[red] require iOS 15 source and IPA floors

Red evidence: the project exposed three iOS 13.0 targets, and the signed build-5 IPA validator contained no MinimumOSVersion or compiled minos gate.

Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>

Author: yyods

app/test/unit/app_identity_manifest_test.dart

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: MIT
 // Part of PyBLE (https://pyble.dev) — see /LICENSE.
 //
-// X-11 / BLD-10 — platform launchers preserve the PyBLE visual identity.
+// X-11 / BLD-10/13 — platform launchers and deployment metadata preserve the
+// PyBLE distribution contract.
 
 import 'dart:convert';
 import 'dart:io';
@@ -134,6 +135,39 @@ void main() {
     );
   });
 
+  test('iOS project pins every configuration to deployment target 15', () {
+    final String project = File(
+      '${app.path}/ios/Runner.xcodeproj/project.pbxproj',
+    ).readAsStringSync();
+    final List<String> deploymentTargets =
+        RegExp(r'^\s*IPHONEOS_DEPLOYMENT_TARGET = ([^;]+);$', multiLine: true)
+            .allMatches(project)
+            .map((RegExpMatch match) {
+              return match.group(1)!;
+            })
+            .toList(growable: false);
+
+    expect(
+      deploymentTargets,
+      hasLength(3),
+      reason: 'Profile, Debug, and Release must each declare one target',
+    );
+    expect(
+      deploymentTargets,
+      everyElement('15.0'),
+      reason: 'every authored iOS deployment target must use the BLD-13 floor',
+    );
+
+    final String plist = File(
+      '${app.path}/ios/Runner/Info.plist',
+    ).readAsStringSync();
+    expect(
+      plist,
+      isNot(contains('<key>MinimumOSVersion</key>')),
+      reason: 'Xcode must derive MinimumOSVersion from the deployment target',
+    );
+  });
+
   test('Android launcher metadata uses the exact PyBLE wordmark', () {
     final String manifest = File(
       '${app.path}/android/app/src/main/AndroidManifest.xml',

tests/publication/test_ci_contract.py

@@ -407,6 +407,35 @@ def test_android_blockly_smoke_reveals_ime_occluded_actions(self) -> None:
         self.assertLess(reveal_action, hit_test)
         self.assertLess(hit_test, tap_action)
 
+    def test_ios_distribution_validator_enforces_deployment_floor(self) -> None:
+        validator = (
+            REPO_ROOT / "tools" / "validate_ios_ipa.sh"
+        ).read_text(encoding="utf-8")
+
+        required_snippets = (
+            "readonly IOS_DEPLOYMENT_FLOOR='15.0'",
+            "version_at_least() {",
+            "plutil -extract MinimumOSVersion raw",
+            "plutil -extract CFBundleExecutable raw",
+            '"$VTOOL_PATH" -show-build "$APP_EXECUTABLE_PATH"',
+            "expected iOS deployment floor",
+            "compiled iOS minimum",
+        )
+        positions = []
+        for snippet in required_snippets:
+            self.assertIn(
+                snippet,
+                validator,
+                f"missing iOS deployment-floor validator contract: {snippet}",
+            )
+            positions.append(validator.index(snippet))
+
+        self.assertEqual(positions, sorted(positions))
+        self.assertLess(
+            validator.index("compiled iOS minimum"),
+            validator.index("codesign --verify --deep --strict"),
+        )
+
     def test_workflow_has_no_adjacent_duplicate_shell_key(self) -> None:
         workflow = (REPO_ROOT / ".github" / "workflows" / "ci.yml").read_text(
             encoding="utf-8"