[Programcode]

First piece of the native iOS app from plans/2026-10-08-native-ios-app.md: the Expo app workspace at apps/mobile, the five-tab shell, sign-in, and the screenshot harness that stands in for a simulator on the VPS. It targets the long-lived feat/native-ios branch, which reaches main only when Adam approves a milestone.

What the app does so far:

• Signs in with an email code or a demo code, through the same Supabase calls as the website's AuthProvider. Google sign-in waits for the first development build, because Expo Go cannot receive an OAuth redirect, and Sign in with Apple comes after that.
• Shows the five tabs from the mocks (Debate, Prepare, Practice, Library, You) with native tabs on iOS and a web fallback for the preview. Debate shows the signed-out and no-debate states; the other tabs say what is still web-only. You shows the account and signs out.
• Keeps the session in an encrypted store (an AES key in SecureStore, the ciphertext in AsyncStorage), refreshes it only while the app is in the foreground, and survives a cold start without a network. That last case was a real bug while building: supabase-js reports no session for about 30 seconds offline, so the app now starts from the stored session.
• Talks to staging by default. Production is opt-in through EXPO_PUBLIC_SUPABASE_ENV=production and never a fallback. The project URLs and anon keys have one copy, src/lib/supabase/projects.ts.
• Uses the mocks' colours, Inter, the pale-blue icon tiles and the blue-to-teal gradient for the one main action, with a dark variant from the website's palette. New strings live under mobile.* in the three catalogs.

Every native module is in the App Store build of Expo Go, so Adam can run this milestone on his iPhone from the VPS dev server over the tailnet with no EAS build. docs/development.md has the runbook; the Metro manifest was checked to hand out the tailnet hostname.

Repo changes outside the app:

• apps/* joins the npm workspaces. The lockfile diff is additions plus dev-flag changes; no pre-existing package changed version. React 18 stays on the web and React 19 in the app, and the app's web export bundles only 19.
• vercel.json gets an installCommand that installs the root and packages/core only, so website deploys skip the React Native tree. Proven in a clean clone with npm 10.9.9 (Vercel's Node 22) and 12.0.2: 853 packages, no expo or react-native, build passes.
• ESLint gets a block for the app with React Native globals, react-hooks, and an error on window, document and web storage outside *.web.ts(x) files and scripts/. npm run typecheck runs the app's tsc; knip runs the app as a workspace.
• Docs: AGENTS.md and README system maps, the mobile boundary in docs/architecture.md, the runbook in docs/development.md, and the Vercel install note in docs/operations.md.

Checks, run locally on Node 22.23.2 because GitHub Actions starts no jobs on this account (billing):

• npm run verify exit 0 at the final head: 273 Vitest tests, 30 collaboration tests, 333 Deno Edge Function tests, the build and boundary check, the service-worker test, 30 Chromium smoke e2e tests.
• Clean clones: default npm ci with scripts enabled, then lint, typecheck, build and the app's web export, all pass at each of the four commits; the Vercel install command variant builds the website.
• Screenshots of the web export, 65 files under .verify/mobile-shots/: sign-in, its error and demo states, and the signed-in tabs, at iPhone and iPad sizes, light and dark, English and Hungarian, plus the offline cold start. Signed-in shots used a staging demo code; the address on You is masked. A selection is attached below.

Not proven here: anything on a real iPhone (native tabs, large titles, the encrypted store, App Transport Security against a plain-HTTP tailnet name), email-code sign-in end to end, and the sign-out button. Those are the milestone checks on Adam's phone.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Oct 9, 2026 6:37am UTC
debatelab-staging	Ready	Preview	Oct 9, 2026 6:37am UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Free
• Run ID: b99760e9-b3a3-4a90-93a3-2b46292bf149

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

Screenshots of the web export at the final head (the native app is close to this but has native tabs, large titles and sheets):

[Programcode]

Review record, round 1 at b87826b (Codex, gpt-6.1-sol, high effort, detached snapshot). Five findings, all confirmed against the code and fixed on the new head:

• High: the session key could come from Math.random. expo-crypto's synchronous getRandomBytes falls back to Math.random in development builds without the bridge sync hook, which is how Expo Go runs. Fixed in 44fc160: the key comes from getRandomBytesAsync, which has no fallback.
• Medium: overlapping session writes could pair a key with another write's ciphertext. Fixed in 44fc160: reads, writes and removes run one at a time per key through a promise queue, and a failed write does not block the next. Test: apps/mobile/src/lib/device-storage.test.ts (c5c791b), three cases; two of them fail against the old adapter, and the old code returned garbage rather than null.
• Medium: signing out offline left the session on the device. supabase-js returns the failed refresh before removing storage. Fixed in cc13479: sign-out tries global, then local, then always removes the stored session and clears the React state. Proven in the app with an expired token offline: sign-in shown after 67 ms, nothing left in storage.
• Medium: the harness's offline check asserted before the first auth event. Fixed in 48ca94b: the root view exposes auth-settled once the first onAuthStateChange event is handled, and the check waits for it. Mutation proof: with the INITIAL_SESSION fallback removed the check fails ("Offline cold start signed the user out"); restored, it passes.
• Low: server error strings showed in English under a Hungarian or Spanish interface. Fixed in 6b0403c: sign-in-errors.ts maps each demo-code-login error and the common auth codes to mobile.signIn.errors.* keys in all three catalogs, with a translated generic fallback and the raw message logged. Checked live against staging in Hungarian and Spanish. The website has the same gap and is left as is.

Also on the new head: e0ce1dc drops the now-unreachable sign-out error state on the You tab.

Accepted as is: a token refresh already in flight when the user signs out could, in theory, write the session back. That race is in supabase-js itself and the website shares it. Offline, sign-out waits behind supabase-js's first-load retries (about 30 seconds) before it completes.

[Programcode]

Review record, round 2 at e0ce1dc (Codex, gpt-6.1-sol, high effort, detached snapshot, with the round-1 findings and dispositions in the brief): no findings. It re-read the five fixes, the regression test and the surrounding auth and storage code, confirmed the old adapter fails both race cases of the new test, probed queue cleanup, sign-out, stale reads and the error mapping, and checked that the effective website and packages/core ESLint configuration is unchanged, the docs check passes, and the website production build with its boundary checker passes.

Both Vercel projects built e0ce1dc with the new install command. GitHub Actions started no jobs (billing); the checks of record are the local run in the description, repeated at the final head: npm run verify exit 0 with 276 Vitest tests (the three new storage cases included), 30 collaboration tests, 333 Deno tests, the build, the service-worker test and 30 Chromium smoke tests. Copilot was out of quota and CodeRabbit does not review PRs against non-default branches.