Release v1.3.0

.github/workflows/ci.yml

@@ -353,6 +353,48 @@ jobs:
         # dragging a flaky suite in here would intermittently block every PR in the repo.
         run: cd app && npm run test:practices -- --ci --testTimeout=20000
 
+      - name: Navigation layout tests
+        # DEBUG-562. Co-located under src/core/navigation/, which no existing pattern
+        # reaches: `test:unit` is --testPathPattern=unit and `test:integration` is
+        # =integration, and neither matches this directory. Two suites ran on NOBODY'S
+        # pull request until this step existed — including the one that pins the tab
+        # bar's top edge clear of the crisis FAB's touch band, which is the mechanical
+        # form of DEBUG-562's AC2 ruling and the only thing that catches drift on
+        # EITHER side of that collision.
+        #
+        # Wired by PATTERN, never by renaming files toward one — scripts/
+        # ci-uncovered-tests.json records coverage-by-filename as the defect it exists
+        # to remove. Scoped to the directory rather than the file for the same reason.
+        #
+        # `CleanTabNavigator.accessibility.test.tsx` in the same directory is already
+        # reached by the Accessibility job (its name carries `accessibility`); running
+        # it twice is cheap and beats keying this step on a filename.
+        run: cd app && npm run test:navigation -- --ci --testTimeout=20000
+
+      - name: Analytics boundary tests
+        # INFRA-542. Co-located under src/core/analytics/, which no existing pattern
+        # reaches: the two files here carrying `privacy` in their NAME are gated by
+        # test:privacy, and the rest of the directory by nothing — coverage by
+        # filename, the defect scripts/ci-uncovered-tests.json exists to remove.
+        #
+        # This directory is the app's ONLY third-party egress path. Its failure mode
+        # is silent in both directions: trackEvent early-returns without a client, and
+        # PHIFilter drops a violating payload with a log rather than a throw. A pin
+        # here that runs on nobody's PR is worth approximately nothing.
+        #
+        # Wired by PATTERN, never by renaming files toward one (DEBUG-468 precedent).
+        run: cd app && npm run test:analytics -- --ci --testTimeout=20000
+
+      - name: Classical library tests
+        # FEAT-567. passagesContent.test.ts holds the passage SCHEMA checks —
+        # author/work enum membership, principle match, duplicate ids, required
+        # fields — and matched no CI pattern, so a malformed passage could land
+        # unnoticed. The provenance suite that checks TRANSLATORS already runs
+        # (it lives under app/__tests__/unit/); this is the other half.
+        #
+        # Wired by PATTERN, never by renaming files toward one (DEBUG-468 precedent).
+        run: cd app && npm run test:library -- --ci --testTimeout=20000
+
       - name: Upload coverage
         if: always()
         uses: actions/upload-artifact@v6
@@ -362,9 +404,11 @@ jobs:
           retention-days: 14
 
   # Security + compliance — encryption, HIPAA-adjacent checks, dependency
-  # audit. npm audit threshold is `high` (not `moderate`) until the
-  # 5-month-old lockfile is refreshed — see audit-roadmap.md Phase 0/3 for
-  # the planned dependency refresh.
+  # audit. npm audit threshold is `moderate`, tightened from `high` by
+  # MAINT-182 once the explicit allowlist landed (this header claimed `high`
+  # until INFRA-576; .audit-ci.json has said `"moderate": true` since
+  # MAINT-182). The 5-month-old lockfile refresh is still outstanding — see
+  # audit-roadmap.md Phase 0/3.
   security:
     name: Security + compliance
     runs-on: ubuntu-latest
@@ -467,6 +511,15 @@ jobs:
         # JS view hierarchy, so while one is open the root crisis button is not
         # on screen at all — a zero-988-affordance render state.
         #
+        # INFRA-571 added rule 4, which is a different SHAPE: a CALL SITE in
+        # app/src handing presentation to a third-party component that never
+        # appears in our tree (Sentry's feedback widget, expo-sharing's share
+        # sheet, the StoreKit purchase sheet). The <Modal> lives in node_modules,
+        # so rules 1-3 cannot see it, and INFRA-531's crisis-constant-import rule
+        # matches nothing because nothing on those paths imports from
+        # features/crisis/. Its allowlist is keyed <file>::<name> and fails on a
+        # stale entry the same way rule 2 does.
+        #
         # This exists because a Protected Paths row could not catch it. The four
         # sites DEBUG-406 audited live in src/core/components/ and
         # src/features/insights/, neither of which is on that list and neither of
@@ -520,14 +573,13 @@ jobs:
       - name: npm audit
         # MAINT-182: switched from raw `npm audit --audit-level=high` to
         # `audit-ci` with an explicit allowlist at app/.audit-ci.json.
-        # Three transitive CVEs in @expo/config-plugins@56.0.8 are
-        # allowlisted (GHSA-ph9p-34f9-6g65 tmp path traversal,
-        # GHSA-6vfc-qv3f-vr6c markdown-it ReDoS, GHSA-w5hq-g745-h8pq
-        # uuid bounds check) — all build-time only, no patched stable
-        # version available. Threshold is `moderate` (tightened from the
-        # prior `high`) since the allowlist gives precise control.
-        # Drop the GHSAs from .audit-ci.json when @expo/config-plugins
-        # >=56.0.9 ships as stable.
+        # Threshold is `moderate` (tightened from the prior `high`) since
+        # the allowlist gives precise control. Every allowlisted GHSA
+        # carries its own review note and drop-condition in that file's
+        # `$comment` — read there, not here; this list rotted twice.
+        # INFRA-576 retired GHSA-ph9p-34f9-6g65 (tmp), which this comment
+        # had attributed to @expo/config-plugins: the tree's only tmp
+        # arrives via patch-package and is already patched.
         #
         # Historical context (kept for archaeology): the W3 paydown's
         # `npm audit fix` cleared 11 high+critical vulns (xmldom,

.github/workflows/main-branch-health.yml

@@ -44,12 +44,15 @@ name: Main Branch Health
 # exactly this gate, and this probe covers exactly it.
 #
 # WHAT THIS PROBE DOES NOT COVER — say it here so no future reader assumes
-# coverage that is not present. `main`'s .github/workflows/ is separately stale
-# (retired workflows still active there, an older NODE_VERSION, and a
-# job-list that differs from development's). A pull_request into `main` runs
-# MAIN's ci.yml, not this repo's current one, so a green probe does NOT by
-# itself prove a hotfix PR will pass. Those gaps are tracked as INFRA-458 and
-# INFRA-459.
+# coverage that is not present. A pull_request into `main` runs MAIN's ci.yml,
+# not this repo's current one, so a green probe does NOT by itself prove a
+# hotfix PR will pass. `main` carries whatever workflows the last release
+# shipped, so any workflow change merged to `development` since then is absent
+# there. That drift is the normal state between releases, not an incident, and
+# it RE-OPENS after every release — so read
+# `git show origin/main:.github/workflows/ci.yml` rather than this repo's copy
+# before reasoning about what gates a hotfix. INFRA-458 closed the 2026-07-13
+# instance, in which `main` lacked the safety-privacy job outright for six weeks.
 #
 # THIS PROBE STILL CANNOT OBSERVE ITS OWN SILENCE, but something else now does:
 # INFRA-460 added a liveness cross-check as a step in ci.yml's `ci-pass` job,

.github/workflows/release.yml

@@ -38,7 +38,10 @@ jobs:
   build-and-submit:
     name: EAS build + auto-submit to TestFlight
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    # Waits for the build (see the --no-wait note below), so this must cover
+    # EAS queue + build + submit. Observed build alone is ~7 min; queue is the
+    # variable. 15 min was the old budget for a fire-and-forget exit.
+    timeout-minutes: 60
 
     steps:
       - uses: actions/checkout@v5
@@ -114,10 +117,17 @@ jobs:
       # accepts only --auto-submit / --auto-submit-with-profile, and the
       # invented --submit-profile failed every real release from INFRA-146
       # until DEBUG-336 (dry runs skip this step, so it went unnoticed).
-      # --no-wait lets this workflow exit quickly while EAS does
-      # the 20-30 min build + submit asynchronously. Failures surface in
-      # the EAS dashboard, in App Store Connect, and (for EAS-side errors)
-      # in this job's logs.
+      # This step deliberately does NOT pass --no-wait. It used to, and that
+      # made a red build report green: `eas build --no-wait` exits 0 the moment
+      # EAS *accepts* the job, so the workflow's conclusion described the
+      # scheduling, not the build. v1.2.0 errored in `Install dependencies` on
+      # an expired GITHUB_TOKEN while this job reported success, and nothing on
+      # GitHub ever went red. Waiting costs wall-clock and buys a real verdict.
+      #
+      # What waiting still does NOT cover: Apple's own processing of the
+      # uploaded binary. That is asynchronous and reported only by email / App
+      # Store Connect — a successful upload is not an accepted build. ITMS-90683
+      # rejected v1.2.0 minutes after a fully green submit. See the final step.
       # Skipped on a workflow_dispatch with dry_run=true (validation only).
       - name: Build + auto-submit to TestFlight
         if: ${{ !inputs.dry_run }}
@@ -127,5 +137,15 @@ jobs:
             --platform ios \
             --profile production \
             --auto-submit \
-            --non-interactive \
-            --no-wait
+            --non-interactive
+
+      # A green job above means the binary built and uploaded. It does NOT mean
+      # the build is in TestFlight — Apple can still reject it during
+      # processing, and only tells you by email.
+      - name: Report what green does and does not mean
+        if: ${{ !inputs.dry_run && success() }}
+        run: |
+          echo "Build succeeded and the binary was uploaded to App Store Connect."
+          echo "This is NOT yet a TestFlight build: Apple processing can still reject it"
+          echo "(e.g. ITMS-90683), and reports only by email / App Store Connect."
+          echo "Verify: https://appstoreconnect.apple.com/apps/6777579207/testflight/ios"

README.md

@@ -149,7 +149,7 @@ Honest examination for learning and growth (not self-judgment):
 ## ✨ **Core Features**
 
 ### **Philosophical Accuracy**
-- **Classical Sources**: All content grounded in Marcus Aurelius (*Meditations*), Epictetus (*Enchiridion*, *Discourses*), Seneca (*Letters from a Stoic*, *On Anger*)
+- **Classical Sources**: All content grounded in Marcus Aurelius (*Meditations*), Epictetus (*Enchiridion*), Seneca (*Moral Letters to Lucilius*, *On Anger*)
 - **Educational Approach**: Learn authentic Stoic Mindfulness V2 framework, not pop-Stoicism
 - **Virtue Ethics**: Track growth in Wisdom, Justice, Courage, Temperance
 - **Balanced Practice**: Self-compassion integrated to prevent harsh "stoicism" (emotional suppression)
@@ -410,7 +410,7 @@ While Being is primarily an educational tool for Stoic Mindfulness philosophy an
 **Classical Stoic Texts** — public-domain translations, the only renderings shipped in the app:
 - Marcus Aurelius - *Meditations*, trans. George Long (1862; text as digitized in Project Gutenberg ebook #15877, *Thoughts of Marcus Aurelius Antoninus*)
 - Epictetus - *Enchiridion*, trans. Elizabeth Carter (1758)
-- Seneca - *Letters from a Stoic* (*Epistulae Morales*), trans. Richard Mott Gummere (Loeb Classical Library, 1917–1925); *Of Anger*, *Of Peace of Mind* and the other dialogues, trans. Aubrey Stewart (*Minor Dialogues*, 1889); *On Benefits*, trans. Aubrey Stewart (1887)
+- Seneca - *Moral Letters to Lucilius* (*Ad Lucilium Epistulae Morales*), trans. Richard Mott Gummere (Loeb Classical Library, 1917–1925; public domain by pre-1929 US publication; text as digitized on Wikisource from Internet Archive scans `adluciliumepistu01seneuoft` and `adluciliumepistu03seneuoft`); *Of Anger*, *Of Peace of Mind* and the other dialogues, trans. Aubrey Stewart (*Minor Dialogues*, 1889); *On Benefits*, trans. Aubrey Stewart (1887)
 
 Gregory Hays (2002), Robin Hard (2011/2014) and Nicholas White (1983) are excellent modern translations and worth reading, but they are **in copyright** and no rendering from them appears anywhere in this app. That is enforced mechanically by `app/src/features/learn/__tests__/moduleClassicalQuotes.test.ts` and its sibling guards.