feat(mobile): add the native posthog triage app

.agents/skills/requesting-mobile-releases/SKILL.md

@@ -0,0 +1,108 @@
+---
+name: requesting-mobile-releases
+description: >
+  Decides whether a PostHog mobile app change can ship as an over-the-air (OTA) update or needs a native
+  store release, then creates the release request file under products/mobile/releases/requests/. Use
+  before creating or editing a mobile release request, when asked to ship, release, publish or push an
+  update of the mobile app, and when a change under products/mobile touches package.json,
+  pnpm-lock.yaml, app.config.ts, eas.json, plugins/, targets/, modules/ or any expo-* or react-native-*
+  dependency. Covers the native fingerprint comparison, the version rule, and what the request must say.
+---
+
+# Requesting mobile releases
+
+A merged release request is the release trigger.
+Mobile Release publishes it from `master` with no human gate.
+An `ota` request goes straight to the production channel that installed apps pull from.
+A `native` request submits both binaries to TestFlight and Play internal testing.
+Decide the kind before you create the file, and say which kind you chose and why in the PR description.
+
+[RELEASING.md](../../../products/mobile/docs/RELEASING.md) has the commands and the recovery procedure.
+[OTA.md](../../../products/mobile/docs/OTA.md) has the runtime rules.
+This skill is the decision procedure.
+
+## 1. Classify the change
+
+An OTA update replaces JavaScript and assets only.
+The installed binary keeps its native code, so anything the native fingerprint covers forces a native release.
+A change needs `native` when it touches any of:
+
+- a dependency with native code: most `expo-*`, `react-native-*` and `@react-native-*` packages, `@shopify/react-native-skia`, and anything that ships `ios/` or `android/` directories in `node_modules`;
+- `app.config.ts` fields under `ios`, `android`, `plugins`, `runtimeVersion` or `version`, and icons, splash, entitlements or permissions;
+- `plugins/`, `targets/` (widgets), `modules/` (local native modules), or the build profiles in `eas.json`;
+- the Expo SDK or React Native version;
+- a `pnpm-lock.yaml` change that adds or bumps any of the above, also transitively.
+
+Changes limited to `src/`, `app/` routes, assets, copy and fixtures are OTA candidates.
+
+Quick scan from `products/mobile`:
+
+```sh
+git diff origin/master --stat -- package.json pnpm-lock.yaml app.config.ts eas.json plugins targets modules
+```
+
+An empty result means the change is probably OTA-safe.
+A non-empty result does not make it native by itself. Run step 2 either way.
+
+## 2. Confirm with the fingerprint
+
+`pnpm release:fingerprint` prints the iOS and Android native fingerprints of the checkout, computed the same way the publisher computes them.
+Compare the branch against the commit of the last completed native release:
+
+```sh
+# Find the last completed release and its native baseline commit.
+TAG_SHA=$(gh api repos/PostHog/posthog/git/ref/tags/mobile-production -q .object.sha)
+LAST_ID=$(gh api "repos/PostHog/posthog/git/tags/$TAG_SHA" -q .message | jq -r .id)
+BASE=$(gh release view "mobile-release/$LAST_ID" --repo PostHog/posthog --json body -q .body | jq -r .native.commit)
+
+# Head: in the branch, from products/mobile.
+pnpm install --frozen-lockfile && pnpm release:fingerprint > /tmp/fp-head.json
+
+# Base: a disposable worktree at the baseline commit.
+git worktree add --detach /tmp/mobile-fp-base "$BASE"
+(cd /tmp/mobile-fp-base/products/mobile && pnpm install --frozen-lockfile && pnpm release:fingerprint > /tmp/fp-base.json)
+git worktree remove --force /tmp/mobile-fp-base
+
+diff /tmp/fp-base.json /tmp/fp-head.json
+```
+
+Before the first hosted native release there is no `mobile-production` tag. Compare against `origin/master` instead, and remember that the first hosted release must be `native`.
+
+- Identical fingerprints: the change can ship as `ota`.
+- Any difference: request `native` and raise `version` in `app.config.ts`.
+
+Compute both sides on the same machine.
+Locally neither side has the EAS production environment (`GOOGLE_SERVICES_JSON`, `APPLE_TEAM_ID`), so a local fingerprint never matches the one in a receipt, but a local base-to-head comparison is valid.
+The publisher repeats the comparison with the real environment after the merge and refuses an incompatible OTA. Catch it here, before the PR merges.
+
+## 3. Apply the version rule
+
+- `ota`: keep `version` in `app.config.ts` equal to the runtime of the last native release.
+- `native`: raise `version` above it. Build numbers come from EAS (`autoIncrement`); do not set them by hand.
+
+`pnpm release:check` enforces this against the PR base in CI.
+
+## 4. Create the request
+
+From `products/mobile`, with `LAST_ID` from step 2 as the predecessor:
+
+```sh
+pnpm release:request ota --id <lowercase-id> --previous "$LAST_ID" --notes "What testers should verify."
+pnpm release:request native --id native-<version-digits> --previous "$LAST_ID" --notes "What changed natively."
+pnpm release:check
+pnpm release:test
+```
+
+Rules the publisher enforces:
+
+- One new request per PR. A push that adds two fails.
+- Requests are append-only. Never edit, rename or delete a merged request.
+- Commit the request with the app change it releases.
+- The notes become the body of a public GitHub prerelease. Keep customer names, credentials and internal links out of them.
+
+Run `/running-mobile-demo-flows` on the same branch before you open the PR.
+
+## 5. Report
+
+State the kind, the fingerprint result per platform, the predecessor id, and the app version.
+If you could not run the fingerprint comparison, say so and do not create an `ota` request.

.agents/skills/running-mobile-demo-flows/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: running-mobile-demo-flows
+description: >
+  Runs the PostHog mobile app's Argent demo flows (demo-smoke and views-smoke) on a local iOS simulator
+  against a bundled Release build, and reads their results. Use before reporting a change under
+  products/mobile that touches a screen, navigation, the demo fixtures, a testID, or a flow file as done,
+  and when asked to smoke-test the mobile app. CI does not run these flows, so the local run is the only
+  UI check a change gets.
+---
+
+# Running mobile demo flows
+
+The flows live in `products/mobile/.argent/flows/`.
+`demo-smoke` walks the inbox, a report, the hand-off sheet, decisions and chat in demo mode.
+`views-smoke` covers the Views tab.
+Both start and end on the sign-in screen with demo mode off, so a run can repeat right away.
+[TESTING.md](../../../products/mobile/docs/TESTING.md#demo-walkthrough-on-the-ios-simulator) lists each step.
+
+## When to run them
+
+- A change under `products/mobile/app/`, `src/features/`, `src/ui/`, navigation, or the demo fixtures.
+- A change to a flow YAML or to a `testID` the flows use.
+- Before you create a release request (see `/requesting-mobile-releases`).
+
+Skip them for a change that only touches docs, tests, backend code, or build configuration.
+
+## Prerequisites, once per machine
+
+- Xcode with an iOS simulator runtime, and CocoaPods. The scripts are verified on Xcode 26.6 with iOS 26.5 and on Xcode 27.1 with iOS 27.0.
+- Argent 0.30.1 in a private prefix, so it does not collide with an editor's Argent server:
+
+```sh
+DO_NOT_TRACK=1 npm install --prefix /tmp/mobile-argent-tools --no-audit --no-fund @swmansion/argent@0.30.1
+```
+
+## Run the bundled flows
+
+From `products/mobile`:
+
+```sh
+export PATH="/tmp/mobile-argent-tools/node_modules/.bin:$PATH"
+export DO_NOT_TRACK=1
+pnpm install --frozen-lockfile
+bash scripts/ci-argent-build.sh /tmp/mobile-argent-build /tmp/mobile-argent-artifacts
+bash scripts/ci-argent.sh \
+    /tmp/mobile-argent-build/Build/Products/Release-iphonesimulator/PostHog.app \
+    /tmp/mobile-argent-artifacts
+```
+
+Budget about 8 minutes for a fresh native build and about 3 minutes for both flows.
+The build regenerates the ignored `ios/` directory, so use a disposable worktree when the checkout has manual native edits.
+The flow script creates its own temporary simulator, so other booted simulators do not interfere.
+Set `ARGENT_IOS_RUNTIME` to a runtime id from `xcrun simctl list runtimes` to pick another installed runtime.
+
+## Read the result
+
+- Exit code 0 means both flows passed.
+- On failure, open `/tmp/mobile-argent-artifacts/`: the JSON report has one entry per step, failed steps have a screenshot, and `prebuild.log`, `pods.log` and `build.log` explain a native build failure.
+- Both flows run even when the first fails. Report each one.
+- An `idle` step can warn that a small part of the screen was still changing, such as the text caret. The next step waits for a stable element, so this warning is expected.
+
+## Iterate on a flow with the dev client
+
+The bundled build is slow to rebuild. While you edit a flow or a screen, use Metro instead:
+
+1. `pnpm ios --port 8181` builds the dev client, boots a simulator and starts Metro.
+2. In the dev menu, turn off **Tools button** and **Fast refresh**. The floating gear swallows taps on the inbox More button, and the refresh banner covers Back and Close.
+3. Make sure demo mode is off (Settings, **Exit demo**).
+4. `argent flow run demo-smoke --platform ios` from `products/mobile`. Add `--device <udid>` when more than one simulator is booted.
+
+Known traps: a system "Open in PostHog?" alert after a deep link is invisible to Argent selectors, so dismiss it with a raw tap.
+If every selector step times out with a ViewInspector RPC error, drive by normalized coordinates and screenshots instead.
+[TESTING.md](../../../products/mobile/docs/TESTING.md#troubleshooting) has the rest.
+
+## Report
+
+State which flows ran, the Xcode and runtime versions, and pass or fail per flow.
+Name the failed step and its screenshot path when one failed.
+Do not commit `.argent/recordings/` or the artifact directory.

.github/CODEOWNERS

@@ -91,3 +91,8 @@ products/isolation_baseline.txt @PostHog/team-devex
 /CLAUDE.md @PostHog/team-devex
 .github/pull_request_template.md @PostHog/team-devex
 .agents/skills/writing-pr-descriptions/ @PostHog/team-devex
+
+# The mobile owner reviews app changes and the workflows that build and release it.
+products/mobile/** @cvolzer3
+products/desktop/apps/mobile/** @cvolzer3
+.github/workflows/*mobile*.yml @cvolzer3

.github/workflows/ci-python.yml

@@ -140,12 +140,16 @@ jobs:
                         - 'products/desktop/packages/core/src/inbox/objectKinds.generated.ts'
                         - 'packages/agent/packages/agent-contracts/src/objectTagKinds.generated.ts'
                         - 'frontend/src/lib/components/AgentObjectTags/objectKinds.generated.ts'
+                        - 'products/mobile/src/features/chat/objectKinds.generated.ts'
                         - 'products/tasks/frontend/modelCatalog.generated.ts'
                         - 'packages/agent/packages/agent-contracts/src/model-catalog.generated.ts'
                         - 'services/mcp/src/lib/oauth-scopes.generated.ts'
                         - 'frontend/src/lib/oauthScopes.generated.ts'
                         - 'products/commands/commands.generated.json'
                         - 'products/commands/COMMANDS.generated.md'
+                        # Formatter inputs can change the generated mobile projection.
+                        - 'products/mobile/biome.json'
+                        - 'products/mobile/pnpm-lock.yaml'
                         # hogli CLI changes need validation
                         - 'tools/hogli/**'
                         - 'tools/hogli-commands/hogli_commands/**'

.github/workflows/mobile-build.yml

@@ -0,0 +1,115 @@
+name: Mobile Build
+
+# Queues internal development/preview builds. Production binaries and OTA updates
+# are published only by Mobile Release after a release request merges to master.
+# Release steps: products/mobile/docs/RELEASING.md.
+#
+# Store credentials stay on EAS, set once with `eas credentials`, so this workflow
+# never handles an Apple or Google key.
+
+on:
+    # Manual only. A pull request run executes code its author controls, so it must
+    # never reach the Expo token or the stores.
+    workflow_dispatch:
+        inputs:
+            profile:
+                description: 'EAS build profile'
+                type: choice
+                default: preview
+                options:
+                    - development
+                    - preview
+            platform:
+                description: 'Platform'
+                type: choice
+                default: all
+                options:
+                    - all
+                    - ios
+                    - android
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.profile }}-${{ inputs.platform }}
+    # Let an explicit build dispatch finish uploading and submitting to EAS.
+    # This only serializes GitHub runs in this group. With --no-wait, EAS builds
+    # continue independently and may overlap.
+    cancel-in-progress: false
+
+permissions:
+    contents: read
+
+jobs:
+    build:
+        if: github.repository == 'PostHog/posthog' && github.ref == 'refs/heads/master'
+        environment: mobile-build
+        name: EAS build (${{ inputs.profile }}, ${{ inputs.platform }})
+        runs-on: depot-ubuntu-24.04
+        timeout-minutes: 20
+        defaults:
+            run:
+                working-directory: products/mobile
+        steps:
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  ref: ${{ github.sha }}
+                  persist-credentials: false
+                  sparse-checkout: products/mobile
+                  sparse-checkout-cone-mode: false
+
+            - name: Setup pnpm
+              uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+              with:
+                  package_json_file: products/mobile/package.json
+              env:
+                  # See mobile-ci.yml: a stalled npm audit or fetch otherwise waits 300s.
+                  NPM_CONFIG_FETCH_TIMEOUT: 45000
+                  NPM_CONFIG_FETCH_RETRIES: 2
+                  NPM_CONFIG_AUDIT: 'false'
+                  NPM_CONFIG_FUND: 'false'
+
+            - name: Setup Node.js
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              with:
+                  node-version-file: products/mobile/.node-version
+                  token: ${{ github.token }}
+
+            - name: Get pnpm store path
+              id: pnpm-store
+              run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+            # Same key as mobile-ci.yml, which writes it on master. Restore only.
+            - name: Restore pnpm store
+              uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+              with:
+                  path: ${{ steps.pnpm-store.outputs.path }}
+                  key: mobile-pnpm-${{ runner.os }}-${{ hashFiles('products/mobile/pnpm-lock.yaml') }}
+                  restore-keys: mobile-pnpm-${{ runner.os }}-
+
+            # EAS CLI evaluates app.config.ts and its config plugins, which need the
+            # app's dependencies on disk.
+            - name: Install dependencies
+              run: pnpm install --frozen-lockfile
+
+            - name: Setup EAS
+              uses: expo/expo-github-action@eab7a230208c952974db8c3245cfd78402c7b385 # 9.0.0
+              with:
+                  # Pinned so a new eas-cli release cannot change a release build unannounced.
+                  eas-version: 24.8.0
+                  token: ${{ secrets.MOBILE_BUILD_EXPO_TOKEN }}
+
+            - name: EAS internal build
+              env:
+                  PLATFORM: ${{ inputs.platform }}
+                  PROFILE: ${{ inputs.profile }}
+              run: |
+                  if [[ "$PROFILE" != "development" && "$PROFILE" != "preview" ]]; then
+                    echo "::error::Use a merged mobile release request for production builds."
+                    exit 1
+                  fi
+                  sh scripts/eas-build.sh \
+                    --non-interactive \
+                    --no-wait \
+                    --platform "$PLATFORM" \
+                    --profile "$PROFILE" \
+                    --message "${GITHUB_REF_NAME}@${GITHUB_SHA::12}"