[codex] Add iOS universal wallet readiness gates

.github/CODEOWNERS

@@ -0,0 +1,23 @@
+# Owners must have write access to this repository.
+
+* @soramitsu/fearless
+
+/.github/ @soramitsu/devops-team
+/AGENTS.md @soramitsu/fearless @soramitsu/ios-developers
+/CONTRIBUTING.md @soramitsu/fearless @soramitsu/ios-developers
+/README.md @soramitsu/fearless @soramitsu/ios-developers
+/docs/release-checklist.md @soramitsu/fearless @soramitsu/devops-team
+/docs/rollback-checklist.md @soramitsu/fearless @soramitsu/devops-team
+/scripts/audit-public-artifacts.sh @soramitsu/fearless @soramitsu/ios-developers @soramitsu/security
+
+/fearless.xcodeproj/ @soramitsu/fearless @soramitsu/ios-developers
+/fearless.xcworkspace/ @soramitsu/fearless @soramitsu/ios-developers
+/fearless/ @soramitsu/fearless @soramitsu/ios-developers
+/fearless/Common/Model/ @soramitsu/fearless @soramitsu/ios-developers @soramitsu/security
+/fearless/Common/Keys/ @soramitsu/fearless @soramitsu/ios-developers @soramitsu/security
+/fearless/Common/Network/Wallet/ @soramitsu/fearless @soramitsu/ios-developers @soramitsu/security
+/fearless/CoreLayer/CoreComponents/Storage/Keys/ @soramitsu/fearless @soramitsu/ios-developers @soramitsu/security
+/**/*Key* @soramitsu/fearless @soramitsu/ios-developers @soramitsu/security
+/**/*Keychain* @soramitsu/fearless @soramitsu/ios-developers @soramitsu/security
+/**/*Keystore* @soramitsu/fearless @soramitsu/ios-developers @soramitsu/security
+/**/*Signer* @soramitsu/fearless @soramitsu/ios-developers @soramitsu/security

.github/pull_request_template.md

@@ -0,0 +1,49 @@
+## Summary
+
+Describe the change and why it is needed.
+
+## Related Issue
+
+Closes #<issue-number> (or) Relates to #<issue-number>
+
+## Target Branch
+
+- [ ] This PR targets `develop`
+- [ ] This PR targets `master` and is a release or hotfix PR
+
+## Type of Change
+
+- [ ] feat (new feature)
+- [ ] fix (bug fix)
+- [ ] refactor (no functional change)
+- [ ] chore/build (tooling, CI, deps)
+- [ ] docs
+
+## Screenshots / Videos
+
+If UI changes, include before/after.
+
+## Test Plan
+
+Commands run locally:
+
+```
+xcodebuild -workspace fearless.xcworkspace -scheme fearless.tests test
+```
+
+Additional checks and scenarios covered:
+-
+
+## Risks & Rollout
+
+Potential impact, migrations, or config/secrets required.
+
+## Checklist
+
+- [ ] Linked an issue and added a clear description
+- [ ] Added/updated tests for changed code where applicable
+- [ ] Updated docs when behavior or commands changed
+- [ ] Ran simulator build/tests locally or verified CI
+- [ ] No secrets or local environment files committed
+- [ ] `./scripts/audit-public-artifacts.sh` passes when public artifacts or env defaults change
+- [ ] No direct-to-`master` workflow is introduced

.github/workflows/branch-flow.yml

@@ -0,0 +1,51 @@
+name: Branch Flow
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Branch flow audit self-test
+        run: bash scripts/test-branch-flow-audit.sh
+
+      - name: Branch flow drift audit
+        run: bash scripts/audit-branch-flow.sh
+
+      - name: Validate PR target
+        env:
+          BASE_BRANCH: ${{ github.base_ref }}
+          HEAD_BRANCH: ${{ github.head_ref }}
+        run: |
+          set -euo pipefail
+
+          echo "PR branch flow: ${HEAD_BRANCH} -> ${BASE_BRANCH}"
+
+          if [[ "$BASE_BRANCH" == "develop" ]]; then
+            if [[ "$HEAD_BRANCH" == "master" ]]; then
+              echo "::error::Do not open normal work from master to develop. Use a feature/fix/chore/refactor, release, or hotfix branch."
+              exit 1
+            fi
+
+            exit 0
+          fi
+
+          if [[ "$BASE_BRANCH" == "master" ]]; then
+            if [[ "$HEAD_BRANCH" == "develop" || "$HEAD_BRANCH" == release/* || "$HEAD_BRANCH" == hotfix/* ]]; then
+              exit 0
+            fi
+
+            echo "::error::master is releasable. Only develop, release/*, or hotfix/* branches may target master."
+            exit 1
+          fi
+
+          echo "::error::Pull requests must target develop for normal work or master for release/hotfix promotion."
+          exit 1

.github/workflows/codecov.yml

@@ -1,9 +1,14 @@
 name: Codecov Fearless
 
 on:
+  push:
+    branches:
+      - develop
+      - master
   pull_request:
     branches:
       - develop
+      - master
 
 jobs:
   build:
@@ -12,6 +17,49 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Branch flow audit
+        run: |
+          bash ./scripts/audit-branch-flow.sh
+          bash ./scripts/test-branch-flow-audit.sh
+
+      - name: Audit public artifacts
+        run: ./scripts/audit-public-artifacts.sh
+
+      - name: TODO debt audit
+        run: |
+          bash ./scripts/test-todo-debt-audit.sh
+          bash ./scripts/audit-todo-debt.sh
+
+      - name: Iroha mobile SDK release asset contract
+        env:
+          GH_TOKEN: ${{ github.token }}
+          IROHA_MOBILE_SDK_RELEASE_TAG: ${{ vars.IROHA_MOBILE_SDK_RELEASE_TAG }}
+          IROHA_MOBILE_SDK_RELEASE_REPO: ${{ vars.IROHA_MOBILE_SDK_RELEASE_REPO }}
+        run: |
+          bash ./scripts/check-iroha-mobile-sdk-release-assets.sh --self-test
+          if [[ -n "${IROHA_MOBILE_SDK_RELEASE_TAG:-}" ]]; then
+            bash ./scripts/check-iroha-mobile-sdk-release-assets.sh --download --tag "$IROHA_MOBILE_SDK_RELEASE_TAG"
+          else
+            echo "IROHA_MOBILE_SDK_RELEASE_TAG is not configured; real release asset validation skipped."
+          fi
+
+      - name: Private overlay audit self-test
+        run: bash ./scripts/test-private-overlay-boundary.sh
+
+      - name: Shared-features delta report
+        run: |
+          bash ./scripts/deps/test-shared-features-delta-report.sh
+          bash ./scripts/deps/audit-shared-features-delta-report.sh "$(pwd)" --write-report build/reports/shared-features-delta-report.json
+
+      - name: Upload shared-features delta report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: shared-features-delta-report
+          path: build/reports/shared-features-delta-report.json
+          if-no-files-found: ignore
+          retention-days: 14
+
       - name: Configure GitHub auth for private pods (optional)
         env:
           GH_READ_TOKEN: ${{ secrets.GH_READ_TOKEN }}
@@ -22,7 +70,7 @@ jobs:
           else
             echo "GH_READ_TOKEN not set; proceeding without GitHub auth"
           fi
-      
+
       - name: Bootstrap Dependencies
         run: |
           bash scripts/ci/bootstrap.sh
@@ -116,3 +164,17 @@ jobs:
 
       - name: Upload coverage to Codecov
         run: bash <(curl -s https://codecov.io/bash) -J 'fearless'
+
+  jenkins-pr-merge:
+    name: continuous-integration/jenkins/pr-merge
+    runs-on: ubuntu-latest
+    needs: build
+    if: always()
+    steps:
+      - name: Require iOS build job success
+        run: |
+          if [[ "${{ needs.build.result }}" != "success" ]]; then
+            echo "Required iOS build job did not pass: ${{ needs.build.result }}" >&2
+            exit 1
+          fi
+          echo "Jenkins compatibility context is backed by the GitHub Actions build job."

.gitignore

@@ -43,6 +43,8 @@ Carthage/Build
 #fastlane/screenshots
 #fastlane/test_output
 fastlane/
+.bundle/
+vendor/bundle/
 # Code Injection
 #
 # After new code Injection tools there's a generated folder /iOSInjectionProject

AGENTS.md

@@ -59,6 +59,7 @@ CI note
 - Do not alter seed handling, signing, or cryptography without maintainer approval.
 - Runtime registries and chain/type sources must be aligned with the current Polkadot SDK release; coordinate updates with maintainers.
 - Use `*.xcconfig` and environment variables for private values; avoid hardcoding secrets in `Info.plist`.
+- Keep partner identifiers and buy-provider keys in environment variables or generated CI keys, not committed Swift source.
 
 ## Dependencies & Versioning
 - Prefer conservative upgrades (patch/minor). Pin major bumps to separate PRs with clear testing notes.
@@ -149,6 +150,7 @@ The project mixes CocoaPods and Swift Package Manager. Follow these steps in ord
 - Environment variables:
   - `GH_PAT_READ` (optional): GitHub PAT for private pods (`FearlessKeys`).
   - `DEVELOPER_DIR` (optional): Jenkinsfile auto‑pins to Xcode 15.x if present for SPM stability; otherwise default Xcode is used.
+  - `MOONPAY_PUBLIC_KEY`: Moonpay partner public key generated into CI keys for trusted builds.
 - Private keys in PRs:
   - PR builds do NOT require private keys. The Jenkinsfile detects PR context (`CHANGE_ID`) and temporarily comments out the `pod 'FearlessKeys'` line before `pod install`, then restores the file. This prevents private repo access and allows PRs to build without secrets.
   - Trusted branches (develop/master/release): Jenkins sets `INCLUDE_FEARLESS_KEYS=1` and, if `GH_PAT_READ` is present, rewrites GitHub URLs to use the token so `pod install` can fetch `FearlessKeys`.

CONTRIBUTING.md

@@ -27,7 +27,25 @@ If you think you miss some functionality on our application, please open issue o
 * (OPTIONAL) If possible, provide complete description of functionality you suggest
 * (OPTIONAL) Provide your telegram username, and be sure to join [Our Community Channel](https://t.me/fearlesshappiness) on Telegram, so our team can get in touch with you to retrieve more information about your vision
 
-Even if you provide mockups, please understand that our design team will review it and might implement this in very different way. 
+Even if you provide mockups, please understand that our design team will review it and might implement this in very different way.
+
+### Git flow
+
+All normal work starts from `develop` and is submitted back to `develop`.
+Use short-lived branches named `feature/<ticket>-<slug>`, `fix/<ticket>-<slug>`,
+`chore/<slug>`, or `refactor/<slug>`.
+
+`master` is the releasable branch. Do not target `master` except for release
+pull requests from `develop` or urgent `hotfix/<version-or-slug>` branches.
+Every commit on `master` must be safe to release, and release tags must point at
+commits already merged to `master`.
+
+Feature PRs are squash-merged after review and green CI. Release PRs to
+`master` use merge commits so the release boundary remains visible.
+
+The `Branch Flow` GitHub Actions workflow validates PR targets automatically:
+normal work must target `develop`, while `master` accepts only `develop`,
+`release/*`, or `hotfix/*` branches.
 
 ### 💻 Opening Pull Requests
 
@@ -36,10 +54,10 @@ If you would like to help us by contributing writing the code, please follow nex
 * Always create and issue prior to opening Pull Request (hereinafter the PR), or your PR less likely to be reviewed
 * Remember, that in that case you are required to provide full description for you feature in created issue, otherwise it would be hard for us to understand what you're trying to add to our codebase
 * Follow the coding standards guidelines (TO BE PROVIDED LATER), or you will be asked to make changes to follow them
-* Please avoid huge PRs, and if your contribution really requires lots of files, please make a base branch with series of small PRs on your fork, and then provide link to those PRs in your big one PR in our repository 
+* Please avoid huge PRs, and if your contribution really requires lots of files, please make a base branch with series of small PRs on your fork, and then provide link to those PRs in your big one PR in our repository
 * Provide steps for QA engineer to test your functionality (they should cover requirements from your issue)
 
-Even if you provide mockups, please understand that our design team will review it and might implement this in very different way. 
+Even if you provide mockups, please understand that our design team will review it and might implement this in very different way.
 
 ### Telegram links
 

Gemfile

@@ -0,0 +1,10 @@
+source "https://rubygems.org"
+
+gem "cocoapods", "1.16.2"
+
+# System Ruby on current macOS images can still be 2.6. Pin transitive gems
+# whose latest releases now require newer Ruby versions so bootstrap remains
+# reproducible for public checkouts.
+gem "drb", "2.0.6"
+gem "ffi", "1.15.5"
+gem "securerandom", "0.3.2"