N4 What the app uses of the device
- Area
- N — Companion
- Audience
- both
- Kind
- feature
- Status
- accepted
- Maturity
- building
- Labels
- mobile, security, ux
The feature in the specification · Read at
Requirements
A permission MUST be requested at the point of first use, and MUST NOT be requested on launch.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/src/Api/Notifier.phpapp-modules/kernel/tests/Api/PermissionTest.phptests/Contract/NotifierContractTest.php
The app MUST state what a permission is for, in its own words, before the system prompt.
Every permission MUST be optional, and the app MUST offer a working alternative for each declined one.
A declined permission MUST NOT be requested again automatically.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/src/Api/Asked.phpapp-modules/kernel/tests/Api/AskedTest.phptests/Contract/NotifierContractTest.php
A session token MUST be stored in the platform's secure storage, and MUST NOT be written to application preferences, an app-readable file, or an unencrypted backup.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/src/Api/Configured.phptests/Contract/SecureStorageContractTest.php
Where the device offers no secure storage, the app MUST refuse to persist a session and MUST say why.
The app MUST lock on backgrounding, and MUST require biometric or passcode to resume.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/operator/src/Internal/Screens/Locked.phpbootstrap/Composition/NativePHP/WhenTheLockMoves.phpapp-modules/kernel/tests/Api/LockTest.php
Biometric failure MUST fall back to the device passcode and MUST NOT fall back to unlocked.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/src/Api/Authenticated.phpapp-modules/device/src/Api/PlatformAuth.phpapp-modules/kernel/tests/Api/LockTest.php
The task-switcher representation of the app MUST NOT show application content.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/operator/src/Internal/Screens/Locked.phpbridge/resources/android/CaptureRule.kttests/Contract/CaptureContractTest.php
A notification MUST NOT contain a credential, a household member's name, or the title of a requested item.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/src/Api/Notification.phpapp-modules/kernel/tests/Api/NotificationTest.php
The app MUST NOT raise alerts of its own; every notification MUST originate in the core's notification decisions.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/tests/Api/NotificationTest.phpapp-modules/kernel/tests/Api/WhatTheCoreDecidedTest.php
The app MUST NOT send analytics, telemetry or crash reports to any third party.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/src/Api/Assembled.phptests/Arch/NothingLeavesThisDeviceTest.php
A diagnostic report MUST be assembled for the operator to send, and MUST NOT be transmitted by the app.
The app MUST honour the platform's text scaling, screen reader, contrast and reduced-motion settings, and MUST NOT implement a parallel accessibility layer.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companiontests/Templates/ThePlatformOwnsAccessibilityTest.php
A notification MUST NOT be shown for a stack no longer configured on the device.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/src/Api/Notification.phpapp-modules/kernel/src/Api/StackId.phpapp-modules/kernel/tests/Api/NotificationTest.php
The app MUST declare a local-network permission purpose that states what the network is used for in the operator's terms, and MUST NOT ship a placeholder string.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companiontests/Arch/PermissionsAreExplainedTest.php
Where the platform requires permission before the local network may be reached, the app MUST report a refused permission as a distinct condition from an unreachable stack, and MUST offer the way to grant it.
A screen showing a credential, a session token or pairing material MUST be excluded from the task-switcher snapshot and from screen recording.
The app MUST require the device's own authentication on a cold start, and again on resume after a period the operator can configure; it MUST NOT prompt while an action it has already sent is still outstanding.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/src/Api/DeviceAuth.phpapp-modules/kernel/src/Api/Opening.phpapp-modules/kernel/tests/Api/LockTest.php
A notification shown while the app is locked MUST NOT disclose a finding's detail, a service name, or any value read from a stack.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/device/src/Api/PlatformNotifier.phpapp-modules/kernel/tests/Api/NotificationTest.php
Every control that can be operated MUST carry a label the screen reader announces, and a control whose only content is an icon MUST NOT rely on that icon to convey its purpose.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companiontests/Templates/ScreensSpeakToTheOperatorTest.php
Authentication on a cold start (N4-R19) MUST NOT be required where the device holds no pairing and no session, and the app MUST reach its first-run surface without a prompt.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/src/Api/Opening.phpapp-modules/kernel/src/Api/Stacks.phptests/Contract/StacksContractTest.php
Whether the device holds a pairing MUST be read from the store itself rather than from a flag the app maintains, and the unlocked first run MUST NOT be reachable once a pairing has been held.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/kernel/src/Api/Opening.phpapp-modules/kernel/src/Api/Stacks.phptests/Contract/StacksContractTest.php
While the app is locked, no application content MUST be drawn behind the lock, including a first-run surface, an empty state and any previously rendered frame.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/operator/src/Internal/Screens/Locked.phpbootstrap/Composition/NativePHP/TheLockIsOnTheGlass.phptests/Feature/NothingIsDrawnBehindTheLockTest.php
The app MUST NOT use Apple's or Google's push service, or any service able to read a notification; it MUST raise each notification locally, from its own pinned connection to the stack, while it runs and when the platform wakes it for background refresh, and on waking MUST notify what the stack raised since it last listened (ARCH-R281).
- locked by
- no version locks it yet
- recorded partial
- lemonfiber-companionapp-modules/sdk/src/Api/AlertsHeard.phpapp-modules/sdk/src/Internal/TheStreamsHeld.phpapp-modules/vault/src/Api/PlatformWhereHearingLeftOff.phpapp-modules/wayfinding/src/Api/WhatItListensWith.phpapp-modules/device/src/Api/PlatformNotifier.phptests/Contract/HearingContractTest.phptests/Contract/WhereHearingLeftOffContractTest.phptests/Feature/TheListOfStacksListensTest.phpapp-modules/wayfinding/src/Api/HearingWhileAway.phpapp-modules/device/src/Api/PlatformWakes.phpbridge/resources/android/WakeFunctions.ktbridge/resources/ios/WakeFunctions.swifttests/Feature/HearingTheStacksWhileTheAppIsAwayTest.phptests/Contract/WakingWhileAwayContractTest.php
On Android, where a UnifiedPush distributor is installed, the app MUST offer waking through it, MUST register the endpoint the distributor gives with each stack the operator turns it on for and remove it when turned off or the stack is removed (ARCH-R282), and MUST treat a push as a wake only, reading what to notify over its own connection.
- locked by
- no version locks it yet
- recorded open
- lemonfiber-companion
Where the operator turns notifications on, the app MUST say that while it is closed it hears a stack only when the platform wakes it, and so may notify late or not at all, on iOS and on Android without a UnifiedPush distributor.
- locked by
- no version locks it yet
- recorded partial
- lemonfiber-companionapp-modules/operator/src/Internal/ChoosesNotifications.phplang/en/device.phptests/Feature/SettingHowThisPhoneIsSetTest.php
Unless the stack says its replay holds every alert raised since the app last listened (ARCH-R281), the app MUST NOT present the alerts it notifies on waking as all of them, and MUST say to the operator, where notifications are turned on, that some may be missing; a household member MUST NOT be shown it.
- locked by
- no version locks it yet
- recorded done
- lemonfiber-companionapp-modules/operator/resources/views/how-this-phone-is-set.blade.phplang/en/settings.phptests/Feature/SettingHowThisPhoneIsSetTest.php