Clarify the iOS remote-only boundary for App Review

.github/workflows/deploy-site.yml

@@ -17,11 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install, build, and upload
-        uses: withastro/action@v5
+        uses: withastro/action@e84f40bd8d2caa9e768ec82ad30dd81f0b280853 # v6
         with:
           path: website
+          node-version: 24
 
   deploy:
     needs: build
@@ -32,4 +33,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/ios-test.yml

@@ -62,12 +62,62 @@ jobs:
             -project KeyJawn.xcodeproj \
             -scheme KeyJawn \
             -destination "platform=iOS Simulator,name=${{ steps.sim.outputs.name }}" \
+            -skip-testing:KeyJawnUITests/KeyboardIMETests \
             -resultBundlePath "$GITHUB_WORKSPACE/TestResults.xcresult"
 
+      - name: Pick iPad simulator
+        id: ipad-sim
+        run: |
+          set -euo pipefail
+          LIST=$(xcrun simctl list devices available -j)
+          UDID=$(python3 -c '
+          import json
+          import re
+          import sys
+
+          devices_by_runtime = json.load(sys.stdin)["devices"]
+
+          def runtime_version(identifier):
+              match = re.search(r"iOS-(\d+(?:-\d+)*)$", identifier)
+              if not match:
+                  return ()
+              return tuple(int(part) for part in match.group(1).split("-"))
+
+          runtimes = sorted(
+              devices_by_runtime.items(),
+              key=lambda item: runtime_version(item[0]),
+              reverse=True,
+          )
+          for _, devices in runtimes:
+              for device in devices:
+                  if device.get("isAvailable") and device["name"].startswith("iPad"):
+                      print(device["udid"])
+                      raise SystemExit
+          ' <<< "$LIST")
+          if [ -z "$UDID" ]; then
+            echo "No available iPad simulator:"
+            printf '%s\n' "$LIST"
+            exit 1
+          fi
+          echo "udid=$UDID" >> "$GITHUB_OUTPUT"
+
+      - name: Test iPad system keyboard
+        working-directory: ios
+        run: |
+          set -euo pipefail
+          xcodebuild test \
+            -project KeyJawn.xcodeproj \
+            -scheme KeyJawn \
+            -destination "platform=iOS Simulator,id=${{ steps.ipad-sim.outputs.udid }}" \
+            -only-testing:KeyJawnUITests/KeyboardIMETests \
+            -resultBundlePath "$GITHUB_WORKSPACE/IPadKeyboardResults.xcresult"
+
       - name: Upload xcresult
         if: failure()
         uses: actions/upload-artifact@v4
         with:
           name: ios-test-xcresult
-          path: TestResults.xcresult
+          path: |
+            TestResults.xcresult
+            IPadKeyboardResults.xcresult
           if-no-files-found: ignore

.gitignore

@@ -26,11 +26,17 @@ play-service-account.json
 __pycache__/
 *.pyc
 store/keyjawn-store.db
+store/keyjawn-store.db-*
 store/venv/
 store/gunicorn.ctl
 
+# Worker packaging output
+worker/build/
+worker/*.egg-info/
+
 # iOS / Xcode
 xcuserdata/
+ios/scratch/
 ios/KeyJawnKit/.build/
 ios/web-poc/node_modules/
 ios/web-poc/hosts.json

.swift-format

@@ -0,0 +1,7 @@
+{
+    "indentation": {
+        "spaces": 4
+    },
+    "lineLength": 120,
+    "version": 1
+}

CHANGELOG.md

@@ -0,0 +1,51 @@
+# Changelog
+
+This file records user-visible changes and release state. A source change is not
+a distributed release.
+
+## Unreleased
+
+### iOS
+
+- Clarified that terminal commands execute on a user-configured remote SSH
+  server, not on the iPhone or iPad.
+- Removed the session-free Preview terminal and unused review-facing metadata.
+- Clarified that copied-image upload writes one prepared image to a configured
+  remote directory. That upload feature does not browse local files or list,
+  read, or download remote files.
+- Limited copied-image upload to SSH key-authenticated hosts. Password
+  authentication remains available for terminal connections.
+- Clarified that the keyboard extension inserts text or control sequences and
+  that the receiving app decides how to interpret them.
+- Fixed non-ASCII terminal input, which previously sent a single lossy byte.
+- Corrected the keyboard extension metadata to declare its standard ASCII input.
+- Added tests for the remote-execution, local-file, keyboard, and metadata
+  boundaries.
+- Added reviewer-safe iPhone and iPad App Store screenshot sets from the current
+  build.
+
+### Documentation and worker
+
+- Added one App Store metadata and reviewer-response draft with credential-free
+  placeholders.
+- Added platform labels and iOS custom-keyboard limits to active public copy.
+- Added Android, TestFlight, and App Store release-note templates.
+- Updated social-worker prompts so they do not claim unsupported iOS behavior or
+  an App Store launch.
+
+### Distribution state
+
+- KeyJawn Lite 1.3.0 has active internal and closed Google Play test tracks.
+- Google Play production is inactive and Google Play app signing is active.
+  The checked-in Android source and a local verification bundle are version
+  1.4.0, version code 10, and target API 36. The bundle used a disposable key
+  and cannot be uploaded.
+- Apple rejected review build 2 under App Store Review guideline 2.5.2.
+- Source build 9 exists in the repository.
+- A fresh signed build 9 archive was created and verified from the corrected
+  source on August 31, 2026. The exact archive was uploaded, and Apple processed
+  build 9 as valid. Build 9 is selected for version 1.0, manual release is
+  enabled, and the submission is waiting for review. The reviewer response and
+  test steps were included in the review notes. The app is not approved and not
+  publicly released.
+- This remediation made no Android distribution change.