Purpose: Current staging acceptance entry points and build-source handoff.
Scope: QA on canonical HTTPS staging and the disposable native devbox.
Source of truth for: Canonical URLs, release receipts and Android source limits.
Last updated: 2026-11-14
Update when: The deployed application release or native producer changes.

# Baobab staging access

Use these canonical addresses. HTTP ingress is open; application sign-in remains
required for authenticated product operations. Use only the synthetic test
accounts distributed in the private QA fixture handoff. No HTTP Basic password
is needed and no real patient data belongs in staging.

- Patient: https://patient.baobab.staging.championspirit.com/
- Doctor and clinic: https://console.baobab.staging.championspirit.com/
- Partner laboratory: https://labo.baobab.staging.championspirit.com/
- Partner: https://partenaire.baobab.staging.championspirit.com/
- API: https://api.baobab.staging.championspirit.com/api/v1/
- Landing receipt: https://baobab.staging.championspirit.com/landing-assets/release.json
- Native artifact receipt: https://patient.baobab.staging.championspirit.com/downloads/BUILD.json

## Acceptance state

The landing receipt attests only the landing source and asset hashes. Do not use
it as proof of the API, native binary or a complete clinical journey. QA-001 stays
open until the accepted main API/front ends, flags, synthetic account catalogue,
mail inbox and authenticated journeys are verified together. A service that has
not been composed must report its real error; no fallback transport is accepted.
No account password, token or code is published in this guide.

## Android source and disposable-devbox preparation

Authoritative product source is the repository's accepted main, under:

- `apps/mobile/app.config.ts` — current native configuration.
- `apps/mobile/eas.json` — current native build profiles and toolchain pin.
- `apps/mobile/app/` — actual application routes.
- `apps/mobile/src/` — patient Classic/Easy, doctor and shared host/runtime code.
- `packages/` — the shared generated client and native dependencies of main.

On the disposable KVM devbox only, fetch and detach the accepted integration SHA
identified by INT, install its immutable dependency graph and retain that SHA in
the native build receipt. Never install/build mobile on the shared development VPS.

```sh
git fetch origin main
git switch --detach <INT-accepted-main-SHA>
corepack enable
yarn install --immutable
```

Android compilation is still gated by QA-003: accepted main's native-proof profile
currently declares only iOS. B/C/INT must land the actual Android platform/package,
SDK/plugin compatibility and build profile before a product APK can be attested.
Do not disable native plugins, bypass the mobile session or use a separate branch
as a substitute for a main-native build. The existing download's BUILD.json records
its own source; it is not currently proof of an Android product build from main.
After that native producer lands, record exact main SHA, toolchain, API base URL,
application id, build variant and APK SHA256 and run the agreed KVM/device journeys.