fix(ios): replace Python stamp callback with native jobs

[torlando-tech]

Summary

• replace the Python ctypes.CFUNCTYPE cancellation trampoline with job-owned native Swift state
• expose callback-free start, poll, cancel, release, and cancel-all C ABI functions while preserving multithreaded Swift proof-of-work
• linearize cancellation with result publication so a cancelled job cannot subsequently return a stamp
• fail closed on unexpected poll statuses and independently unregister LXMF's external generator during teardown
• retain and verify the new exports in stripped Release artifacts, with CI guards preventing callback trampoline reintroduction

Root cause

The previous Swift-to-Python cancellation callback used a libffi closure backed by dynamically generated executable memory. Physical arm64e devices could reject that page under iOS code-signing enforcement, producing CODESIGNING 2 Invalid Page crashes while stamping.

Verification

• 207 portable/static tests passed
• 7 native Swift job tests passed
• native lifecycle suite passed 50 consecutive stress runs
• post-processed signed Release build passed signature, ABI, and no-harness inspection
• iOS Simulator exercised success, cancellation, retry, and idle behavior
• physical arm64e iPhone exercised success, cancellation with no result publication, retry, background/foreground, 60-second idle, and generation after process relaunch
• physical embedded-Python/LXMF send delivered a cost-12 stamped message to a controlled peer; the receiver validated the stamp and Columba received the delivery proof
• two independent final reviews reported no findings

Risk and rollback

The change is isolated to the iOS external stamper bridge and native stamp-job lifecycle. The synchronous callback-free native generator remains available. Rollback is the three commits in this PR, but would restore the unsafe reverse callback and is not recommended.

Environment limitation

The exact reported iOS 27 beta device was unavailable. Validation used the closest installed iOS 26.4 Simulator and a physical arm64e iPhone on iOS 26.

[greptile-apps]

Greptile Summary

The PR replaces the Python callback-based stamp cancellation bridge with callback-free, job-owned Swift state and a start/poll/cancel/release C ABI.

• Adds a native asynchronous stamp-job registry with cancellation/result linearization.
• Updates the embedded Python bridge to poll native jobs, fail closed on unexpected statuses, and cancel all work during teardown.
• Exports and verifies the new Release symbols and adds Swift and Python lifecycle regression coverage.

Confidence Score: 5/5

The PR appears safe to merge, with the new callback-free stamp lifecycle consistently guarded across Swift, Python, teardown, exports, and Release artifact verification.

Native jobs retain their work safely, serialize cancellation against result publication, fail closed at the Python boundary, and are cancelled and detached during teardown; no concrete blocking failure remains.

Important Files Changed

Filename	Overview
Sources/SwiftBLEBridge/StampGenerator.swift	Introduces native cancellation state, asynchronous job ownership, serialized result publication, and callback-free C ABI lifecycle functions.
app/rns_bridge.py	Replaces the ctypes callback trampoline with native job polling and adds fail-closed cancellation and teardown behavior.
Sources/ColumbaApp/Resources/ColumbaApp.exports	Replaces the retired cancellable callback export with all five native job lifecycle exports.
Tests/SwiftBLEBridgeTests/NativeStampJobTests.swift	Covers proof generation, cancellation, release, cancel-all, worker termination, and invalid costs.
.github/workflows/tests.yml	Adds execution of the native stamp-job regression suite to CI.
Package.swift	Registers the SwiftBLEBridge test target required by the new native lifecycle tests.

Sequence Diagram

sequenceDiagram
    participant LXMF
    participant Python as rns_bridge.py
    participant ABI as Native C ABI
    participant Registry as Swift Job Registry
    participant Workers as PoW Workers
    LXMF->>Python: external_generator(workblock, cost, token)
    Python->>ABI: stamp_job_start(...)
    ABI->>Registry: register job
    Registry->>Workers: start proof-of-work
    loop Until terminal
        Python->>Python: check cancellation token
        opt Cancelled
            Python->>ABI: stamp_job_cancel(jobID)
            ABI->>Registry: cancel job
        end
        Python->>ABI: stamp_job_poll(jobID, output)
        ABI-->>Python: running / stamp / cancelled / failed
    end
    Python->>ABI: stamp_job_release(jobID)
    Python-->>LXMF: stamp or None

Loading

_{Reviews (1): Last reviewed commit: "fix(ios): avoid pointer capture in stamp..." | Re-trigger Greptile}