Distribution and rollout
How a native app moves from publish through review and staged rollout to a consent install on the car.
A native app reaches a car through a fixed lifecycle: you publish, an admin reviews, you promote an approved release to a rollout percentage, the car polls for OTA updates, and the owner confirms an Android install dialog. Each step is gated, and the car verifies every APK offline before it installs.
Lifecycle
The release moves through these stages:
Publish. Run i99dash apk publish to validate, hash, attest, and submit the manifest. The submission enters review as pending.
Review. An admin approves or rejects the submission. Native code on a vehicle is higher-risk, so a submit defaults to human review, not auto-approve.
Promote. Run i99dash apk promote on an approved release to start a staged rollout (rolling at a percentage, or published for a full release).
OTA poll. Each car polls for updates and offers the new version to owners inside its rollout bucket.
Consent install. The owner confirms the standard Android install dialog. There is no silent install for third-party apps.
Review states
A submission carries one review state at a time:
| State | Meaning |
|---|---|
pending | Submitted and waiting for admin review. New submits start here. |
approved | Cleared for promotion. Only approved releases can be promoted. |
rejected | Declined by an admin. Resubmit a new version to try again. |
revoked | Pulled from the catalog after approval. Cars refuse it. |
A package that was previously rejected or revoked is forced back to pending when it re-enters review.
Staged rollout
promote --rollout N exposes a release to a stable per-car bucket from 0 to N, where N is an integer percent. For example, --rollout 10 reaches about 10% of cars, and the same car stays in the same bucket as you raise the percentage. Start low and raise it as you gain confidence.
i99dash apk promote --rollout 10The --status flag controls the release mode:
rolling(default) exposes the release only to cars inside the rollout bucket.publishedis a full release that supersedes older versions of that app.
i99dash apk promote --rollout 100 --status publishedCars detect a newer release by versionCode. Each publish uses a strictly greater versionCode than the package current max, so the car can tell when an update is available.
How the owner installs
Owners manage native apps from the "Native Apps" tab in the car app, which lists approved apps and lets the owner install or uninstall them. Installing runs the standard Android install dialog, which the owner confirms. The platform never installs a third-party app silently.
Verify before install
Before the install dialog appears, the car runs every check offline:
- Verifies the platform release envelope against a pinned platform public key. See Signing and trust.
- Re-checks the APK SHA-256 and the signer certificate SHA.
- Confirms the version is not a downgrade.
- Confirms the package is not revoked.
Any failure means no install. A revoked app, or an app from a suspended publisher, is pulled from the catalog and refused.
Every check is fail-closed and runs on the car without a network. If verification fails, the owner never sees an install prompt.