Completed milestones

Closed work and evidence. Active work lives in ROADMAP.md. Technical behavior belongs in topic documentation under documentation index.

Google Play authentication

Resolved with GOOPDL_ACCOUNT_EMAIL and GOOPDL_AAS_TOKEN account-based authentication (aas_et/-prefixed token), documented in docs/authentication.md; no anonymous dispenser or committed credential required. Anonymous AuroraOSS dispenser access remains unavailable from GitHub-hosted runners (HTTP 403); CI falls back to verified APKMirror delivery when account secrets are absent. Rejected any option requiring committed credentials or a shared account.

Documentation overhaul

Reviewed uv-based Python project README conventions and j-hc/revanced-magisk-module as structural prior art, then rewrote published documentation for human-first navigation.

• README.md: centered header with slogan and badges, description, requirements, features, installation, quick start, morphe.toml overview, usage tables, documentation index, and credits.
• docs/README.md: index grouped into starting guides, setup, build pipeline in reading order, security and releases, contributing, and project status.
• Rewrote all eleven topic documents with sections, option and field tables, and stated rationale: cli.md (per-command reference, conventions, exit codes), configuration.md (complete field reference with defaults and validation rules), toolchain.md, providers.md, merge.md, build.md, google-play-integrity.md, modules.md, security.md (now including explicit non-goals), releases.md, and THIRD_PARTY.md.
• Credited Morphe, j-hc/revanced-magisk-module, APKEditor, uber-apk-signer, and ReVanced; verified every relative documentation link resolves.

Signed merged stock APK

• APKEditor merged stock output stays marked google_signature_retained = false.
• uber-apk-signer remains sole signer for merged stock and patched APKs.
• Builder signs merged stock immediately after merge, verifies package/version/architecture/ZIP/certificate before Morphe patching, and patches from signed stock.
• Merge provenance records signed-stock hash and certificate SHA-256.
• Regression coverage verifies signed merged stock and merge provenance.

Verified template

• Registered Manual verified build on default branch for workflow_dispatch.
• Confirmed committed template keystore selection and validation without secrets.
• Confirmed template certificate signs every release-matrix APK (run 30224125858).
• Published and verified test release v0.0.0-test.4: release-manifest hashes, both update JSON files, and GitHub provenance passed (run 30249842874).

Google Play anonymous auth fails from GitHub-hosted runners when AuroraOSS returns HTTP 403. CI falls back to verified APKMirror delivery; no credential is published.

Config-driven applications

• Removed hardcoded YouTube/YouTube Music app registry.
• Added TOML-controlled output slug and patched package behavior.
• Added Reddit generic-app regression coverage.
• Resolved APKMirror catalog pages through architecture-specific APK/APKM assets; validated Cloudflare R2 delivery and split extraction (run 30224125858).
• Resolved Uptodown catalog pages through requested APK/XAPK architecture assets.

Signer policy

• Kept EXPECTED_SIGNERS enforcement for YouTube and YouTube Music; unsigned, malformed, and mixed-signer sets remain rejected.
• Added optional per-app expected-signer SHA-256 TOML pin.
• Provenance and build summaries record observed signer certificate SHA-256.
• Unpinned valid signer acceptance emits an explicit build event and documents provider-served signer trust.

Package layout

• Moved flat src/morphe_*.py modules into src/morphe_builder/ and replaced filename prefixes with package-relative imports.

Per-app toolchains

• Per-app patches-source, patches-version, cli-source, and morphe-version override [toolchain] defaults.
• Sources are validated as owner/repo before download.
• Cache and toolchain-provenance.json keys include owner/repo@resolved-tag.
• Toolchains prepare once per distinct source and record exact source, tag, and asset hash.
• Regression coverage builds two apps using different patch sources.

Patch-source and config policy

• Each app invokes Morphe with one --patches bundle; bundle stacking is unsupported.
• Kept ordered [[apps]] tables because named tables lose ordering and indexed validation errors.
• Deferred [defaults] for density, architecture, and Google Play settings until four or more apps make repetition exceed merge complexity.
• Regression coverage rejects multiple patch sources and asserts one --patches argument.

Module stock replacement

• customize.sh installs signed stock/base.apk when installed stock version differs from module target.
• If signer mismatch prevents update, it replaces package; this removes app data and is documented.
• Regression coverage proves version-mismatch installation path and missing-payload abort.

Release readiness

• GitHub-hosted Ubuntu CI validates setup from fresh runners; Windows setup was validated during primary Windows development.
• Documented public shared template-key trust limit prominently in docs/releases.md.
• Added daily config-driven verified-update workflow. It resolves effective CLI/patch source-version tuples, compares tags and SHA-256 values with published APK provenance, skips unchanged toolchains, and blocks publication unless APK version or hash changes.
• Declared stable after user validated application and module behavior on ARM64 device.

Test-release artifact matrix

v0.0.0-test.4 built and released:

• YouTube ARM64 non-root APK and module.
• YouTube ARMv7 APK and module.
• YouTube Music ARM64 non-root APK, root APK, and module.
• YouTube Music ARMv7 non-root APK, root APK, and module.

Artifact matrix is complete.