# Default server, Sign in, guest joining, server setting — 2026-09-24

Branch `feat/default-server` off `f91de82`. The signed-out home names the
server (calls.oficina.works by default) with one **Sign in** and a secondary
**Join a call as a guest**; the server is a setting (Mac Settings scene,
iPhone gear sheet). M1 Max, macOS 27.

| Check | Result |
| --- | --- |
| `build-bridge.sh` | Rebuilt; RNNoise and DeepFilter cache hits at their pins |
| `swift test` | 133 tests, 0 failures, 1 skipped (keychain); adds `DefaultServerTests` (17) |
| `GOTOOLCHAIN=go1.26.5 make ci`, `make native-test` | Passed with `GOFLAGS=-count=1` |
| `make native-mac` | Built; launched and stayed up |
| `make iphone` | Simulator build succeeded |
| `CGO_ENABLED=0 make browser` | 33 of 34 in the full run while an Xcode build shared the machine; `mutualshare` (a frame-flow window stalled) passed alone on an idle machine. No web code changed |
| `make native-browser` | Passed; `TestNativeBrowserAuthentication` gains a `server` case (Sign in's instance-root handoff) |
| iPhone UI tests | `testSignedOutHomeIsSignInAndGuest`, `testInvalidGuestLink` passed on the simulator |
| `TestIPhoneSafariAuthentication` | Member (Sign in, `-CallsServer`) and guest (guest screen) passed. The guest case was already failing on main: the web's guest screen needs its "sign in" link followed, and Safari's autofill bubble could take the tap on the submit button |
| Snapshots | `CallsInterop --lobby-snapshots` renders the new states (see DESIGN.md) |

# Per-call device routing on LiveKit's module — 2026-09-23

Branch `merge/native-call-devices`: `native-call-devices` (`410ddcb`, the
source of Calls 0.2.1 build 3) merged into `origin/main` at `1ab8a2e`. The
Mac stays on LiveKit's AVAudioEngine module with DeepFilterNet 3; build 3's
CoreAudio HAL device (`CallsAudio`) was dropped, because WebRTC's
custom-audio-device constructor takes no audio processing module. Its routing
rules were carried onto the module (`AudioRoutes`), and its camera discovery,
refresh and restore-on-refusal kept. M1 Max, macOS 27.

| Check | Result |
| --- | --- |
| `build-bridge.sh`, `build-rnnoise.sh`, `build-deepfilter.sh` | Built fresh in a new worktree (no cache) |
| `deepfilter-notices.py` after that build | Regenerates `LICENSE.deepfilternet-crates` byte for byte (90 crates) |
| `swift test` | 116 tests, 0 failures, 1 skipped (keychain test, as before); includes the seven `CallAudioSelectionTests` and a non-default choice on the real module |
| `GOTOOLCHAIN=go1.26.5 make ci`, `make race`, `make native-test` | Passed with `GOFLAGS=-count=1` (no cached results) |
| `make native-mac` | Built; signature verifies; bundle carries LiveKitWebRTC, the DeepFilterNet model, all five notices and `PATENTS.webrtc`; launched and stayed up |
| `make iphone` | Simulator build succeeded |
| `CGO_ENABLED=0 make browser` | 34 of 34 scenarios passed |
| `make native-browser` | Passed (auth, member, guest, chat); CallsInterop rebuilt by the target; the new per-call audio step ran and passed, DeepFilterNet 3 processed the synthetic microphone |

Found while porting: LiveKit's engine module (M150) never reports which device
it is on (`inputDevice`/`outputDevice` read back nil — confirmed on this
machine), and `trySetInputDevice`/`trySetOutputDevice` return YES when the
native call fails (read in the source). Main's pickers read the device back,
so a non-default choice would have been reported as refused; the choice is
now kept by `AudioRoutes`.

Not verified here: this Mac lists only the default microphone and speaker,
so switching between two real devices, unplugging a chosen one, and the
module following a new system default or sample rate need a hands-on pass
with a USB or Bluetooth device.

---

# LiveKit WebRTC and neural noise reduction — 2026-09-23

Branch: `feat/livekit-webrtc-audio`, based on `origin/main` at `3846ca4`. Not
merged, not deployed. Machine: M1 Max, macOS 27, Xcode 26.6.

| Check | Result |
| --- | --- |
| `./native/scripts/build-bridge.sh` | Passed |
| `native/scripts/build-rnnoise.sh`, `build-deepfilter.sh` | Built both xcframeworks from their pins (DeepFilter: Rust 1.92.0 via rustup, cbindgen 0.29.2) |
| `swift test` (native/apple) | 48 tests, 0 failures, including the suppressor fixture tests |
| `make native-test` (uncached, `GOFLAGS=-count=1`) | Passed |
| `make native-mac` | Built; ad hoc signature verifies; bundle carries LiveKitWebRTC.framework, the DeepFilterNet model and the RNNoise/DeepFilterNet notices; app launches |
| `make iphone` + `build-for-testing` (simulator) | Build and test build succeeded; RNNoise linked, DeepFilter not |
| `make native-browser` | Passed (member, guest, chat); asserts DeepFilterNet 3 processed the synthetic microphone and WebRTC reports its suppressor and gain off, echo cancellation on |
| `CGO_ENABLED=0 make browser` | 33 of 34 passed; `switching` (web camera switch) failed once under load from a concurrent simulator run and passed alone. This branch does not touch the web client |
| `make iphone-browser` | Failed, and fails identically on a clean `origin/main` worktree (both peers stuck `reconnecting`, 0 frames); the Safari UI test flaked differently on each run. Environmental, not this branch; the first run's media test did pass on this branch |
| `GOTOOLCHAIN=go1.26.5 make ci` | Passed |

Fixture (synthesised speech at -23 dBFS with seeded hiss and key clicks, each
suppressor alone): RNNoise takes the noise-only lead-in from -41 to -71 dBFS
and DeepFilterNet 3 to -69 dBFS (both at their 30 dB limit); speech holds at
-24.5 → -24.6 dBFS; 99% of voiced frames kept by each. Per 10 ms frame:
RNNoise 0.69–0.81 ms, DeepFilterNet 1.16–1.23 ms (about 7–8% and 12% of one
core). DeepFilterNet's model loads in 0.26–0.35 s. In the native/browser
gate, as wall-clock share of the audio thread with Chromium on the same
machine: DeepFilterNet median 15.1–15.3% (13–27%), RNNoise median 12.9%.

Needs a real call or device: echo with speakers (software AEC3 on Mac, now on
the AVAudioEngine module), typing, wind and room echo against both models;
that SpeechGain lifts a quiet talker without audible pumping; switching Mac
microphone and speaker mid-call (only one of each on the test machine);
Bluetooth at 16 kHz handing back to WebRTC's suppressor; Voice Isolation on
iPhone standing ours aside; whether iPhone accepts the platform-mode options
(the readout says if not); DeepFilterNet's cost on an iPhone. The Mac audio
bug (growling) is not addressed and the module change may move it either way.
A test process cannot get microphone permission, so Apple voice processing's
live state on Mac and the Mic Mode menu could not be observed.

---

# Per-call device routing — 2026-09-21

Superseded for audio when this branch was merged into main on 2026-09-23:
the CoreAudio HAL device (`CallsAudio`) it describes was not kept, and its
routing rules now run on LiveKit's audio device module (see the README).

Worktree: `meet-call-devices`, branch `native-call-devices`, based on fetched
`origin/main` at `3846ca4`. Calls 0.2.1 (build 3) is signed with Team Tito Limited, notarized, and published.
Download: https://raw.amadan.net/oficina/native-releases/deb0bac4cdf6ef23a8edca9094f41260fc02143d/calls/releases/net.amadan.oficina.calls-3.zip

Independent release review: GPT-6 Astra (`release_review`), approved with the
physical-device acceptance limitations below. The extracted, notarized app also
passed Gatekeeper and a relocated launch smoke test.

- Mac app builds and its development signature verifies; iPhone simulator builds.
- All 29 Swift tests pass, including independent per-call selections, reset on
  leave, refused changes, disconnection fallback, following system defaults,
  and reopening devices after sample-rate changes.
- Native/browser member and guest calls pass with the new HAL audio path.
  Reopening both audio routes and refusing a missing microphone preserve
  increasing audio counters and the peer connection. Camera switching, queued
  camera changes, refusal, stream renewal and leaving also pass.
- Native/browser chat passes. The shipping DevicePanel was rendered and visually
  inspected in `native/build/call-devices.png`.
- `GOTOOLCHAIN=go1.26.5 make browser` passes all 34 Chromium scenarios.
- `GOTOOLCHAIN=go1.26.5 make ci` passes. The repository pins this Go version for
  its dependency-notice inventory.

The live gate uses the system's audio route and a synthetic camera. Audio packet
counters establish transport continuity, not audible quality. Physically changing
between USB/Bluetooth devices, unplugging them, and checking echo cancellation
remain hands-on acceptance checks; unit tests cover the routing policy.

---

# Native completion verification — 2026-09-12

Branch: `codex/iphone-and-mirrored-preview`, based on `86ed9f3`.

- Final `make ci`, server race gate, and shared-core race gate pass.
- Full Chromium call gate passes (539 seconds) for this web snapshot.
- Final native/browser gate passes (81 seconds), including member/guest media,
  browser authorization, and bidirectional chat.
- iPhone Safari member/guest authorization and native peer media tests pass
  on iOS 26.5 Simulator (154 seconds). Peers retain media through stream renewal
  and leave cleanly. Simulator media uses synthetic video and disables audio.
- Mac app builds, its ad hoc signature verifies, and it is installed and
  relaunched at `/Applications/Calls.app` with the approved icon and license.
- iPhone development build signs successfully with the personal development
  team and is installed on Paul's iPhone 16 Pro. Initial launch was blocked by
  the phone's lock screen; physical launch/permissions and audible audio await
  an unlocked-device acceptance pass.
- Independent GPT-6 Astra source review approved the local-build milestone
  after fixing cancellation outcomes for queued chat and obsolete join/leave
  operations. A regression test verifies all accepted queued chat gets an
  explicit failure on re-registration; it passes under the race detector.

The server update includes member-only repeat sharing of encrypted invitations
and its additive migration. Older invitations remain valid. Native credentials
remain in memory; calls are foreground-only on iPhone. Developer ID notarization,
TestFlight, physical audio/device routing, background calling and native screen
sharing remain outside this local-install milestone.

The earlier milestone record follows for historical context.

---

# Mac milestone verification — 2026-09-11

Base: fetched `origin/main` at `a283c53`, then fast-forwarded the working branch
to the newer `origin/integrate/home-sso-release` at `eee686a`. Working branch:
`codex/native-mac-milestone`. No production deployment was performed.

| Check | Result |
| --- | --- |
| `CGO_ENABLED=0 make ci` | Passed: vet, formatting, all Go tests and migration agreement |
| `make race` | Passed across `internal/...` |
| `CGO_ENABLED=0 make browser` | Passed all 31 Chromium scenarios; 541 seconds for the browser suite |
| `make native-test` | Passed shared core, bridge and core race tests |
| `make native-mac` | Built the local Mac app with a macOS 14 deployment target |
| `codesign --verify --deep --strict native/build/Calls.app` | Passed for the ad hoc development signature |
| `TestNativeMacCallsBrowser` | Passed member and guest cases; final run 26.49 seconds |
| App launch and opening-window inspection | Passed |

The native/browser test observed video decoded in both directions, audio bytes
received in both directions, no incoming guest media before admission, increasing
media counters after repeated three-second stream renewals, preservation of the
native participation ID, and removal of the browser's remote tile after the
native client left. It uses a synthetic native camera implemented only in the
separate `CallsInterop` executable, Chromium's fake media device, and real
magic-link sessions on an isolated local Calls server. Audio traffic counters do
not prove audible microphone/speaker quality.

`TestNativeCoreUsesHomeSessionAndResumesCall` separately runs the shared Go
client through the real Home assertion/linking fixture, stream renewal and
meeting end. `TestNativeCoreCannotUseAgentBearerAsHumanSession` rejects agent
credentials for calls. Metadata isolation tests cover an actual second meeting
the guest cannot access. Unit tests exercise SSE bounds and framing, redirect
refusal, retry sequence preservation, duplicate delivery and stale native
callbacks after a pair generation changes.

Unverified physical-device acceptance: camera/microphone permission prompts,
audio-device changes, sleep/wake, and a live Home passkey ceremony.
Distribution signing/notarization,
iOS, screen sharing and full long-call TURN renewal parity remain outside this
first milestone. The result is a local development app, not a public release.


The webview sign-in implementation was replaced with system-browser approval.
`TestNativeBrowserAuthentication` covers member and guest sign-in in a fresh
Chromium context with JavaScript disabled: the email opens in a separate tab,
approval hands a session to the shared Go client, and that session can read the
meeting metadata. Server tests cover Home identity/authentication-time
preservation, distinct session tokens, explicit POST approval, CSRF rejection,
wrong proof, replay, expiration, revoked source sessions, and unsafe targets.

Handoff revision checks (2026-09-11): CI and migration agreement passed; core
and bridge tests passed with the core race detector; server authentication race
tests passed; member/guest browser handoff and code comparison passed (65.13 s);
native/browser media and departure checks passed (84.33 s). The rebuilt app's
ad hoc signature verified, and the app was reopened locally. Production sign-in
requires deployment of the new server routes; no deployment was performed.

The full `CGO_ENABLED=0 make browser` gate also passed all 31 scenarios
after the handoff change (797.94 s for Chromium).