shroominic · Sep 8, 2026 · Sep 8, 2026 · Sep 9, 2026 · Sep 9, 2026 · Sep 10, 2026
@@ -8,6 +8,8 @@
 /packages/cgm_ble/ @shroominic
 /packages/cgm_ble_flutter/ @shroominic
 /packages/cgm_aidex/ @shroominic
+/packages/cgm_libre2/ @shroominic
+/packages/cgm_yuwell_anytime/ @shroominic
 /.github/ @shroominic
 /docs/ @shroominic
 /SECURITY.md @shroominic

@@ -18,6 +18,8 @@ body:
         - cgm_ble
         - cgm_ble_flutter
         - cgm_aidex
+        - cgm_libre2
+        - cgm_yuwell_anytime
         - Build, tooling, or documentation
         - Unsure
     validations:

@@ -67,6 +67,28 @@ updates:
     labels:
       - dependencies
 
+  - package-ecosystem: pub
+    directory: /packages/cgm_libre2
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:20"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+
+  - package-ecosystem: pub
+    directory: /packages/cgm_yuwell_anytime
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:25"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+
   - package-ecosystem: gradle
     directory: /openhealth/android
     schedule:

@@ -174,6 +174,24 @@ jobs:
             }
           done
 
+      - name: Require CBIO vendor material for the release build
+        shell: bash
+        env:
+          CBIO_VENDOR_STREAM_KEY_HEX: ${{ secrets.CBIO_VENDOR_STREAM_KEY_HEX }}
+          CBIO_VENDOR_AUTH_MATERIAL_HEX: ${{ secrets.CBIO_VENDOR_AUTH_MATERIAL_HEX }}
+          CBIO_VENDOR_AUTH_TRIGGER_HEX: ${{ secrets.CBIO_VENDOR_AUTH_TRIGGER_HEX }}
+        run: |
+          set -euo pipefail
+          for secret_name in \
+            CBIO_VENDOR_STREAM_KEY_HEX \
+            CBIO_VENDOR_AUTH_MATERIAL_HEX \
+            CBIO_VENDOR_AUTH_TRIGGER_HEX; do
+            test -n "${!secret_name:-}" || {
+              printf 'Required android-release secret %s is missing.\n' "$secret_name" >&2
+              exit 1
+            }
+          done
+
       - name: Set up Java
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
@@ -200,12 +218,16 @@ jobs:
           ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
           ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
           ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+          CBIO_VENDOR_STREAM_KEY_HEX: ${{ secrets.CBIO_VENDOR_STREAM_KEY_HEX }}
+          CBIO_VENDOR_AUTH_MATERIAL_HEX: ${{ secrets.CBIO_VENDOR_AUTH_MATERIAL_HEX }}
+          CBIO_VENDOR_AUTH_TRIGGER_HEX: ${{ secrets.CBIO_VENDOR_AUTH_TRIGGER_HEX }}
         run: |
           set -euo pipefail
           umask 077
           keystore_path="$RUNNER_TEMP/openglucose-release.jks"
+          cbio_defines_path="$RUNNER_TEMP/openglucose-cbio-vendor.json"
           cleanup() {
-            rm -f -- "$keystore_path"
+            rm -f -- "$keystore_path" "$cbio_defines_path"
           }
           trap cleanup EXIT
           trap 'exit 130' INT
@@ -214,9 +236,18 @@ jobs:
             > "$keystore_path"
           test -s "$keystore_path"
           unset ANDROID_KEYSTORE_BASE64
+          jq -n \
+            '{CBIO_VENDOR_STREAM_KEY_HEX: env.CBIO_VENDOR_STREAM_KEY_HEX,
+              CBIO_VENDOR_AUTH_MATERIAL_HEX: env.CBIO_VENDOR_AUTH_MATERIAL_HEX,
+              CBIO_VENDOR_AUTH_TRIGGER_HEX: env.CBIO_VENDOR_AUTH_TRIGGER_HEX}' \
+            > "$cbio_defines_path"
+          chmod 600 "$cbio_defines_path"
+          test -s "$cbio_defines_path"
+          unset CBIO_VENDOR_STREAM_KEY_HEX CBIO_VENDOR_AUTH_MATERIAL_HEX CBIO_VENDOR_AUTH_TRIGGER_HEX
           export ANDROID_KEYSTORE_PATH="$keystore_path"
           cd openhealth
-          flutter build apk --release --no-pub
+          flutter build apk --release --no-pub \
+            --dart-define-from-file="$cbio_defines_path"
 
       - name: Verify signer, identity, version, and digest
         id: verify

@@ -253,6 +253,9 @@ jobs:
           ASC_API_ISSUER_ID: ${{ vars.ASC_API_ISSUER_ID }}
           ASC_API_KEY_ID: ${{ vars.ASC_API_KEY_ID }}
           ASC_API_KEY_P8_BASE64: ${{ secrets.ASC_API_KEY_P8_BASE64 }}
+          CBIO_VENDOR_STREAM_KEY_HEX: ${{ secrets.CBIO_VENDOR_STREAM_KEY_HEX }}
+          CBIO_VENDOR_AUTH_MATERIAL_HEX: ${{ secrets.CBIO_VENDOR_AUTH_MATERIAL_HEX }}
+          CBIO_VENDOR_AUTH_TRIGGER_HEX: ${{ secrets.CBIO_VENDOR_AUTH_TRIGGER_HEX }}
           IOS_APP_STORE_PROFILE_BASE64: ${{ secrets.IOS_APP_STORE_PROFILE_BASE64 }}
           IOS_DISTRIBUTION_CERTIFICATE_SHA1: ${{ vars.IOS_DISTRIBUTION_CERTIFICATE_SHA1 }}
           IOS_DISTRIBUTION_P12_BASE64: ${{ secrets.IOS_DISTRIBUTION_P12_BASE64 }}
@@ -284,7 +287,7 @@ jobs:
             chmod 600 "$2"
           }
 
-          for name in APPLE_TEAM_ID APP_BUNDLE_ID APP_STORE_PROFILE_UUID ASC_API_ISSUER_ID ASC_API_KEY_ID ASC_API_KEY_P8_BASE64 IOS_APP_STORE_PROFILE_BASE64 IOS_DISTRIBUTION_CERTIFICATE_SHA1 IOS_DISTRIBUTION_P12_BASE64 IOS_DISTRIBUTION_P12_PASSWORD IOS_LIVE_ACTIVITY_PROFILE_BASE64 LIVE_ACTIVITY_APP_STORE_PROFILE_UUID LIVE_ACTIVITY_BUNDLE_ID TESTFLIGHT_GROUP TESTFLIGHT_GROUP_ID TESTFLIGHT_INTERNAL_TESTER_ID; do
+          for name in APPLE_TEAM_ID APP_BUNDLE_ID APP_STORE_PROFILE_UUID ASC_API_ISSUER_ID ASC_API_KEY_ID ASC_API_KEY_P8_BASE64 CBIO_VENDOR_STREAM_KEY_HEX CBIO_VENDOR_AUTH_MATERIAL_HEX CBIO_VENDOR_AUTH_TRIGGER_HEX IOS_APP_STORE_PROFILE_BASE64 IOS_DISTRIBUTION_CERTIFICATE_SHA1 IOS_DISTRIBUTION_P12_BASE64 IOS_DISTRIBUTION_P12_PASSWORD IOS_LIVE_ACTIVITY_PROFILE_BASE64 LIVE_ACTIVITY_APP_STORE_PROFILE_UUID LIVE_ACTIVITY_BUNDLE_ID TESTFLIGHT_GROUP TESTFLIGHT_GROUP_ID TESTFLIGHT_INTERNAL_TESTER_ID; do
             require_value "$name"
           done
           if [[ "$RELEASE_AUDIENCE" == external ]]; then
@@ -309,6 +312,16 @@ jobs:
           test ! -e "$material_dir" && test ! -e "$state_dir" && test ! -e "$keychain_path"
           mkdir -m 700 "$material_dir" "$state_dir"
 
+          cbio_defines_path="$material_dir/cbio-vendor.json"
+          jq -n \
+            '{CBIO_VENDOR_STREAM_KEY_HEX: env.CBIO_VENDOR_STREAM_KEY_HEX,
+              CBIO_VENDOR_AUTH_MATERIAL_HEX: env.CBIO_VENDOR_AUTH_MATERIAL_HEX,
+              CBIO_VENDOR_AUTH_TRIGGER_HEX: env.CBIO_VENDOR_AUTH_TRIGGER_HEX}' \
+            > "$cbio_defines_path"
+          chmod 600 "$cbio_defines_path"
+          test -s "$cbio_defines_path"
+          unset CBIO_VENDOR_STREAM_KEY_HEX CBIO_VENDOR_AUTH_MATERIAL_HEX CBIO_VENDOR_AUTH_TRIGGER_HEX
+
           asc_key_path="$material_dir/AuthKey_$ASC_API_KEY_ID.p8"
           p12_path="$material_dir/distribution.p12"
           app_profile_path="$material_dir/app.mobileprovision"
@@ -359,7 +372,7 @@ jobs:
             cd openhealth
             env -u GEM_HOME -u GEM_PATH \
               "${phase_environment[@]}" \
-              APPLE_TEAM_ID="$APPLE_TEAM_ID" APP_BUNDLE_ID="$APP_BUNDLE_ID" APP_STORE_PROFILE_UUID="$APP_STORE_PROFILE_UUID" ASC_API_ISSUER_ID="$ASC_API_ISSUER_ID" ASC_API_KEY_ID="$ASC_API_KEY_ID" ASC_API_KEY_PATH="$asc_key_path" DISTRIBUTE_INTERNAL=yes LIVE_ACTIVITY_APP_STORE_PROFILE_UUID="$LIVE_ACTIVITY_APP_STORE_PROFILE_UUID" LIVE_ACTIVITY_BUNDLE_ID="$LIVE_ACTIVITY_BUNDLE_ID" RELEASE_APPROVED=yes RELEASE_COMMIT="$RELEASE_COMMIT" RELEASE_VERSION="$RELEASE_VERSION" TESTFLIGHT_CHANGELOG="$changelog" TESTFLIGHT_EXTERNAL_TESTER_COUNT="$TESTFLIGHT_EXTERNAL_TESTER_COUNT" TESTFLIGHT_EXTERNAL_TESTER_IDS_SHA256="$TESTFLIGHT_EXTERNAL_TESTER_IDS_SHA256" TESTFLIGHT_GROUP="$TESTFLIGHT_GROUP" TESTFLIGHT_GROUP_ID="$TESTFLIGHT_GROUP_ID" TESTFLIGHT_INTERNAL_TESTER_ID="$TESTFLIGHT_INTERNAL_TESTER_ID" TESTFLIGHT_MODE="$RELEASE_AUDIENCE" TESTFLIGHT_NOTIFICATION_RECEIPT_PATH="$state_dir/notification.json" TESTFLIGHT_UPLOAD_PROVENANCE_PATH="$state_dir/upload-provenance.json" \
+              APPLE_TEAM_ID="$APPLE_TEAM_ID" APP_BUNDLE_ID="$APP_BUNDLE_ID" APP_STORE_PROFILE_UUID="$APP_STORE_PROFILE_UUID" ASC_API_ISSUER_ID="$ASC_API_ISSUER_ID" ASC_API_KEY_ID="$ASC_API_KEY_ID" ASC_API_KEY_PATH="$asc_key_path" CBIO_DART_DEFINE_FROM_FILE="$cbio_defines_path" DISTRIBUTE_INTERNAL=yes LIVE_ACTIVITY_APP_STORE_PROFILE_UUID="$LIVE_ACTIVITY_APP_STORE_PROFILE_UUID" LIVE_ACTIVITY_BUNDLE_ID="$LIVE_ACTIVITY_BUNDLE_ID" RELEASE_APPROVED=yes RELEASE_COMMIT="$RELEASE_COMMIT" RELEASE_VERSION="$RELEASE_VERSION" TESTFLIGHT_CHANGELOG="$changelog" TESTFLIGHT_EXTERNAL_TESTER_COUNT="$TESTFLIGHT_EXTERNAL_TESTER_COUNT" TESTFLIGHT_EXTERNAL_TESTER_IDS_SHA256="$TESTFLIGHT_EXTERNAL_TESTER_IDS_SHA256" TESTFLIGHT_GROUP="$TESTFLIGHT_GROUP" TESTFLIGHT_GROUP_ID="$TESTFLIGHT_GROUP_ID" TESTFLIGHT_INTERNAL_TESTER_ID="$TESTFLIGHT_INTERNAL_TESTER_ID" TESTFLIGHT_MODE="$RELEASE_AUDIENCE" TESTFLIGHT_NOTIFICATION_RECEIPT_PATH="$state_dir/notification.json" TESTFLIGHT_UPLOAD_PROVENANCE_PATH="$state_dir/upload-provenance.json" \
               ./scripts/testflight.sh
           )
 

@@ -32,6 +32,20 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+  vendor-material-guard:
+    name: Vendor Material Guard
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install checksum-pinned quality tools
+        run: make tooling-bootstrap
+
+      - name: Reject vendor material and prove the rule with a canary
+        run: ./scripts/check-cbio-vendor-material.sh
+
   dependency-review:
     name: Dependency Review
     if: github.event_name == 'pull_request'

@@ -56,6 +56,14 @@ app.*.map.json
 *.log
 *.swp
 
+# Private physical-device captures (the harness also rejects Git-local output)
+openglucose-protocol-captures/
+.openglucose-passive-capture
+bugreport-*.zip
+btsnoop_hci.log
+*.pcap
+*.pcapng
+
 # Apple credentials / certs (defense in depth — these should never be in repo)
 *.p8
 *.p12

@@ -0,0 +1,39 @@
+# Secret scanning policy for the repository sweep.
+#
+# The default rule set is extended, never replaced, and no path is exempt: a
+# secret introduced anywhere in the tree still fails the sweep. Every entry
+# below either names a value that is already in this repository's history and is
+# not a credential, records the single historical binding that holds a
+# key-derived test vector, or scopes one obsolete commit that a release
+# aggregate still reaches through a merge it later reverted.
+
+title = "OpenGlucose secret scanning policy"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Known non-secret values, one recorded key-derived fixture binding, and one superseded commit."
+regexTarget = "line"
+regexes = [
+  # macOS self-test storage entry name: a local keychain label, not a credential.
+  '''^\s*const testKey = 'ct5[.]macos[.]selftest[.]v1';$''',
+  # App Store Connect issuer identifier: an identifier, not a credential. The
+  # credential for that API is a private key file that is not in this repository.
+  '''API_ISSUER_ID="[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}"''',
+  # Test-only fixture defaults in a Dart test helper, bounded to that shape.
+  '''^\s*String token = '[A-Za-z0-9_-]{24}',$''',
+  # RECORDED, NOT DISMISSED: this binding held a published synthetic masking
+  # vector, which is a function of the vendor stream key and therefore material
+  # rather than a false positive. It is already public and no scanner setting can
+  # un-publish it; the binding is removed from every tip and the tree guard in
+  # `security/gitleaks-vendor-material.toml` rejects it or any successor at the
+  # tip. Purging the history and rotating the material are decision requests, not
+  # something this policy can settle. Bounded to this one binding name.
+  '''const _authMasked = ''',
+]
+# The sensor lane's first redaction commit carried a synthetic, key-shaped test
+# fixture. That commit has been rewritten and is no longer a tip, but
+# `release/v0.4.0-lane-append` merged it and then reverted the merge, so it is
+# still reachable. Bounded to that one commit; the tip guard covers every tip.
+commits = ["3be16fc212b699d7e9be1852dcbbac8bec6e3ec0"]
@@ -0,0 +1,14 @@
+# Reviewed gitleaks false positives.
+#
+# Each entry below was manually checked against the actual diff and
+# confirmed to contain no real credential, token, or secret material.
+# Do not add an entry here without doing that check first, and say why.
+
+# ct5.macos.selftest.v1 is a FlutterSecureStorage/Keychain *lookup key
+# name* (like a dictionary key), not a credential value. It labels a
+# throwaway self-test entry that _selfTestKeychain() in
+# openhealth/lib/yuwell_macos_debug_main.dart writes, reads back, and
+# deletes to confirm the macOS Keychain is reachable before a debug BLE
+# attempt. generic-api-key matched on the identifier name and the
+# dotted-version-like string shape, not on any secret content.
+164b1705bfab7c622088e526de2cfbb46cf485f3:openhealth/lib/yuwell_macos_debug_main.dart:generic-api-key:103
@@ -10,6 +10,79 @@ expectations are defined in [docs/compatibility.md](docs/compatibility.md).
 
 ## [Unreleased]
 
+### Fixed
+
+- Keep CBIO raw sensor values out of glucose charts, target ranges, native live
+  values, wellness summaries and glucose export columns, including restored
+  CBIO records with missing quality flags. Show the unscaled raw integer without
+  a glucose unit; preserve stored raw records and diagnostic export fields.
+
+### Added
+
+- Add the `cgm_cbio` GS1 live driver and app surface: `FF30` discovery mapping,
+  read-only `FF31` reply inspection, an authenticated, fail-closed read session
+  with bounded history sync, and live glucose rows. Vendor link material is
+  injected at build time, never compiled into the package. SiSensing UUID and
+  protocol evidence stay recorded. Record a separately authorized Mac bench
+  probe in the evidence document.
+- Add a durable, redacted GS1 evidence artifact for device-backed runs:
+  `make cbio-gs1-evidence` records one `gs1-session-<utc>-<harness>.json` per run
+  with the session outcome, record counts and index ranges, closed error
+  taxonomy, and app/harness identity, and indexes it. Both device harnesses now
+  assert the record's invariants instead of printing lines for a human to read.
+- Add a self-proving vendor-material guard (`make vendor-material-guard`, a
+  dedicated security workflow job): the rule rejects a synthetic canary and must
+  also clear the checked-out tree, so a rule that stops matching fails the check
+  rather than reporting a clean repository.
+- Add a private Android Gen1 Libre 2 receiver path with an explicitly initiated
+  NFC streaming exchange, encrypted receiver state, durable login counters,
+  exact-target Bluetooth connection, and CRC-validated packet diagnostics.
+  A separate GPL reference decoder can display provisional current estimates
+  in the explicit private bench build. Neither path is enabled in normal builds.
+- Keep sensor setup inline on the home screen with automatic Bluetooth
+  discovery. A `Can't find your sensor?` action opens model-specific help;
+  AiDEX/LinX stays on Bluetooth, while an explicit FreeStyle Libre 2 selection
+  opens guided NFC in debug capture builds. Move sample data to Settings.
+- Add an identifier-free Libre NFC scan event bridge with an animated
+  listening state, neutral tag detection, verified model identification, and
+  generic retry states. Raw tag identifiers and protocol bytes stay in the
+  bounded app-private capture.
+- Add a pure-Dart, target-unverified Libre 2-family offline protocol core for
+  UUID/topology classification, observation-only sequence validation, and
+  strict opaque fragment assembly. It contains no live sensor I/O, keys,
+  authentication, activation, decryption, or glucose decoding.
+- Add a pure-Dart, target-unverified Yuwell Anytime CT5 offline protocol core
+  with synthetic checksum, framing, transform, authentication-arithmetic, and
+  record-parser tests. It contains no BLE transport, live driver, activation,
+  proprietary binary, real identifier, or vendor-native glucose algorithm.
+- Add an app-owned multi-driver registry that routes one physical BLE scan by
+  stable vendor driver ID while preserving existing AiDEX identifiers, storage
+  keys, histories, and presentation behavior.
+
+### Changed
+
+- Keep the current NFC calibration patch separate from the frozen Libre 2
+  Bluetooth receiver patch. Verify the receiver binding and all FRAM CRCs
+  before saving calibration for the private debug decoder.
+- Reuse a confirmed Libre receiver after a fresh, same-sensor NFC read instead
+  of repeating streaming setup. Failed or stale verification cannot start a
+  new NFC enable attempt.
+- Restore the saved Libre receiver before discovery, and wait for a fresh
+  exact-target advertisement before one explicit Bluetooth connection attempt.
+  Preserve the completed NFC setup and login counters across app restarts.
+- Show closed, user-readable Libre connection failures instead of raw internal
+  codes, and distinguish radio search from successful data reception.
+- Full-product protocol capture builds can keep the existing AiDEX and LinX
+  driver available while passively recording Libre-family observations. The
+  strict capture-only entry point remains observation-only.
+- The one-shot target-unverified Libre patch-information probe now requires an
+  exact eight-byte ISO 15693 identity, derives its manufacturer byte from that
+  identity, accepts only an exact successful seven-byte response, and rejects
+  unknown model signatures before publishing a UI result.
+- The Libre NFC animation now starts only after the native reader confirms NFC
+  and capture readiness. Reader loss publishes a closed retry state; reopening
+  or retrying waits for a fresh native state instead of inventing readiness.
+
 ## [0.1.6] - 2026-08-31
 
 ### Added

@@ -4,9 +4,11 @@ SHELL := /bin/sh
 
 .PHONY: help bootstrap tooling-bootstrap tooling-check hooks format \
 	format-check lint typecheck test-unit test-integration test-e2e test \
+	cbio-gs1-evidence \
+	cbio-gs1-decode-comparison \
 	build build-android build-web build-ios build-macos test-ios-native \
 	test-macos-native \
-	verify-android-release-signing check
+	verify-android-release-signing vendor-material-guard check
 
 platform_checks :=
 ifeq ($(shell uname -s),Darwin)
@@ -26,6 +28,9 @@ tooling-bootstrap: ## Install checksum-pinned repository quality tools.
 tooling-check: tooling-bootstrap ## Run ShellCheck and actionlint with pinned versions.
 	@./scripts/check-tooling.sh
 
+vendor-material-guard: tooling-bootstrap ## Reject vendor material and prove the guard with a canary.
+	@./scripts/check-cbio-vendor-material.sh
+
 hooks: ## Install the pinned Lefthook Git hooks.
 	@./scripts/install-lefthook.sh
 
@@ -50,6 +55,12 @@ test-integration: ## Run every tagged or directory-based integration test.
 test-e2e: ## Report the explicitly deferred device end-to-end lane.
 	@./scripts/flutter-workspace.sh test-e2e
 
+cbio-gs1-evidence: ## Run one GS1 session on a device and record a redacted artifact.
+	@./scripts/cbio-gs1-evidence.sh
+
+cbio-gs1-decode-comparison: ## Replay one captured GS1 log as a side-by-side decode.
+	@./scripts/cbio-gs1-decode-comparison.sh
+
 test: test-unit test-integration ## Run all locally configured automated tests.
 
 build: build-android build-web ## Build the portable Android and web targets.
@@ -75,4 +86,4 @@ test-macos-native: ## Run the macOS RunnerTests on this Mac.
 verify-android-release-signing: ## Prove Android release signing fails closed without credentials.
 	@./scripts/flutter-workspace.sh verify-android-release-signing
 
-check: tooling-check format-check lint test build verify-android-release-signing $(platform_checks) ## Run every required CI gate supported by this host.
+check: tooling-check vendor-material-guard format-check lint test build verify-android-release-signing $(platform_checks) ## Run every required CI gate supported by this host.