feat(mobile): push notifications MVP

.env.example

@@ -59,6 +59,12 @@ RELAY_URL=ws://localhost:3000
 # (use `just web` for Vite HMR instead).
 # BUZZ_WEB_DIR=./web/dist
 
+# NIP-PL mobile push is an explicit deployment opt-in. A gateway URL alone
+# never enables it. When enabled and the URL is absent, the canonical
+# https://push.buzz.xyz/v1/deliveries/apns endpoint is used.
+BUZZ_PUSH_ENABLED=false
+# BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
+
 # Shared Redis-backed admission limits. Defaults shown below; each value must
 # be a positive integer.
 # BUZZ_RATE_LIMIT_HUMAN_MESSAGES_PER_MIN=60

.github/workflows/ci.yml

@@ -63,6 +63,7 @@ jobs:
               - 'pnpm-lock.yaml'
             mobile:
               - 'mobile/**'
+              - 'crates/buzz-push-gateway/tests/vectors/**'
               - 'scripts/mobile-release.sh'
               - 'scripts/mobile-worktree-overrides.sh'
               - 'scripts/mobile-worktree-clean.sh'
@@ -71,6 +72,7 @@ jobs:
               - 'scripts/test-mobile-release-contract.sh'
               - 'scripts/test-mobile-release-candidate-publisher.sh'
               - 'scripts/test-mobile-worktree-overrides.sh'
+              - 'scripts/test-ios-pbxproj-semantics.py'
               - '.github/workflows/mobile-release-candidate.yml'
               - '.github/workflows/ci.yml'
       - name: Release workflow source contract
@@ -900,6 +902,23 @@ jobs:
       - name: Build Android debug APK
         run: just mobile-build-android
 
+  mobile-swift:
+    name: Mobile Swift
+    runs-on: macos-latest
+    timeout-minutes: 10
+    needs: [changes]
+    if: needs.changes.outputs.mobile == 'true'
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Build
+        run: swift build --package-path mobile/ios/BuzzPushKit
+      - name: Build release
+        run: swift build -c release --package-path mobile/ios/BuzzPushKit
+      - name: Test
+        run: swift test --package-path mobile/ios/BuzzPushKit
+      - name: Validate iOS project semantics
+        run: python3 scripts/test-ios-pbxproj-semantics.py
+
   security:
     name: Security
     runs-on: ubuntu-latest

.intersect/sadscan.yaml

@@ -2,3 +2,14 @@
 exclude_rules_for_files:
   sq.pii.cc.visa:
     - Cargo.lock
+  # Self-signed test fixture generated solely to exercise reqwest identity parsing.
+  kingfisher.privkey.2:
+    - "*apns-test-identity.pem"
+    - "*apns-test-key-only.pem"
+    - "*apns-test-encrypted-identity.pem"
+    - "*apns-test-mismatched-identity.pem"
+  np.pem.1:
+    - "*apns-test-identity.pem"
+    - "*apns-test-key-only.pem"
+    - "*apns-test-encrypted-identity.pem"
+    - "*apns-test-mismatched-identity.pem"

Justfile

@@ -312,9 +312,10 @@ test-unit:
         cargo nextest run -p buzz-voice --lib
         cargo nextest run -p buzz-cli
         # buzz-db migrator/lint tests: pure SQL-parsing unit tests (no infra).
-        # They guard the embedded-migrator invariant (exactly the consolidated
-        # 0001; cutover/backfill stays an operator script, not startup state)
-        # and the tenant-scoping lints. The Postgres-backed buzz-db tests are
+        # They guard the embedded-migrator invariant (the complete checked-in
+        # additive migration set; legacy cutover/backfill remains an operator
+        # script, not startup state) and the tenant-scoping lints. The
+        # Postgres-backed buzz-db tests are
         # #[ignore]d, so --lib runs only the infra-free set. Without this gate a
         # stray file in migrations/ or a broken lint ships green.
         cargo nextest run -p buzz-db --lib