Connect Android Hello to deployed Cloud with published Kotlin SDK

.github/dependabot.yml

@@ -24,4 +24,4 @@ updates:
       android:
         patterns: ["com.android*", "androidx.activity*", "androidx.test*"]
       contracts:
-        patterns: ["io.github.arcforges*", "io.grpc*"]
+        patterns: ["io.github.arcforges*", "com.connectrpc*", "com.squareup.okhttp3*", "com.squareup.okio*"]

.github/workflows/ci.yml

@@ -123,7 +123,7 @@ jobs:
           keytool -genkeypair -keystore "$RUNNER_TEMP/test.jks" -storepass android -keypass android -alias test -keyalg RSA -keysize 3072 -validity 2 -dname 'CN=Disposable CI test'
           "$ANDROID_HOME/build-tools/37.0.0/zipalign" -P 16 -f 4 artifacts/candidate/app-release-unsigned.apk "$RUNNER_TEMP/aligned.apk"
           "$ANDROID_HOME/build-tools/37.0.0/apksigner" sign --ks "$RUNNER_TEMP/test.jks" --ks-pass pass:android --out artifacts/test-release.apk "$RUNNER_TEMP/aligned.apk"
-      - name: Exercise UI, recreation and the minified release APK
+      - name: Exercise Android UI, live gRPC-Web and the minified release APK
         uses: ReactiveCircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2
         with:
           api-level: 36
@@ -135,7 +135,11 @@ jobs:
             adb install artifacts/candidate/app-debug.apk
             adb install artifacts/candidate/app-debug-androidTest.apk
             adb shell am instrument -w io.github.arcforges.mobile.debug.test/androidx.test.runner.AndroidJUnitRunner | tee artifacts/instrumentation.txt
+            mkdir -p artifacts/device
+            adb logcat -d > artifacts/device/logcat.txt
+            adb shell run-as io.github.arcforges.mobile.debug cat files/cloud-hello-evidence.json > artifacts/device/cloud-hello.json
             grep -E '^OK \([1-9][0-9]* tests?\)' artifacts/instrumentation.txt
+            grep '^CLOUD_HELLO_VERIFIED ' artifacts/instrumentation.txt
             python eng/device-smoke.py artifacts/test-release.apk --serial emulator-5554
       - name: Upload device evidence
         if: always()
@@ -210,12 +214,12 @@ jobs:
           VERSION_NAME: ${{ needs.build.outputs.version_name }}
         run: |
           cat > "$RUNNER_TEMP/release-notes.md" <<EOF
-          Android Hello World build from commit $GITHUB_SHA.
+          Android Cloud Hello build from commit $GITHUB_SHA.
 
           Install the APK on Android 8.0 or newer. The AAB is for a future store upload; no store deployment occurs here.
           JVM desktop preview is development-only and is not distributed.
 
-          Both OS builds, unit tests, Android instrumentation, minified APK launch, lint and security checks passed before signing.
+          Both OS builds, unit tests, Android instrumentation, live Cloud gRPC-Web calls from the SDK and minified APK, lint and security checks passed before signing.
           See release.json for source/candidate hashes and the signing certificate; SHA256SUMS verifies the downloads.
           EOF
           gh release create "android-$VERSION_NAME" artifacts/release/* --target "$GITHUB_SHA" --title "Android $VERSION_NAME" --prerelease --notes-file "$RUNNER_TEMP/release-notes.md"

CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 Read [development.md](docs/development.md), install JDK 21 and the listed Android SDK components, and enable the local hooks with `python eng/mobile.py hooks`.
 
-Use a branch or worktree and open a pull request. Keep changes within their requested scope. Run `./gradlew spotlessApply` before committing Kotlin changes; the pre-push hook runs formatting and unit checks. CI additionally builds on Windows/Linux, checks Android lint, exercises the Android UI and launches the minified release candidate.
+Use a branch or worktree and open a pull request. Keep changes within their requested scope. Run `./gradlew spotlessApply` before committing Kotlin changes; the pre-push hook runs formatting and unit checks. CI additionally builds on Windows/Linux, checks Android lint, exercises the Android UI and calls the real Cloud Hello from both the SDK and minified release candidate. Device instrumentation requires Internet access; unit tests use a local fixture.
 
 Commit Gradle lockfiles and `gradle/verification-metadata.xml`. Review dependency changes before regenerating checksums; a newly downloaded checksum is not independent proof of origin. See the dependency update procedure in [development.md](docs/development.md). Do not disable strict verification or allow failing checks to make a dependency update pass.
 

README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/ArcForges/Mobile/actions/workflows/ci.yml/badge.svg)](https://github.com/ArcForges/Mobile/actions/workflows/ci.yml)
 
-A native Kotlin Android Hello World app, with a shared Compose UI and a JVM development preview. Android is the only product delivered by this repository. The current screen works offline; production ArcChat services, accounts and synchronization are future work.
+A native Kotlin Android app that calls the real Cloud Hello API at `https://arcforges.com/api`, with a shared Compose UI and an offline JVM development preview. Android is the only product delivered by this repository. Production ArcChat services, accounts and synchronization are future work.
 
 | Component | Pinned version / purpose |
 | --- | --- |
@@ -11,10 +11,13 @@ A native Kotlin Android Hello World app, with a shared Compose UI and a JVM deve
 | Kotlin / Compose Multiplatform | 2.4.20 / 1.12.0 |
 | Compose Hot Reload | 1.2.0; JVM development sandbox only |
 | Android SDK | compile/target 37, Build-Tools 37.0.0, minimum Android 8.0 (API 26) |
-| Contracts | `io.github.arcforges:contracts-client:1.0.0-ci.25.1` from Maven Central |
+| Contracts | `io.github.arcforges:contracts-connect-client:1.0.0-ci.36.1` from Maven Central |
+| Transport | Connect-Kotlin 0.9.0, binary gRPC-Web over platform-validated HTTPS |
 
 `app` owns Android lifecycle, published Contracts integration and APK/AAB packaging. `shared` owns the greeting behavior and Compose UI, reused by Android and the `desktop` JVM preview target. Contracts source generation stays in the [Contracts repository](https://github.com/ArcForges/Contracts); this build uses released Maven artifacts and needs no adjacent checkout.
 
+Enter a name and press **Say hello** to call Cloud. The app shows progress, the server's greeting or a recoverable error. It has a five-second RPC deadline and never retries automatically. Recreating the Activity preserves the name and completed result, cancels pending work and allows a fresh manual request. The anonymous Hello needs no login, API token or Cloudflare account. The preview is labeled **Local preview · Works offline** and makes no Cloud calls.
+
 ```sh
 python eng/mobile.py hooks
 ./gradlew :app:installDebug

THIRD_PARTY_NOTICES.md

@@ -2,7 +2,7 @@
 
 Original ArcForges Mobile code and tooling use Apache-2.0. The Gradle wrapper is distributed under Apache-2.0 and comes from the same verified Gradle 9.7.1 wrapper used by ArcForges Contracts; its distribution checksum is pinned in the wrapper properties.
 
-The application consumes published artifacts, including ArcForges Contracts, Kotlin, AndroidX/Compose, Protocol Buffers, gRPC and their transitive dependencies. Each dependency retains its own license and notices. Gradle lockfiles and checksum metadata enumerate the resolved artifacts. Runtime license/notice resources are retained or merged during Android packaging, including the notices in Contracts JARs.
+The application consumes published artifacts, including ArcForges Contracts, Kotlin, AndroidX/Compose, Protocol Buffers, Connect-Kotlin, OkHttp/Okio and their transitive dependencies. Each dependency retains its own license and notices. Gradle lockfiles and checksum metadata enumerate the resolved artifacts. Runtime license/notice resources are retained or merged during Android packaging, including the notices in Contracts JARs.
 
 Contracts JARs each contain their own root `sbom.cdx.json` and `source.json`. These per-artifact documents stay available in the original Maven artifacts and are excluded from APK resources: concatenating them at the same path would produce invalid JSON. They are not license notices. The application release manifest records the application source and hashes separately.
 

app/build.gradle.kts

@@ -71,11 +71,11 @@ dependencies {
     implementation(libs.compose.runtime)
     implementation(libs.compose.ui)
     implementation(libs.contracts.client)
-    implementation(libs.grpc.okhttp)
+    implementation(libs.connect.okhttp)
+    implementation(libs.connect.javalite)
+    implementation(libs.coroutines.core)
     coreLibraryDesugaring(libs.desugar)
     testImplementation(libs.junit)
-    testImplementation(libs.grpc.inprocess)
-    testImplementation(libs.coroutines.core)
     androidTestImplementation(libs.androidx.test.runner)
     androidTestImplementation(libs.androidx.test.junit)
     androidTestImplementation(libs.compose.ui.test.junit4)