From cd3e5d811c21f0840af04992c32683cc5890e426 Mon Sep 17 00:00:00 2001 From: Wessel Verheij Date: Mon, 14 Sep 2026 03:44:05 +0200 Subject: [PATCH] docs(quality,e5): a security page listing a gap the page it links to had closed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two records disagreeing about one check, and a third describing an absence that is now only partly an absence. 40-quality/security.md carried "Mobile backup exclusion" under Known outstanding items, saying whether the iOS exclusion covers the file the app actually opens was an open question — and linked, for that claim, to the E5 section that had settled it on 2026-09-06. A re-check named the path, read the flag back per node rather than trusting the write, and reported `flagged=7 unflagged=0` against Documents/persisted_data on an iPhone 12 mini. The row pointed at its own answer for eight days. Removed with the reason kept rather than quietly deleted: a security page that overstates a gap is read exactly as carefully as one that understates one. E5's Android note said nothing records the same passes on Android. Two Android hardware runs have happened since and are recorded in the product repository: E5-R10 closed on a Galaxy A51 on 2026-09-09, and E2-R23 and E5-R28 walked on the same handset on 2026-09-13. Neither is one of the three gates, so the note stays — narrowed to the two that really are unrecorded there, the local-notification banner and the two-device pairing UAT. The backup exclusion is app-wide on Android and reaches every release build by construction. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Wessel Verheij --- .../features/e-sync/e5-mobile-peer.md | 20 ++++++++++++++----- 40-quality/security.md | 14 ++++++++++++- 2 files changed, 28 insertions(+), 6 deletions(-) diff --git a/10-functional/features/e-sync/e5-mobile-peer.md b/10-functional/features/e-sync/e5-mobile-peer.md index 66ae686..da4d2ca 100644 --- a/10-functional/features/e-sync/e5-mobile-peer.md +++ b/10-functional/features/e-sync/e5-mobile-peer.md @@ -143,11 +143,21 @@ independently reported that store's `database.sqlite` at 2,637,824 bytes, which is what rules out the empty 4 KB stub under Application Support that the earlier check may have read. -**Android device acceptance is not recorded.** All three gates were taken on one -handset, an iPhone 12 mini. Nothing here records the same passes on Android, and -the final plan still names device acceptance on both. The requirements ask for -real hardware rather than for each platform, so they are met as written; whether -v2.0 ships without an Android pass is a release call, and nobody has made it. +**Android device acceptance is partly recorded, and not here.** All three gates +above were taken on one handset, an iPhone 12 mini, and the final plan still +names device acceptance on both. Two Android hardware runs have happened since +and are recorded in the product repository rather than on this page: `E5-R10`'s +asynchronous cold-start recovery signal was closed on a Galaxy A51 (Android 13) +with a fingerprint enrolled on 2026-09-09, and `E2-R23` and `E5-R28` were walked +on the same handset alongside an iPhone 12 mini on 2026-09-13, in that repo's +walk ledger. + +Neither is the same thing as the three gates. What is still unrecorded on +Android is the local-notification banner and the two-device pairing UAT; the +backup exclusion is app-wide there and reaches every release build by +construction rather than by a device run. The requirements ask for real hardware +rather than for each platform, so they are met as written; whether v2.0 ships +without an Android pass of those two is a release call, and nobody has made it. ## Edge cases diff --git a/40-quality/security.md b/40-quality/security.md index a96b59f..a5df933 100644 --- a/40-quality/security.md +++ b/40-quality/security.md @@ -121,7 +121,19 @@ Recorded rather than described as solved: | Item | Status | |------|--------| | A Linux desktop with no keyring | Custody is wired on every platform ([F3-R33](../10-functional/features/f-platform/f3-auth-and-app-lock.md#acceptance-criteria)). Where no keyring is reachable the shell falls back to a store whose key is public, so that machine is **reported as unprotected** rather than credited with custody, and biometric enrolment refuses there ([F3-R37](../10-functional/features/f-platform/f3-auth-and-app-lock.md#acceptance-criteria)). The reader has no passive surface telling them; they learn it by attempting an enrolment. | -| Mobile backup exclusion | A bridge exists and the mobile build applies it. Android is covered app-wide and reaches every release build. On iOS no pipeline builds an artefact, and whether the exclusion covers the file the app actually opens is [an open question](../10-functional/features/e-sync/e5-mobile-peer.md#open-questions-and-known-gaps) ([E4-R25](../10-functional/features/e-sync/e4-at-rest-encryption.md#acceptance-criteria)). | + +**Mobile backup exclusion was in this table and is not outstanding.** It said +that whether the iOS exclusion covers the file the app actually opens was an +open question, and linked to the E5 section that had **settled it on +2026-09-06** — by a re-check naming the path, reading the flag back per node +rather than trusting the write, and reporting `flagged=7 unflagged=0` against +`Documents/persisted_data` on an iPhone 12 mini +([E4-R25](../10-functional/features/e-sync/e4-at-rest-encryption.md#acceptance-criteria), +[E5](../10-functional/features/e-sync/e5-mobile-peer.md#open-questions-and-known-gaps)). +The row pointed at its own answer for eight days. Removed here rather than +quietly, because a security page that overstates a gap is read exactly as +carefully as one that understates one, and this is the second record on this +page to have lagged the feature page it cites. ## Related