Upstream Fearless iOS shared-feature compatibility delta

[takemiyamakoto]

Summary

• upstream the compatibility and native-crypto package delta currently patched into Fearless iOS after SwiftPM resolution
• make the Polkaswap address factory dependency callable and declare every module imported by the current source
• prevent bundled SoraKeystore Objective-C runtime collisions
• remove redundant embedded native archive sidecars
• remove an unsafe scrypt debug print that exposed secret-derived bytes and could read beyond a non-NUL-terminated buffer
• replace the dead Nexus XNetworking binary URL with a checksum-bound immutable public GitHub release
• register the compatibility regression target in the committed Xcode test plan so CI cannot silently skip it
• fix Swift 6.3 test compilation discovered by executing that target
• add regression coverage for the RFC 7914 scrypt vector, invalid cost rejection, zero stdout, public pool initializers, address-factory type semantics, and Objective-C runtime names
• replace the invalid read-only CODEOWNER with the repository's existing write-enabled soramitsu/ios-developers team so protected code-owner review is enforceable

XNetworking release provenance

• public immutable release: https://github.com/soramitsu/x-networking/releases/tag/ios-xcframework-1.0.10-rebuild.1
• source commit: b7657d4dad68dd3afee6b29b8b2909848afd38a2
• source tree: 39dc8d56c9448b4cda4d3054c20e95ccefaf4295
• annotated tag object: 527350a21d14a1f29a3d20745c1580c60b5a408a
• asset size: 14,093,111 bytes
• SHA-256 / SwiftPM checksum: 43319ac6f215e95edc215366116264205902a18d480b87aa4a8c40d381a3b61a
• GitHub immutable-release and asset attestations verified
• anonymous download returned HTTP 200 and was byte-identical to the qualified local asset

The release is an exact-source rebuild because the former Nexus binary is inaccessible and cannot be compared for binary identity. Independent raw Kotlin/Native builds emitted different Mach-O UUIDs, so source-build byte reproducibility is not claimed. Canonical archive packaging was independently repeated and was byte-identical.

Testing

• git diff --check
• swift package dump-package
• clean public SwiftPM resolution of the immutable GitHub asset
• swiftc -parse for every changed Swift source and test
• repo SwiftFormat lint: zero violations across changed Swift sources/tests
• native package template and sidecar-absence contract checks
• clang -Wall -Wextra -Werror -fsyntax-only for changed scrypt on arm64 iOS Simulator, x86_64 iOS Simulator, and x86_64+SSSE3
• standalone RFC 7914 vector plus invalid-N negative test with an exact empty-stdout assertion
• clean Release SSFTransactionHistory build for iPhone 15 Pro / iOS 17.2 simulator, arm64, iOS 14 deployment target
• clean Release SSFTransactionHistory build for generic arm64 iOS device, iOS 14 deployment target, with signing disabled
• committed Modules-Package test plan focused on FearlessCompatibilityTests: 5 passed, 0 failed, 0 skipped
• XNetworking source tests: 108/108 iOS Simulator and 108/108 Android/JVM passed
• XNetworking runtime smoke on iPhone 15 Pro / iOS 17.2 simulator exercised networking/database API and remained alive for 55 seconds
• deliberately wrong SwiftPM checksum: rejected with exit 1 and the exact calculated-versus-declared checksum mismatch
• deliberately nonexistent release asset: rejected with exit 1 and HTTP 404
• archive traversal, absolute-path, symlink-escape, slice, dSYM UUID, linked-library, license, notices, and CycloneDX SBOM validation
• GitHub release and canonical-asset attestation verification

Remaining protected-merge boundary

The former public dependency/DNS blocker is resolved. This PR is still intentionally blocked on the required continuous-integration/jenkins/pr-merge context, eligible independent code-owner approval, and protected merge. GitHub's final push and PR-synchronize webhook deliveries to the active Jenkins hook returned HTTP 502, and the Jenkins hostname did not resolve from the release host, so no required context was created. No physical-device result is claimed for this upstream package; the generic-device compile/link and simulator runtime lanes are the available evidence.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.