# Subplan 05 - Artifact Validation

## Goal

Validate uploaded platform artifacts before publication and channel promotion.

## Common Validation

All artifacts:

- file exists
- size matches upload metadata
- SHA-256 matches
- content type is allowed
- extension matches platform policy
- archive is readable when applicable

## iOS IPA

Validate:

- zip structure
- `.app` bundle exists
- Info.plist can be read
- bundle id matches app policy
- version/build metadata matches release
- provisioning profile mode is classified
- install mode is classified as TestFlight, Enterprise/MDM, or Artifact only

Acceptance:

- The system never implies browser IPA install unless enterprise/MDM manifest
  requirements are met.

## Android APK

Validate:

- APK structure
- manifest package id
- version code/name
- min sdk
- signature presence
- basic metadata extraction

Acceptance:

- APK validator can reject package id mismatch before publication.

## macOS

Validate:

- archive opens
- app bundle or installer package exists
- Info.plist metadata when relevant
- code signing status if tool support exists
- notarization state when provided or checked

Acceptance:

- Notarization can be pending for beta but must satisfy stable policy if
  configured.

## Linux

Validate:

- archive/package opens
- architecture metadata when available
- executable presence
- optional package metadata for deb/rpm/appimage

Acceptance:

- Platform and architecture metadata can drive download labels.

## Windows

Validate:

- exe/msi/zip exists
- authenticode status if supported
- malware scan placeholder status
- architecture metadata when available

Acceptance:

- Stable promotion can require completed scan policy.

## Validation Pipeline

Statuses:

- pending
- passed
- failed
- warning
- skipped

Policy:

- beta/internal may allow warnings.
- stable requires all configured required checks.
- every validation result is auditable.