← FIELD GUIDES / FD-03EVIDENCE-LED WORKFLOW

Android and iOS release-artifact diff checklist

A package-first checklist for reviewing store-facing contract and payload changes between accepted and candidate mobile releases.

WHAT THIS CANNOT PROVE

Artifact inspection can expose what is present in a candidate and how it differs from a baseline. It does not guarantee store acceptance, policy compliance, runtime SDK behavior, or that an identifiable library version is vulnerability-free.

01 / COMPARISON CONTRACT

Compare like with like before interpreting the package.

Packaging format, signing stage, build configuration, architecture, and symbol handling can all dominate the delta.

01

Match format and stage

Compare AAB to AAB, APK to APK, or IPA/archive to the same stage. Record whether packages are signed, thinned, development, ad hoc, or distribution candidates.

02

Pin platform tooling

Record Unity, Gradle/Android tooling or Xcode, target/minimum OS, scripting backend, architecture set, and relevant build flags.

03

Carry expected changes

Let the release owner declare expected permission, SDK, capability, and payload changes. The review should distinguish them from surprises without hiding either.

02 / ANDROID

Inspect the merged Android contract and embedded payload.

Unity exports launcher and unityLibrary modules, and multiple sources contribute to the final application manifest and dependency graph.

01

Diff the final manifest

Compare permissions, features, components, intent filters, authorities, exported state, SDK levels, application flags, and other store- or security-relevant values in the merged result.

02

Inventory native and Java dependencies

Inspect packaged ABIs, .so libraries, AAR/JAR or resolved dependencies, identifiable versions, and additions caused by Unity plug-ins or Gradle modules.

03

Break down payload and symbols

Compare compressed and unpacked size by defensible package section; verify expected native debug-symbol outputs without treating their absence as proof of a release defect.

03 / IOS

Review the generated Xcode contract and the signed app.

Unity generates an Xcode project, while Xcode builds and signs the application. Evidence can change at each stage.

01

Diff bundle metadata

Compare bundle identifiers and versions, minimum OS, URL schemes, privacy and usage-description keys, supported devices, and relevant Info.plist values.

02

Inspect frameworks and slices

Inventory embedded frameworks, dynamic libraries, identifiable SDK versions, architectures, and unexpected simulator or debug content.

03

Verify final entitlements

Compare the target capability intent, entitlements file, provisioning profile allowance, signing log, and entitlements embedded in the signed app when diagnosing a change.

04 / REVIEW OUTPUT

Make every flag traceable to the package.

A release diff should help an owner decide what to inspect next, without masquerading as a store-review oracle.

01

Show added, removed, and changed

Include both sides and the path or package entry that supports the comparison. An unexplained removal can be as material as an addition.

02

Label version confidence

Distinguish declared versions, embedded version evidence, fingerprint-based guesses, and unknown libraries. Do not promote heuristics into exact inventory.

03

Apply explicit studio policy

Use review/block/observe status for agreed permissions, entitlements, SDK families, architectures, symbols, and size thresholds. Keep store approval outside the claim.

PRIMARY SOURCES

Inspect the underlying documentation.

This guide is XeSoft's evaluation framework, not a substitute for the source documentation. Links below go to the primary publisher.

UnityGradle project structure

Unity's launcher and unityLibrary modules, manifests, plug-ins, assets, symbols, and dependency files.

UnityHow Unity builds iOS applications

The Unity-to-Xcode build stages and incremental generation of plist and entitlement files.

UnityUnity Xcode project structure

Generated targets, frameworks, data, and Info.plist surfaces.

AppleDiagnosing issues with entitlements

How to inspect target, provisioning-profile, build-log, and signed-app entitlement state.

MATCHING PRIVATE PILOT

Apply the checklist to one real workflow.

Mobile Release Auditor is a narrowly scoped private-pilot proposal for turning this review contract into a repeatable report. The first step is fit and evidence, not a platform migration.

Read the Mobile Release Auditor brief