feat(ios): integrate the synthetic photo-processing path and scoped API auth

.github/workflows/ios.yml

@@ -28,7 +28,20 @@ concurrency:
 
 jobs:
   ios-build:
-    name: iOS build
+    # Three groups of the UI tests, one job each (ios/Tools/ui-test-groups.py holds their selectors
+    # and checks that together they run every test once). With two groups, journey hit the cap
+    # below in run 37221532164 (#216 at 6fa43b9b): 12 min of package tests and build, then a
+    # 75.3 min UI step that stopped after 107 of its 109 tests. That run's per-class times put
+    # ScreenStatesUITests at 1892 s (its every-state audit 905 s) and the other journey classes at
+    # about 2475 s, so ScreenStatesUITests has its own job. journey runs the package tests, the
+    # project check and the Debug device build; photoProcessing runs the unsigned Release build;
+    # screenStates runs only its UI tests. fail-fast is off so a failure in one group still leaves
+    # the others' results.
+    name: iOS build (${{ matrix.group }})
+    strategy:
+      fail-fast: false
+      matrix:
+        group: [screenStates, journey, photoProcessing]
     # A free account runs 5 macOS jobs at once, shared by every open pull request, so drafts and
     # labels other than full-ui don't take a slot.
     if: >-
@@ -42,7 +55,9 @@ jobs:
     # freshness UI tests add about 161 s more (run 36744881974), so 60 would cut the
     # every-state audit short. 75 left room until the 2026-10-03 candidate's 86 UI cases:
     # run 37121918073 attempt 2 spent 10 min 34 s before the UI step and 64 min 39 s in it,
-    # and the cap stopped it after 76 cases with 0 failures. 90 runs all of them.
+    # and the cap stopped it after 76 cases with 0 failures. 90 ran all of them; since photo
+    # processing's tests moved to their own job, 90 is the cap for each group, and the groups are
+    # split so that each fits it rather than raising it.
     timeout-minutes: 90
     env:
       # Newest stable Xcode on macos-26 per images/macos/macos-26-arm64-Readme.md (image 20260907).
@@ -55,7 +70,9 @@ jobs:
       XCODEGEN_VERSION: 2.46.0
       XCODEGEN_SHA256: 4d9e34b62172d645eed6457cac13fc222569974098ef4ee9c3368bedf0196806
       # The every-state accessibility audit relaunches the app 65 times (about 10 min). Pull
-      # requests skip it unless labelled full-ui; pushes and manual runs always include it.
+      # requests skip it unless labelled full-ui; pushes and manual runs always include it. It is
+      # in the screenStates group; photoProcessing always runs its own audits.
+      GROUP: ${{ matrix.group }}
       FULL_UI: ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'full-ui') }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -71,6 +88,13 @@ jobs:
           xcodebuild -version
           swift --version
 
+      # Before anything slow: the groups' selectors must cover every UI test exactly once, and the
+      # CI tools' own tests (the groups' check and the result snapshot) must pass.
+      - name: Check the UI test groups
+        run: |
+          python3 -m unittest discover -s ios/Tools -p 'test_*.py'
+          python3 ios/Tools/ui-test-groups.py check
+
       # Booting takes 2 to 3 minutes and needs nothing from the build, so it runs alongside the
       # steps below; the UI test step waits for it.
       - name: Boot the Simulator in the background
@@ -86,6 +110,7 @@ jobs:
           fi
           echo "SIM_UDID=$udid" >> "$GITHUB_ENV"
           nohup xcrun simctl bootstatus "$udid" -b > "$RUNNER_TEMP/simulator-boot.log" 2>&1 &
+          echo "SIM_BOOT_PID=$!" >> "$GITHUB_ENV"
 
       # The package's drift test compares the vendored server schemas with the server's own copies:
       # the checkout's files once that branch merges, else the t3/server branch, which the shallow
@@ -94,6 +119,7 @@ jobs:
       # than skip, so CI can't go green without comparing. The checkout counts only when it holds
       # every compared file: a folder alone isn't enough (main has a server/ without schemas).
       - name: Fetch the server contract
+        if: matrix.group == 'journey'
         run: |
           fetch_unless_present() {
             local branch="$1"; shift
@@ -111,6 +137,7 @@ jobs:
           fetch_unless_present t3/server server/schemas/scene.schema.json server/schemas/result.schema.json server/tests/fixtures/example-scene.json
 
       - name: Install XcodeGen
+        if: matrix.group == 'journey'
         run: |
           curl -fsSL -o "$RUNNER_TEMP/xcodegen.zip" \
             "https://github.com/yonaskolb/XcodeGen/releases/download/${XCODEGEN_VERSION}/xcodegen.zip"
@@ -119,9 +146,11 @@ jobs:
           echo "$RUNNER_TEMP/xcodegen/bin" >> "$GITHUB_PATH"
 
       - name: Generate project
+        if: matrix.group == 'journey'
         run: xcodegen generate --spec ios/project.yml
 
       - name: Check committed project matches project.yml
+        if: matrix.group == 'journey'
         run: |
           if ! git diff --exit-code -- ios; then
             echo "::error::HouseScan.xcodeproj differs from project.yml. Run 'make ios-project' (XcodeGen ${XCODEGEN_VERSION}) and commit the result."
@@ -136,42 +165,73 @@ jobs:
 
       - name: Test HouseScanKit
         # The capture logic is a plain Swift package; its tests run on macOS without a Simulator.
+        # Once per run: photoProcessing builds the same package sources into its Release build.
+        if: matrix.group == 'journey'
         env:
           HOUSESCAN_REQUIRE_UPSTREAM: "1"
         run: swift test --package-path ios/HouseScanKit -Xswiftc -warnings-as-errors
 
       # CI builds once from clean, so the index Xcode keeps for editing is wasted work.
       - name: Build
+        if: matrix.group == 'journey'
         run: >-
           xcodebuild -project ios/HouseScan.xcodeproj -scheme HouseScan -configuration Debug
           -destination "generic/platform=iOS" CODE_SIGNING_ALLOWED=NO COMPILER_INDEX_STORE_ENABLE=NO build
 
+      # Proves the Release configuration compiles, the photo-processing setup gate included, whose
+      # fixture switches exist only in Debug. It doesn't show what Release does at run time.
+      - name: Build Release, unsigned
+        if: matrix.group == 'photoProcessing'
+        run: >-
+          xcodebuild -project ios/HouseScan.xcodeproj -scheme HouseScan -configuration Release
+          -destination "generic/platform=iOS" CODE_SIGNING_ALLOWED=NO COMPILER_INDEX_STORE_ENABLE=NO build
+
+      # The background boot first: screenStates reaches this step 3 s after starting it, and a
+      # second `bootstatus -b` while that boot was under way exited 149 (run 37228728303). Once it
+      # has finished, `-b` returns at once on a booted device, and boots it if the first try failed.
       - name: Wait for the Simulator
         timeout-minutes: 10
         run: |
-          xcrun simctl bootstatus "$SIM_UDID" -b
+          while kill -0 "$SIM_BOOT_PID" 2>/dev/null; do sleep 2; done
+          if ! xcrun simctl bootstatus "$SIM_UDID" -b; then
+            echo "::error::$SIM_NAME on iOS $SIM_OS did not boot. The background boot's log follows."
+            cat "$RUNNER_TEMP/simulator-boot.log"
+            exit 1
+          fi
           echo "Booted $SIM_NAME on iOS $SIM_OS ($SIM_UDID)."
 
-      - name: UI test the whole flow in the Simulator
+      - name: UI test the group in the Simulator
         # Replays the committed synthetic wall (ios/HouseScanUITests/Fixtures/synthetic-wall) with
-        # -autopilot and the bundled sample result.
+        # -autopilot and the bundled sample result; photoProcessing adds its in-app fixture.
         run: |
-          skip=()
-          if [ "$FULL_UI" != "true" ]; then
-            skip=(-skip-testing:HouseScanUITests/ScreenStatesUITests/testEveryStatePassesTheAccessibilityAudit)
+          if [ "$GROUP" = screenStates ] && [ "$FULL_UI" != "true" ]; then
             echo "::notice::Skipped the every-state accessibility audit (about 10 min). Add the full-ui label to run it on this pull request."
           fi
+          # Read without mapfile: the runner's /bin/bash is 3.2.
+          list="$(python3 ios/Tools/ui-test-groups.py args "$GROUP" --full-ui "$FULL_UI")"
+          selectors=()
+          while IFS= read -r line; do selectors+=("$line"); done <<< "$list"
+          echo "Selectors: ${selectors[*]}"
           xcodebuild -project ios/HouseScan.xcodeproj -scheme HouseScan -configuration Debug \
             -destination "id=$SIM_UDID" \
             -resultBundlePath "$RUNNER_TEMP/HouseScanUITests.xcresult" \
-            -only-testing:HouseScanUITests "${skip[@]}" \
+            "${selectors[@]}" \
             COMPILER_INDEX_STORE_ENABLE=NO test
 
+      # A run the cap cancels leaves the bundle half-written, and its Staging/ files vanish while
+      # they are read: run 37221532164's journey upload stopped at the first one (ENOENT) and kept
+      # nothing. This copies the bundle first, lets only Staging/ entries vanish, and lists them in
+      # SNAPSHOT.txt beside it ("complete" or "incomplete"); any other error fails this step. The
+      # job's own result, a cancellation included, stays as it was.
+      - name: Snapshot the UI test results
+        if: always()
+        run: python3 ios/Tools/snapshot-xcresult.py "$RUNNER_TEMP/HouseScanUITests.xcresult" "$RUNNER_TEMP/ui-test-results"
+
       - name: Keep UI test screenshots
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: ui-test-results
-          path: ${{ runner.temp }}/HouseScanUITests.xcresult
+          name: ui-test-results-${{ matrix.group }}
+          path: ${{ runner.temp }}/ui-test-results
           if-no-files-found: ignore
           retention-days: 7

.greptile/config.json

@@ -0,0 +1,3 @@
+{
+  "autoReview": ["open", "push"]
+}

CONTRIBUTING.md

@@ -22,6 +22,8 @@ State what the old code did before describing the new behavior. Link the reviewe
 
 The `size:*` label describes the effective diff. It is a review signal, not a merge gate. Do not set it by hand.
 
+Greptile reviews new commits through [`.greptile/config.json`](.greptile/config.json). The dashboard's open-only trigger left follow-up commits unreviewed. This repository override adds push reviews without changing other repositories' settings. Greptile reads this setting from the PR's source branch, so older branches need the config too. For a branch without it, request a current review with `@greptileai review` after pushing. Use `@greptileai review this draft` for drafts.
+
 ## Checks
 
 | Check | Runs on GitHub when | Local command |
@@ -36,6 +38,8 @@ The `size:*` label describes the effective diff. It is a review signal, not a me
 
 The iOS UI tests skip the every-state accessibility audit on pull requests, because it adds about 10 minutes and macOS runners are scarce. Add the `full-ui` label when a pull request changes screens or copy; pushes to `t3/ios-mvf` and `main` always run it.
 
+The iOS check runs as three jobs, each under its own 90-minute cap: `screenStates` runs `ScreenStatesUITests`, the every-state audit included under `full-ui`; `photoProcessing` runs an unsigned Release build and `PhotoProcessingUITests` with its own audits; and `journey` runs the package tests, the Debug build and every other UI test class. `ios/Tools/ui-test-groups.py` holds the groups' test selectors; `python3 ios/Tools/ui-test-groups.py check` lists the UI tests from source and fails unless the groups run each exactly once. Run it after adding or renaming a UI test class. Each job keeps its result bundle as the artifact `ui-test-results-<group>`, with `SNAPSHOT.txt` saying whether the copy is complete; a job the cap cancelled can leave it incomplete.
+
 `make check` runs the server, web and iOS suites, then `make scoring`, `make measure-lab`, `make evals`, `make recon` and `make meter-closeup` for each of those folders the branch has. They need uv, Node 24 with pnpm, and Xcode 26 or newer; each directory's README has details. No check is required by branch rules yet. Don't call one required until the rules require its status.
 
 Keep workflows that run pull-request code away from production credentials and destructive external systems. A green CI run is evidence for the checks it ran, not proof that a capture works on a real house.

ios/HouseScan/Contract/ResultPresentation+Reading.swift

@@ -76,10 +76,7 @@ extension ResultPresentation {
         checks.map { row in
             ResultReading.Check(
                 id: row.id, outcome: row.outcome.placementOutcome, needsPerson: row.needsPerson,
-                viewCapturable: viewToTake(for: row) != nil,
-                margin: ResultReading.margin(
-                    measured: row.measured.map(Double.init), threshold: row.threshold.map(Double.init),
-                    plusMinus: row.plusMinus.map(Double.init), comparison: row.comparison?.placementComparison)
+                viewCapturable: viewToTake(for: row) != nil
             )
         }
     }
@@ -102,12 +99,3 @@ private extension CheckOutcome {
         }
     }
 }
-
-private extension RuleComparison {
-    var placementComparison: PlacementComparison {
-        switch self {
-        case .atLeast: .atLeast
-        case .atMost: .atMost
-        }
-    }
-}

ios/HouseScan/Contract/ScanContract.swift

@@ -1,5 +1,6 @@
 import CoreGraphics
 import Foundation
+import HouseScanKit
 import Observation
 import simd
 import SwiftUI
@@ -33,6 +34,9 @@ enum ScanPhase: String, Sendable, CaseIterable {
     case spotConfirm
     case result
     case resultAR
+    /// A photo-processing scan after it was sent: its progress, then its answer
+    /// (`ScanViewState.photoProcessing`). Legacy scans never come here.
+    case processing
     case unsupported
 }
 
@@ -567,6 +571,10 @@ enum EndMarkRefusal: Error, Equatable, Sendable {
     case otherSide(WallSide)
     /// Tracking isn't normal, as for a feature mark (`MarkRefusal.trackingNotReady`).
     case trackingNotReady
+    /// During a past_end request: an end there would leave less wall than the walk's minimum
+    /// (`CoverageMap.endWouldLeaveTooLittle`, `WallFrame.minWallLength`), which the app can't use.
+    /// Decided in `aimedEnd`, so the preview and the button agree.
+    case tooLittleWall
 }
 
 enum MarkRefusal: Equatable, Sendable {
@@ -631,6 +639,10 @@ struct GapRequest: Identifiable, Equatable, Sendable {
     /// Set while a walk-out request's line lies past where the space ends
     /// (`GapPlanner.walkOutBlock`): no walk can meet it, and the card says so.
     var spaceEnds: SpaceEnds? = nil
+    /// A server past_end request's side: the walk stopped there, and the request asks to walk on
+    /// past it. The screen also offers "Wall ends here" for that end, with its question, as the
+    /// walk does (B-12). Nil for every other request.
+    var pastEndSide: WallSide? = nil
 }
 
 // MARK: - Upload and result
@@ -957,6 +969,14 @@ final class ScanViewState {
     var shareableScan: URL?
     /// A camera permission or session failure the homeowner can act on.
     var failure: ScanFailure?
+    /// The backend this scan uses, fixed when it started; nil before a scan starts.
+    var scanBackend: ProcessingBackend?
+    /// Photo processing's side of this scan: its consent, progress and answer. Nil on a Legacy
+    /// scan, and before a scan starts.
+    var photoProcessing: PhotoProcessingStatus?
+    /// Photo processing sends a synthetic test capture in place of this scan's photos (DEBUG's
+    /// `-photoProcessingSyntheticCapture`), so its answer says nothing about the wall on screen.
+    var photoCaptureIsSynthetic = false
 
     init() {}
 }
@@ -1042,6 +1062,14 @@ protocol ScanActions: AnyObject {
     func showAR()
     func closeAR()
     func startOver()
+    /// The homeowner's answer to sending this scan's photos for processing
+    /// (`PhotoProcessingStatus.Consent.asking`).
+    func answerPhotoConsent(_ yes: Bool)
+    /// A no after a yes: this scan's photos stop going to photo processing.
+    func stopSendingPhotos()
+    /// A photo-processing scan this build can't send, stopped before capture: choose Legacy and
+    /// start a new scan with it.
+    func scanWithLegacyInstead()
     /// The app came back to the foreground on the camera-access failure: if access is now on,
     /// the scan goes on without Start over. Does nothing otherwise.
     func recheckCameraAccess()