Backend security stack and Flyway-style migrations for the app and the server

.github/scripts/build_javadocs.sh

@@ -145,8 +145,9 @@ fi
 # declare nothing outside java.*, so the JDK resolves them here as it does the
 # rest.
 #
-# The shared classes keep their package-info.java, so a shared package has the
-# same description in both references. SharedWithBackend itself and the rest of
+# The shared classes keep their package-info.java, so a package shared whole has
+# the same description in both references; one shared in part is described for
+# the server in vm/backend/package-docs (see where it is staged, below). SharedWithBackend itself and the rest of
 # com.codename1.impl are staged for symbol resolution and filtered out of the
 # documented set, exactly as for the client API above.
 BACKEND_DIR="$ROOT_DIR/vm/backend"
@@ -162,6 +163,18 @@ cp -r "$BACKEND_DIR/impl/parparvm/." "$BACKEND_STAGE/"
 # document.
 cp -r "$BACKEND_DIR/test/src/." "$BACKEND_STAGE/"
 cp -r "$BACKEND_DIR/test/parparvm/." "$BACKEND_STAGE/"
+# A package the backend shares only PART of cannot take the core's description:
+# that one names every class of the package, and the ones a server does not have
+# are references this run cannot resolve -- which doclint fails, and which the
+# website's doclet would otherwise print as plain text where a link was meant.
+# vm/backend/package-docs holds the server's own description of such a package
+# (com.codename1.security: the digests and one-time passwords, without the
+# client's ciphers and key storage). Staged before the loop below, whose
+# "unless one is already there" then leaves it in place. It cannot live in
+# vm/backend/src: shared-sources.sh refuses any file there that has a core twin.
+if [ -d "$BACKEND_DIR/package-docs" ]; then
+  cp -r "$BACKEND_DIR/package-docs/." "$BACKEND_STAGE/"
+fi
 while IFS= read -r shared; do
   rel="${shared#"$CN1_DIR/src/"}"
   mkdir -p "$BACKEND_STAGE/$(dirname "$rel")"

.github/workflows/blog-prose.yml

@@ -135,8 +135,7 @@ jobs:
         run: |
           set -euo pipefail
           cd scripts
-          npm init -y 2>/dev/null || true
-          npm install playwright
+          npm ci
           # Playwright shells out to apt for the OS-level deps, so the runner
           # image's third-party sources have to be pruned FIRST -- a broken
           # vendor mirror makes its apt-get fail as a whole and it reports

.github/workflows/cn1playground-language.yml

@@ -114,7 +114,7 @@ jobs:
         run: |
           set -euo pipefail
           cd scripts
-          npm install playwright
+          npm ci
           bash "$GITHUB_WORKSPACE/scripts/ci/apt-get-update.sh"
           npx playwright install-deps chromium firefox
           npx playwright install chromium firefox

.github/workflows/identity-stack.yml

@@ -294,11 +294,6 @@ jobs:
         run: |
           set -euo pipefail
           cd Ports/iOSPort/nativeSources
-          SDK="$(xcrun --show-sdk-path --sdk iphoneos)"
-          if [ ! -d "$SDK" ]; then
-            echo "::error::No iPhoneOS SDK available on this runner"
-            exit 1
-          fi
           # The .m files include "xmlvm.h" and use ParparVM's CN1_THREAD_*
           # macros. Those live in the ParparVM build pipeline, not in this
           # checkout, so we stage a minimal shim header that defines the
@@ -328,38 +323,48 @@ jobs:
           #define CN1_THREAD_GET_STATE_PASS_ARG threadStateData,
           #define CN1_THREAD_GET_STATE_PASS_SINGLE_ARG threadStateData
           EOF
-          # Exercise BOTH configurations -- the "stubs" path (apps that
-          # don't reference com.codename1.io.oidc / AppleSignIn) and the
-          # "full" path (apps that do). IPhoneBuilder flips the macros on
-          # via the classpath scanner; we want either to keep building.
-          for label in stubs full; do
-            extra=""
-            if [ "$label" = full ]; then
-              extra="-DCN1_INCLUDE_OIDC -DCN1_INCLUDE_APPLESIGNIN -DCN1_INCLUDE_WEBAUTHN"
-            fi
-            echo "::group::clang $label"
-            # -fmodules because the port's Metal sources use @import, and the
-            # real build compiles with CLANG_ENABLE_MODULES=YES. The renderer
-            # header used to be unreachable here -- CN1_USE_METAL was a
-            # commented-out define the builder uncommented -- so a lint with
-            # modules off never saw the @import. Metal is the only renderer
-            # now and the define is unconditional, so this lint has to compile
-            # the way the product does or it fails on syntax the product
-            # accepts.
-            xcrun --sdk iphoneos clang \
-                -fsyntax-only \
-                -fmodules \
-                -fmodules-cache-path="$STUB/modulecache" \
-                -arch arm64 \
-                -fobjc-arc \
-                -Werror=incompatible-pointer-types \
-                -Werror=objc-method-access \
-                -Wno-unused-parameter \
-                -I"$STUB" \
-                -DNEW_CODENAME_ONE_VM=1 \
-                $extra \
-                CN1OidcBrowser.m \
-                CN1AppleSignIn.m \
-                CN1WebAuthn.m
-            echo "::endgroup::"
+          # Identity sources are copied into the watch companion too. Compile
+          # the actual SDK variants so unavailable presentation APIs fail here.
+          for sdk in iphoneos watchos; do
+            SDK="$(xcrun --show-sdk-path --sdk "$sdk")"
+            case "$sdk" in
+              iphoneos) target=arm64-apple-ios12.0 ;;
+              watchos) target=arm64_32-apple-watchos6.2 ;;
+            esac
+            # Exercise BOTH configurations -- the "stubs" path (apps that
+            # don't reference com.codename1.io.oidc / AppleSignIn) and the
+            # "full" path (apps that do). IPhoneBuilder flips the macros on
+            # via the classpath scanner; we want either to keep building.
+            for label in stubs full; do
+              extra=""
+              if [ "$label" = full ]; then
+                extra="-DCN1_INCLUDE_OIDC -DCN1_INCLUDE_APPLESIGNIN -DCN1_INCLUDE_WEBAUTHN"
+              fi
+              echo "::group::clang $sdk $label"
+              # -fmodules because the port's Metal sources use @import, and the
+              # real build compiles with CLANG_ENABLE_MODULES=YES. The renderer
+              # header used to be unreachable here -- CN1_USE_METAL was a
+              # commented-out define the builder uncommented -- so a lint with
+              # modules off never saw the @import. Metal is the only renderer
+              # now and the define is unconditional, so this lint has to compile
+              # the way the product does or it fails on syntax the product
+              # accepts.
+              xcrun --sdk "$sdk" clang \
+                  -fsyntax-only \
+                  -fmodules \
+                  -fmodules-cache-path="$STUB/modulecache" \
+                  -target "$target" \
+                  -isysroot "$SDK" \
+                  -fobjc-arc \
+                  -Werror=incompatible-pointer-types \
+                  -Werror=objc-method-access \
+                  -Wno-unused-parameter \
+                  -I"$STUB" \
+                  -DNEW_CODENAME_ONE_VM=1 \
+                  $extra \
+                  CN1OidcBrowser.m \
+                  CN1AppleSignIn.m \
+                  CN1WebAuthn.m
+              echo "::endgroup::"
+            done
           done

.github/workflows/javadocs.yml

@@ -9,6 +9,7 @@ on:
       - 'vm/backend/src/**/*.java'
       - 'vm/backend/impl/**/*.java'
       - 'vm/backend/shared-sources.sh'
+      - 'vm/backend/package-docs/**'
       - 'maven/**/src/main/java/**/*.java'
       - '.github/scripts/build_javadocs.sh'
       - 'scripts/check-package-info.sh'

.github/workflows/parparvm-tests.yml

@@ -41,6 +41,14 @@ on:
       - 'CodenameOne/src/com/codename1/annotations/JsonIgnore.java'
       - 'CodenameOne/src/com/codename1/annotations/JsonProperty.java'
       - 'CodenameOne/src/com/codename1/io/gzip/**'
+      - 'CodenameOne/src/com/codename1/migration/**'
+      - 'CodenameOne/src/com/codename1/impl/migration/**'
+      - 'CodenameOne/src/com/codename1/security/Hash.java'
+      - 'CodenameOne/src/com/codename1/security/Hmac.java'
+      - 'CodenameOne/src/com/codename1/security/MessageDigestImpl.java'
+      - 'CodenameOne/src/com/codename1/security/Otp.java'
+      - 'CodenameOne/src/com/codename1/security/Base32.java'
+      - 'CodenameOne/src/com/codename1/security/CryptoException.java'
       - '!vm/**/README.md'
       - '!vm/**/readme.md'
       - '!vm/**/docs/**'
@@ -85,6 +93,14 @@ on:
       - 'CodenameOne/src/com/codename1/annotations/JsonIgnore.java'
       - 'CodenameOne/src/com/codename1/annotations/JsonProperty.java'
       - 'CodenameOne/src/com/codename1/io/gzip/**'
+      - 'CodenameOne/src/com/codename1/migration/**'
+      - 'CodenameOne/src/com/codename1/impl/migration/**'
+      - 'CodenameOne/src/com/codename1/security/Hash.java'
+      - 'CodenameOne/src/com/codename1/security/Hmac.java'
+      - 'CodenameOne/src/com/codename1/security/MessageDigestImpl.java'
+      - 'CodenameOne/src/com/codename1/security/Otp.java'
+      - 'CodenameOne/src/com/codename1/security/Base32.java'
+      - 'CodenameOne/src/com/codename1/security/CryptoException.java'
       - '!vm/**/README.md'
       - '!vm/**/readme.md'
       - '!vm/**/docs/**'
@@ -148,10 +164,21 @@ jobs:
         run: vm/benchmarks/check-ablation-arms.sh
         env:
           CN1_ABLATION_CFLAGS: -O1
+      - name: Preserve ablation failure logs
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: ablation-failure-logs
+          path: |
+            vm/benchmarks/target/ablation/*.log
+            vm/benchmarks/target/ablation/*.run
+          if-no-files-found: warn
 
   vm-tests:
     runs-on: ubuntu-24.04
-    timeout-minutes: 90
+    # The full suite takes about an hour before the bounded GC benchmark arms.
+    # Leave time for both; each benchmark workload retains its own timeout.
+    timeout-minutes: 120
     # The two database engines the backend speaks a wire protocol to.
     #
     # BackendDatabaseTest and BackendOrmTest run one body of assertions against

.github/workflows/port-status-nightly.yml

@@ -80,8 +80,7 @@ jobs:
       - name: Install Playwright browser
         working-directory: scripts
         run: |
-          npm init -y 2>/dev/null || true
-          npm install playwright
+          npm ci
           # Playwright shells out to apt for the OS-level deps, so the runner
           # image's third-party sources have to be pruned FIRST -- a broken
           # vendor mirror makes its apt-get fail as a whole and it reports

.github/workflows/scripts-android.yml

@@ -52,6 +52,7 @@ name: Test Android build scripts
       # transport.
       - 'scripts/hellocodenameone/backend/**'
       - 'scripts/lib/cn1ss.sh'
+      - 'scripts/ci/tests/cn1ss-selfcheck-test.sh'
   push:
     branches:
       - master
@@ -98,6 +99,7 @@ name: Test Android build scripts
       # transport.
       - 'scripts/hellocodenameone/backend/**'
       - 'scripts/lib/cn1ss.sh'
+      - 'scripts/ci/tests/cn1ss-selfcheck-test.sh'
 
 # The token in secrets.CN1SS_GH_TOKEN was generated on
 # Oct 16th 2025. If in Oct 2026 builds start failing, it
@@ -155,6 +157,8 @@ jobs:
       CN1SS_FAIL_ON_TEST_PROBLEMS: '1'
     steps:
       - uses: actions/checkout@v6
+      - name: Test screenshot server startup probe
+        run: bash scripts/ci/tests/cn1ss-selfcheck-test.sh
       - name: Set TMPDIR
         run: echo "TMPDIR=${{ runner.temp }}" >> $GITHUB_ENV
       - name: Free Disk Space

.github/workflows/scripts-ios-native.yml

@@ -26,7 +26,10 @@ jobs:
     permissions:
       contents: read
     runs-on: macos-15
-    timeout-minutes: 45
+    # Allow setup plus the separately bounded 30-minute generation and 45-minute
+    # XCTest build/run steps. A 45-minute job cap canceled a progressing native
+    # build after only 34 minutes of the XCTest step in run 37728629000.
+    timeout-minutes: 90
     steps:
       - uses: actions/checkout@v6
 

.github/workflows/scripts-javascript.yml

@@ -224,7 +224,7 @@ jobs:
         uses: actions/cache@v5
         with:
           path: scripts/node_modules
-          key: ${{ runner.os }}-scripts-npm-playwright-v1
+          key: ${{ runner.os }}-scripts-npm-${{ hashFiles('scripts/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-scripts-npm-
 
@@ -233,29 +233,23 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ~/.cache/ms-playwright
-          key: ${{ runner.os }}-playwright-chromium-firefox-v1
+          key: ${{ runner.os }}-playwright-chromium-firefox-${{ hashFiles('scripts/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-playwright-
 
       - name: Install Playwright Chromium
         run: |
           cd scripts
-          npm init -y 2>/dev/null || true
-          npm install playwright
+          npm ci
           # OS-level deps (apt packages) aren't cached so always install them.
           # Playwright shells out to apt for the OS-level deps, so the runner
           # image's third-party sources have to be pruned FIRST -- a broken
           # vendor mirror makes its apt-get fail as a whole and it reports
           # only "Failed to install browser dependencies".
           bash "$GITHUB_WORKSPACE/scripts/ci/apt-get-update.sh"
           npx playwright install-deps chromium firefox
-          # `npm install playwright` resolves the floating version, so the
-          # cached browser binary can drift away from what the freshly
-          # installed Playwright expects (the cache only stores the binary).
-          # `install chromium` is a no-op when the versions match and
-          # re-downloads the right build when they don't, so it makes the
-          # job resilient to Playwright revving its bundled chromium build
-          # in between cache writes.
+          # Install the browser revisions selected by the committed lockfile;
+          # a restored fallback cache may contain a different revision.
           npx playwright install chromium
           # Firefox for the composited rendering check below: issue #5910 was reported
           # from Firefox, and the two engines composite the canvas and the text layer

.github/workflows/website-docs.yml

@@ -45,6 +45,7 @@ on:
       - 'vm/backend/src/**'
       - 'vm/backend/impl/**'
       - 'vm/backend/shared-sources.sh'
+      - 'vm/backend/package-docs/**'
       # build.sh renders the Port Status JDK 25 table with this script's `summary`, so a
       # change to its output shape must go through the Hugo build and validate_port_status.
       # The baseline DATA (vm/selfhost/perf-baseline/**) is left out on purpose: a row
@@ -83,6 +84,7 @@ on:
       - 'vm/backend/src/**'
       - 'vm/backend/impl/**'
       - 'vm/backend/shared-sources.sh'
+      - 'vm/backend/package-docs/**'
       # As above: the JDK 25 table's renderer.
       - 'vm/selfhost/perf_baseline.py'
       - '.github/workflows/website-docs.yml'
@@ -363,7 +365,7 @@ jobs:
         run: |
           set -euo pipefail
           cd scripts
-          npm install playwright
+          npm ci
           bash "$GITHUB_WORKSPACE/scripts/ci/apt-get-update.sh"
           npx playwright install-deps chromium firefox
           npx playwright install chromium firefox

.gitignore

@@ -135,6 +135,8 @@ dependency-reduced-pom.xml
 /.playwright-cli
 package-lock.json
 package.json
+!/scripts/package.json
+!/scripts/package-lock.json
 .claude/
 
 # Local screenshot/perf bench output

CLAUDE.md

@@ -375,7 +375,13 @@ The backend is held to the client's gates:
   `package-info.java` per package; no since markers.
 - SpotBugs (zero findings, `maven/backend/spotbugs-exclude.xml`), PMD (the core's
   forbidden list) and Checkstyle (zero errors) run in `maven/backend`'s `verify`,
-  using the core's own `pmd.xml` and `checkstyle.xml`.
+  using the core's own `pmd.xml` and `checkstyle.xml`. Only two of the three
+  fail a local build: SpotBugs, and Checkstyle through its `check` execution
+  (`checkstyle-zero-errors`). **PMD writes `maven/backend/target/pmd.xml` and
+  judges nothing** -- its forbidden list lives in
+  `.github/scripts/generate-quality-report.py`, which PR CI runs afterwards. A
+  green `mvn verify` therefore says nothing about PMD: read the report. Both
+  reports once sat at seven and fifteen findings behind green local builds.
 - Error Prone's `BanClassForName`, because ParparVM translates the backend too.
 - `maven/backend` compiles only the `impl/javase` twins, so the production
   `impl/parparvm` tree gets its own analysis-only module, `maven/backend-parparvm`
@@ -391,6 +397,39 @@ The backend is held to the client's gates:
 `DM_CONVERT_CASE` is deliberately not excluded for the backend, as it is for the
 core: a server folds protocol tokens, and the next section is why that matters.
 
+#### A package shared only in part: `vm/backend/package-docs`
+
+A core package of which the backend takes only SOME classes cannot be described
+by the core's `package-info.java`. That file links every class of the package,
+and the ones a server does not have are references the backend run cannot
+resolve: doclint fails on them, and the website's doclet would print each as
+plain text where a link was meant. `com.codename1.security` is the case that
+exists -- the server shares the digests and the one-time passwords, not the
+client's ciphers and key storage.
+
+`vm/backend/package-docs/<package path>/package-info.java` is the server's own
+description of such a package. `build_javadocs.sh` copies that tree into the
+backend staging directory *before* it copies the shared classes, and the loop
+that follows takes a core `package-info.java` only for a package that has none
+yet, so the server's one stays. The website build renders the same staging
+directory, so it needs nothing of its own.
+
+- It cannot live in `vm/backend/src`: `shared-sources.sh` and
+  `maven/backend/pom.xml` fail the build on any file there with the same package
+  and name as a core source, and a `package-info.java` cannot be marked
+  `@SharedWithBackend` either.
+- It is documentation only. No build compiles it, so nothing but the javadoc
+  run tells you it is wrong: after touching one, run the backend half of
+  `build_javadocs.sh` under a JDK 25 `javadoc`.
+- A package the backend shares WHOLE needs no entry -- the core's description is
+  true of it and is taken as it is.
+- The directory is in the `paths` of `javadocs.yml` and `website-docs.yml`; a
+  new tree beside it would need adding there.
+
+`com.codename1.impl.*` is on the source path of that run but not among the
+documented sources, so doclint never reads its comments: a broken reference in
+an internal class passes the gate. Write those references fully qualified.
+
 ### No `@author`, `@version` or `@since` in documentation
 
 All three are banned, each by its own gate. `@since` (and "#### Since" sections)