FTWKit (the app's logic), FTWShared (Sendable values for widgets and later a notification extension) and FTWDemo (the simulated box, out of the product module). - FTWShared holds the App Group cache: prices-<site> and car-<site>, each with carrier, srcState and when it was read, written with completeUntilFirstUserAuthentication. A reader takes any number of sources, so a cloud copy can be one more source later. The price and freshness formatters moved here, in English and Swedish. - The car record keeps soc_source and when the level was read. - Contract.swift follows main's registry: planner.prefs.set and the modes without priority and weighted. ContractTests now also checks modes, frozen field ids, the shared enums and the demo box's names. - The session closes when the app goes to the background and reopens on return without a passkey. A relay 4429 shows "FTW is busy". - A WidgetKit extension with one price widget that reads the cache. The App Group is written once, in FTW.xcconfig; both entitlements and Info.plists read it. No DEVELOPMENT_TEAM; simulator builds sign ad hoc so the entitlements travel with the app. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- DEVELOPMENT_TEAM L66M368PZ6 in FTW.xcconfig, for the app and the widget, with automatic signing. Simulator builds still sign ad hoc and need no Apple account. The App IDs, App Group and Associated Domains still have to be registered for the team; the README lists the steps. - A pairing QR scanned with the iOS camera arrives as a universal link to https://app.ftw.energy/p#…. The app takes it through onOpenURL and onContinueUserActivity, the same offer path as any pairing link. - In the simulator, which has no camera, a picture of the QR from Photos pairs. PairingImage reads the link with CoreImage, with tests. - FTW Cloud is now an opt-in, readable state cache. The cache comments and CLAUDE.md say so; M1 does not depend on it. - Passkeys no longer uses the presentation anchor iOS 26 deprecated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… end Four families read the App Group cache and nothing else: small (also the StandBy widget), medium with a twelve-hour curve, and the lock screen's rectangle and inline line. Prices show on the lock screen. - PriceGlance (FTWShared) builds the timeline: one entry now and one at every price boundary the box sent, at the box's resolution. Where the prices stop, the widget turns grey and says "No prices after Tue 24:00 · open FTW". It never stretches or repeats old prices. - The total says what it holds. The wire carries spot and total but not the settings between them, so a line through the two tells a grid fee from VAT. - Freshness stays two fields: every entry is carrier .cache with the srcState the app saw when it fetched. - SiteModel logs each write with os.Logger and gains refreshSharedPrices. The app asks for a BGAppRefreshTask just after 13:05, then every half hour until the box has tomorrow. No silent push, no server. - Swedish and English live in FTWShared; a test checks that every widget sentence has Swedish. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The car view's rules, in FTWKit so they are tested:
- Where the level comes from: from the car, from the car but older than
five minutes ("last reported HH:MM"), set from this phone, FTW's
estimate, or FTW's assumption of 20 % at plug-in.
- A receipt for every command: sent, received (cmd.ack), done
(cmd.result), or why not. Session.command gains onAck for this.
- The ready time on the household clock, worked out the way Core does,
so 07:00 stays 07:00 across 25 October and a box that kept the UTC
minute shows the 06:00 it really uses. Goals go out as both
time_of_day_min and time_of_day_min_utc.
- Whether the car makes its goal, from the plan's own shortfall.
- "Is FTW in control?" from Core's control feedback, never green from
readings that are not live.
- English and Swedish words for all of it.
LoadpointsModel drops boost, solar-only and battery size from the daily
path. Charge now holds the charger's full current with no time limit and
no level gate. The demo box plugs in and out, has a car that reports its
level, a plan with a shortfall, and a charger that takes a moment.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A bar mark with an x interval and a single y lies on its side, so the curve showed short dashes at each price. Rectangles from zero to the price fix that. Hour labels fall every third hour, clear of the right edge, on the 24-hour clock the rest of the widget uses. The average line takes the muted tone instead of the system tint. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
App stores attach their own terms to every copy, and the GNU AGPL forbids further restrictions on recipients. Sourceful owns all code here today, so it may publish through the App Store as it is. That stops being true once someone else's code comes in under plain AGPL. LICENSE gains a second section 7 permission, next to the Energyplan one. It allows conveying the app through a store such as the App Store, TestFlight or Google Play despite the store's terms. Every other AGPL condition stays: source for the exact version outside the store, license and source offer reachable in the app, no added restrictions, and installation information except the distributor's own signing keys. CONTRIBUTING now says each contribution grants both permissions, so the permission covers future code as well. LICENSING.md and the README say the same in plain words. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On the lock screen the inline line shares its width with the date, so
it now shows the price and the start of the cheapest stretch ("273 öre
· billigast 02:45"), and "Inga priser · öppna FTW" when there is none.
The rectangle's lower lines shrink a little before they would be cut.
Colours resolve through a SwiftUI ShapeStyle instead of UIColor, and the
background task reads the scene phase instead of UIApplication.
The timeline sorts the slots and reads what the total holds once, not
once per entry: 121 entries took 37-40 ms in a Debug build in the
simulator, now 14-17 ms, file read included. An OSSignposter interval
wraps it for Instruments, and the log line carries the time.
The price figure changes with a numeric content transition.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Now keeps four things: "Is FTW in control?" in one calm line, the power flow, the car as one row that opens the car view, and the price card. The headline sentence, today's totals, savings and the fuse go. The line is green only when Core's control feedback says so over a live stream; a cache is grey and dated. The car view, in FTW/Car: - How full the car is, and who says so. Plugged in and unread, FTW assumes 20 % and says so with a badge. 20/40/60/80 and ±5 send loadpoint.soc.set at once; quick taps fold into one send. - The goal, on the household clock, with the next deadline, whether the plan makes it, and when it charges. "Use 80 % by 07:00 on weekdays" when there is none; an editor for the rest. - Charge now, Pause and Back to the plan, each with a receipt: sent, received, done, or why not. - In the demo, a card to plug the car in and out. Every word is in English and Swedish. The tab bar with one tab gives way to a navigation stack. The bands above every screen stop growing past xxxLarge text, and the flow diagram past xLarge. The demo's loopback could deliver a frame before the one sent ahead of it: each frame had its own timer, and live timers with the same delay need not fire in order. An api.chunk before its api.head read as "your box didn't answer". Each timer now delivers the oldest frame. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e rendering mode - The App Group write runs off the main actor (a @Concurrent function), in the order it was asked for. A sign-out asked for meanwhile wins: writes and clears share a lock and a per-directory clear count, so a late write never puts the home back. - The same prices again are neither written nor reloaded, so the widget timeline is rebuilt only for new prices. The background task waits for the write to land before iOS can suspend it. - The curve follows widgetRenderingMode: tinted, clear and StandBy's one-colour mode keep the current and cheap slots strong and fade the rest. The cheapest line and the symbol take the accent. - A bolt symbol heads every family, as in Apple's own widgets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A tag ios-v1.2.3, or a manual run, archives the app with Xcode 27 on GitHub's xcode-27 image, signs it with Sourceful's team through an App Store Connect API key and uploads it with method app-store-connect and destination upload. The version comes from the tag, the build number from the run. Without the ASC_* secrets, and on every pull request, it archives unsigned and says the upload was skipped. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… phone The app store permission in LICENSE asks that the license and an offer of the exact version's source be reachable in the app. A Copy Files phase puts LICENSE, NOTICE and LICENSING.md from the repository root into the bundle, and a script phase records the commit: FTW_SOURCE_REVISION from CI, else git, with a tree that has changes marked as a local build. Source & licenses shows version, build and commit, links to the tree and the license at that commit, the three texts joined for a phone's width, and that there is no third-party code. A test fails when the package or the project gains a dependency. Remove this phone clears the key, the pairing, the sealed readings and the widgets' records (AppModel.leave) and says how to remove the phone on the box. The registry has no op for a phone to remove itself. Both are reached from the foot of Now and of pairing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t frame The icon is an Icon Composer document made from FTW's mark in ftw-webapp/public/icons/icon.svg: the amber bolt as a glass layer on the mark's near-black. iOS draws the light, dark, tinted and clear looks from it. The 1024 image and the macOS sizes left over from #5 are gone. The launch screen fills with the app's surface colour, light and dark, so nothing changes colour between the launch screen and the first frame. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both the app and the widget extension carry a privacy manifest: no tracking, no tracking domains, nothing collected. Readings and commands travel end to end encrypted between the phone and the household's box; the relay forwards ciphertext and stores nothing. Required reasons, checked against the Release binaries: - File timestamp, C617.1, in both. FTWShared's CacheReader picks the newest home by the modification date of its App Group files. - UserDefaults, CA92.1, in the app. Only Debug builds read it today, for the screenshot launch arguments. ITSAppUsesNonExemptEncryption is NO. Every primitive comes from CryptoKit in iOS; the app implements no algorithm of its own. The pull request gives the reasoning and sources, and what France needs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The upload needs an Admin API key, because only Account Holder and Admin may use cloud-managed distribution certificates. A repository secret would let any branch's workflow read it, so the job takes its secrets from the app-store environment, which only main and ios-v* tags may use. Pull requests run without the environment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
RELEASING.md lists, in order, what someone in team L66M368PZ6 does in App Store Connect and on GitHub before the first upload: app record and name, EU trader status, App Privacy, export, age rating, price, countries, the API key, TestFlight and the review. store/ holds the product page in English and Swedish, the App Review notes for the demo, and check.sh, which holds each text to Apple's limits. scripts/store-screenshots.sh takes the 6.9" pictures from the demo in its own simulator. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nothing asks the box on a timer any more. The chargers are read when a screen that shows them appears, after a command, when the stream says the car started or stopped drawing, and when the stream comes back. The plan's shortfall is read when the car view opens and when the car's plan changes. "Is FTW in control?" now comes from lane 0 alone (the dispatch block and each source's state), so Now no longer polls /api/status. A cold start paints the car from the App Group cache the app writes for its widgets, dated and marked as not live, before the box answers. While nothing at all is known the screens show their shape, not a spinner. LaunchClock logs process start to first frame and first content. A tapped level shows as the chosen chip and the receipt; the number only moves once the box confirms it. Goals send time_of_day_min and today's time_of_day_min_utc, built from nothing read; tests cover a Core with srcfl/ftw#1586 and one without. The car view is a system List with system buttons, haptics on commands and outcomes, symbol effects and numeric transitions. The Now car row zooms into it. Now is split into small views that redraw only what a frame changed. Theme colours move to an asset catalog, so no UIKit is left outside the camera. CLAUDE.md gains "Feel and speed". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
In the simulator it shows a button a phone does not have. Wait 12 s so the charging picture shows the car charging, not starting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The close button is the neutral glass one; as a confirmation action it turned amber. - The removal question points at the button that asked it, not at the top of the list. - The mark in the header grows with the text, and the header stacks at accessibility sizes. - A title in capitals over a short line, such as the license's name over its version, reads as one heading. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
RELEASING.md now starts with installing from Xcode on a connected iPhone (Developer Mode, an Apple Account in Xcode, xcodebuild and devicectl), then internal TestFlight, which needs no Beta App Review: the agreement, the app record, an Admin key in plain repository secrets, a tag, and a tester group. External TestFlight and the App Store follow. The workflow accepts tags like ios-v0.1.0-1: text after a dash only tells tags apart. If Xcode's upload fails, it exports the .ipa and sends it with `altool --upload-package`, which Apple's "Upload builds" help still lists. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
App Review's 5.1.1(i) asks that the privacy policy be easy to find in the app. The foot of Now and of pairing links it beside Source & licenses, and Source & licenses has a Privacy and support section. Both pages are srcfl/ftw-web#18's, at ftw.energy, in Swedish when the app is. The footer's links stay on one line while they fit and stack when they do not. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#13 sets ITSAppUsesNonExemptEncryption to NO and adds privacy manifests with no collected data. RELEASING.md now gives the matching App Store Connect answers ("None of the algorithms mentioned above", "Data Not Collected"), #13's reading of US and French encryption rules, and the choice about the relay's error log. The App Review notes say where the privacy link is and that there is no account to delete. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…' into ios-m1-integration
Fredrik decided that France waits until the ANSSI encryption declaration is filed. RELEASING.md now removes France under Pricing and Availability, keeps China out for want of an ICP filing, and adds a step for the declaration, with ANSSI's forms page, before France is added back. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…to ios-m1-integration
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 12, 2026
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This was referenced Oct 12, 2026
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 515965e53c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| s.uptimeMs = b.uptimeMs | ||
| for (k, v) in b.fields { s.fields[k] = v } | ||
| s.truncated = truncated | ||
| if let sources = b.sources { s.sources = sources } |
There was a problem hiding this comment.
When a delta contains only the sources that changed, this assignment drops every unchanged source from the session. The existing protocol implementation in shared/src/commonMain/kotlin/energy/ftw/protocol/Snapshot.kt merges delta sources with putAll, and worstSourceState treats a missing source referenced by the field dictionary as .never; consequently, one partial source update can make healthy devices appear not to be reporting until the next full snapshot.
Useful? React with 👍 / 👎.
Comment on lines
+189
to
+190
| static let horizonMs: Double = 48 * 3_600_000 | ||
| static let publishHour = 14 |
There was a problem hiding this comment.
A fixed 48-hour interval does not always cover “today and tomorrow” from local midnight. Across the autumn DST transition those two calendar days total 49 hours, so the last hour of tomorrow is never requested; across the spring transition they total 47 hours, so the request extends into an unpublished third day and may incorrectly mark an otherwise complete window stale. Compute the end by adding two calendar days instead.
Useful? React with 👍 / 👎.
Comment on lines
+201
to
+203
| public init(site: SiteModel, calendar: Calendar = .current) { | ||
| self.site = site | ||
| self.calendar = calendar |
There was a problem hiding this comment.
When the phone is in a different timezone from the home, the default .current calendar makes midnight, the day-change key, and the publication-hour check follow the phone rather than the box. This shifts the requested/cached price day and can omit hours that belong to the household's current day; the session already exposes the household timezone as site.session.box?.tz, so the price calendar needs to follow that timezone rather than being fixed at construction from the device locale.
Useful? React with 👍 / 👎.
|
|
||
| private func entries(now: Date) -> [PriceWidgetEntry] { | ||
| let reader = CacheReader.shared() | ||
| let read = reader.flatMap { r in r.latestSiteID(PriceEntry.self).flatMap { r.read(PriceEntry.self, siteId: $0) } } |
There was a problem hiding this comment.
After pairing a different box, the old home's App Group files are deliberately retained, but the widget selects whichever price file was modified most recently rather than the app's current site. If the newly selected box is offline or lacks price.spot, it never writes a new PriceEntry, so the widget continues displaying the previous home's potentially different zone, currency, and rates indefinitely. Persist and read an explicit current-site marker instead of inferring it from price-file timestamps.
Useful? React with 👍 / 👎.
The website lives at ftw.sourceful.energy (srcfl/ftw-web README). ftw.energy has no A record, so the About links and the store URLs pointed nowhere. The pages from srcfl/ftw-web#18 answer 200 there in both languages. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
The first native iPhone version of FTW, as one PR. It replaces seven draft PRs, which are closed with a link here:
/p, and a QR image picker in the simulator), Now, App Group cache, teamL66M368PZ6, Associated Domains.loadpoint.soc.set, where the level came from and how old it is, a goal through the schedule PUT (readstime_of_day_minwhen the box sends it, srcfl/ftw#1586), Charge now, Pause and Back to the plan, each with a visible outcome. No timer loops.ITSAppUsesNonExemptEncryption = NO(reasons in #13), an Icon Composer icon, VoiceOver labels.ios-release.ymlto TestFlight (tagios-v*, secrets in theapp-storeenvironment),ExportOptions.plist,RELEASING.md, store texts in sv-SE and en-US, store screenshot script.The rules for feel and speed are in
CLAUDE.mdunder "Feel and speed".Evidence
swift testinappleApp/FTWKit: 115 tests in 18 suites passed, plus 35 in FTWShared. One live-box test is skipped as before.build/ios-0.1.0-7. App Store Connect app: "FTW Energy". Internal group: "Sourceful", which has access to all builds.What happened with CI signing
ios-release.ymlarchived and tested fine (run 38282701811), but signing the widget failed twice. The reason was thatenergy.ftw.app.widgetswas registered, but the app group was not assigned to it, and an API key cannot do that assignment. Xcode reports it as "Authentication failed". The local archive with an Xcode account assigned the group, so the next tag (ios-v0.1.1) should sign in CI. Build 7 used up 0.1.0's next build number, so the next version is 0.1.1.Still open
PROCESSINGat Apple, so a direct install from Xcode waits on Apple. TestFlight is not affected.Squash-merge this PR. The commits have no DCO sign-off; Fredrik signs off his own work.
🤖 Generated with Claude Code