Repository navigation
Bind Android operational notifications and durable commands to current authority - #64
Merged
10 commits merged intoOct 16, 2026
Merged
10 commits merged into
10 commits merged into
Conversation
Unresolved notification clicks and small user commands survive recovery without converting reads into business events or applying stale work to another assignment. Constraint: PR483 is unmerged and undeployed; D05 and Issue62 remain gates. Rejected: Legacy start fallback after unknown atomic result | can duplicate partial business events. Confidence: high Scope-risk: moderate Directive: Keep new APIs OFF until server, policy, security and device gates are cleared. Tested: Typecheck, 253 tests, lint, Expo alignment, Android Hermes export, diff check and independent review. Not-tested: Real FCM, native candidate installation, production server integration and iOS.
Separate inbox receipts from business reads and defer navigation until the user finishes protected work. Recheck authority before moving and consume clicks only after a fresh visible destination commit. Reject malformed operational identities. Constraint: Driver PR64 management review R1-R3; dev remains the integration base Rejected: Discarding drafts or consuming unresolved clicks | interrupts driver work and hides unresolved authority Confidence: high Scope-risk: moderate Directive: Preserve the pending lease during editing, dialogs, saving and proof; never bypass Issue62 Tested: TypeScript; 319 tests; lint; Expo alignment; whitespace; independent review 66 tests Not-tested: New native APK; real FCM; new candidate device screens; server runtime integration
Constraint: Native integration checks must not replace the business package, Firebase configuration, or production API endpoint. Rejected: Install the PR candidate with the production application ID | This could overwrite the business install and reuse real provider configuration. Confidence: high Scope-risk: narrow Directive: Use build:android:integration:apk only with an isolated local server; FCM delivery remains a separate unverified gate. Tested: Targeted project convention tests and Expo config resolution for production and isolated modes. Not-tested: Native APK build and device installation are pending the coordinated heavy-build window.
The Expo android config field did not reach the release manifest. Apply cleartext access through an isolated-only config plugin while production keeps its existing Firebase and network configuration. Constraint: Only the suffix integration package may use loopback HTTP. Rejected: android.usesCleartextTraffic app config field | Expo omitted it from the generated release manifest. Confidence: high Scope-risk: narrow Directive: Keep this plugin behind CLEVER_DRIVER_ISOLATED_ANDROID and never enable cleartext in the business package. Tested: project convention 4/4; isolated Expo prebuild; release manifest inspection; arm64 APK build and device login. Not-tested: Real FCM delivery because the isolated build intentionally has no Firebase provider config.
Capture the fresh audit blocker, actual PostgreSQL client replay proof, native APK provenance, suffix installation, device login recovery, and remaining provider limits. Constraint: Keep export, debug APK, installed device evidence, and real FCM evidence distinct. Rejected: Treating runtime bundle absence as an audit waiver | Issue62 remains blocked by unpatched upstream advisories. Confidence: high Scope-risk: narrow Directive: Do not describe this isolated result as production activation or release-signing evidence. Tested: CI 37570524933; actual PostgreSQL client flow; APK manifest/signature/ABI; suffix install; synthetic device login and relaunch recovery. Not-tested: Real FCM, release signing, native camera and permission flow, production GPS, deployment.
Apply the cleartext policy in both modes and use a guarded prebuild helper. The helper cleans only managed mode transitions or Firebase residue, preserves same-mode caches, and verifies package, manifest, and Firebase output before recording the mode. Constraint: Preserve business Firebase and signing material while keeping operational features and custom API overrides off in release builds. Rejected: Unconditional clean prebuild | It discards valid same-mode native generation and conflicts with the persistent release workspace. Confidence: high Scope-risk: narrow Directive: Use the mode-aware helper for Android APK generation; do not bypass its generated-output checks. Tested: Actual isolated-to-production nonclean prebuild; mode transition and residue guards; targeted policy tests 12/12; workspace tests 325/325, typecheck, lint, Expo alignment; diff check. Not-tested: Business Firebase credentials, release signing, Play submission, or production deployment.
The isolated APK needs an OS notification tap that exercises the production response classifier and resolver. The scheduler accepts only authenticated inbox identities under the integration package and loopback verification guard. Constraint: Keep FCM registration and foreground push receipts restricted to the production package. Rejected: Add a deep link or Android broadcast backdoor | It would bypass the production notification response path. Confidence: high Scope-risk: narrow Directive: Count this path as synthetic local notification evidence, never as actual FCM receipt evidence. Tested: Targeted notification tests 17/17, targeted ESLint, full workspace checks by root, and git diff --check passed. Not-tested: Final rebuilt APK installation and physical notification shade tap are owned by the device verification lane.
Constraint: D05 operational reasons remain unapproved and default empty Rejected: Enable synthetic reasons for normal installs | would treat a fixture as operational policy Confidence: high Scope-risk: narrow Directive: Keep the explicit verification flag and loopback API fence together Tested: Driver typecheck, 325 tests, lint, Expo alignment, isolated APK build Not-tested: Real FCM, live GPS, operational policies, production signing
Render the deferred-notification banner as a bottom SafeArea overlay and place both decisions in visible 44-point action buttons. This keeps the active workspace mounted while making the required actions reachable on tall Android devices. Constraint: Preserve the pending notification, active input, and navigation acknowledgement rules. Rejected: A normal-flow banner below the workspace | The Note20 layout clipped both actions outside the authenticated safe area. Confidence: high Scope-risk: narrow Directive: Keep deferred-notification actions inside a bottom SafeArea container and retain minimum touch height. Tested: driverNotificationWorkProtection 52/52; rendered alert safe-area edges, absolute bounds, and both 44-point actions; diff check; independent re-review APPROVE. Not-tested: Rebuilt APK and final Note20 tap evidence; root runs these sequentially.
Constraint: Preserve PR61, business app data and the Issue62 audit gate. Confidence: high Scope-risk: narrow Directive: Synthetic Android notification taps do not prove FCM or production activation. Tested: Actual Note20 UI flows with PostgreSQL/API correlation; fixed protected actions; 325 tests; typecheck; lint; native APK and installed hash. Not-tested: Real FCM, live vehicle GPS, production signing, camera/POD and unapproved operational policies.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CLEVER Driver change
알림 이동 중 편집·보고 입력을 보존하고, 서버가 확인한 현재 목적지만 표시합니다. 실기기에서 발견한 보호 알림 버튼의 잘림을 bottom SafeArea overlay로 수정했습니다. 같은 보고 명령은 오프라인·앱 재실행·승인 응답 유실 뒤에도 원래 commandId와 입력으로 재시도합니다.
격리 Android 생성은 별도 package와 mode 검증을 사용합니다. 실제 격리→일반 native 생성에서 manifest, applicationId와 synthetic Firebase 파일을 확인합니다. 일반 생성은 cleartext 속성과 격리·운영·API 환경 변수를 제거합니다. 합성 보고 사유는 명시적 검증·운영 flag와 loopback HTTP 조건에서만 주입합니다. Android local notification 도구는 추가로 suffix package를 확인합니다.
EVNSolution/clever-driver-app/clever-driver-appdevcc-312-driver-operational6e2db49e0415786c018762a26a6b136bcef5b7431075507dedc3838356a372fc9bce9756157a1fe4(후속 commit은 검증 문서만 변경)최종 검증
최종 APK:
com.evnsolution.clever.driver.integration, 0.1.14(23), arm64-v8a, 45,582,315 bytes. SHA2562c78ef20bc8522dd46d8c57965ca664727f397aaa5f8557709c2334dd98d09d7. 설치본 hash도 일치합니다. Android Debug certificate SHA256fac61745dc0903786fb9ede62a962b399f7348f0bb6f899b8332667591033b9c입니다. 배포 서명 후보가 아닙니다.검증 행렬·APK·화면·HTTP·DB 경계에 증거를 기록했습니다. 실제 화면 검증을 클라이언트 함수 시험으로 대체하지 않았습니다. 주요 업무 흐름의 이전 APK와 수정 후 APK 증거를 분리했습니다.
남은 차단
Issue62 audit를 유지합니다. 기존 braces/node-forge advisory에 대한 audit 예외와 강제 Expo downgrade는 적용하지 않습니다. Runtime bundle 범위는 면제 근거가 아닙니다.
실제 FCM 수신·background/terminated FCM delivery, 실차 GPS, 운영 Firebase·배포 서명, camera/POD 실제 기기 검증은 남습니다. 미전송 초안의 process 종료 후 복구를 주장하지 않습니다. 재실행 검증은 이미 저장한 보고 명령과 입력의 복구입니다.
D01/D02/D04/D05/D07과 반복 최대6회를 승인하지 않았습니다. 합성 보고 사유는 D05 승인과 다릅니다. 일반 앱은 기본 OFF입니다. P7은 별도입니다. 이 결과는 격리 실기기 업무 흐름 완료이며 운영 활성화 완료가 아닙니다.
PR61 Draft
a7959e5a84393d7dc57e2caa654ea2f8edad202c와 업무용 설치·데이터·서명 자료를 보존했습니다. PR64는 Draft로 유지합니다. 병합, 운영 배포, AWS·운영 DB 변경, 실제 발송과 Play/Drive 게시는 수행하지 않았습니다.Closes #63
Refs #61, #62
Refs EVNSolution/clever-change-control#312
Refs EVNSolution/clever-route-server#483
Refs EVNSolution/clever-dsv-web#85