Integrate live phone and watch remote prototype with guarded motion control

2026-09-18 19:11:52 +04:00
parent 3e787543c0
commit 8131f4f873
54 changed files with 4355 additions and 329 deletions
@@ -0,0 +1,55 @@
+# Wristivo physical pairing and TLS feasibility spike
+
+Status: owner run pending. This procedure is evidence collection, not a compatibility claim.
+
+Record the exact iPhone model/iOS build, TV model from Settings and firmware/Tizen
+version, Wi-Fi topology, build commit, and whether a debugger is attached. The current
+`QA85Q8FAAUXZN` model report is unverified until the TV label and Settings are checked.
+Redact the TV address, pairing token, certificate details that identify the household,
+and client lists before saving evidence. Keep raw captures outside git.
+
+## Pair, deny and timeout
+
+1. Put the iPhone and TV on the same LAN. Keep the existing TV remote available and
+   turn the TV on. Enter only the host name or address in the Wristivo setup screen.
+2. Grant Local Network access when the setup flow explains why it is needed. Start
+   pairing explicitly. The candidate endpoint is TLS `wss` on port `8002`; do not try
+   port `8001` or a plaintext fallback.
+3. Confirm that the TV prompt/device list identifies the controller as **Wristivo**.
+   Record the exact prompt text and firmware. Approve once, then issue one supported
+   direction from the iPhone and record that a socket submission is only a transport
+   receipt until the TV visibly responds.
+4. Repeat with Deny. Confirm the app enters a recoverable denied state and sends no
+   command. Repeat with no TV approval until the 30-second pairing timeout; confirm
+   it does not become ready.
+
+## TLS policy
+
+First run with normal platform certificate and hostname validation. Record whether the
+TV presents a publicly trusted chain, a self-signed certificate, or another failure;
+capture only a redacted fingerprint and trust result. A failed trust check must remain
+failed. Do not install a global ATS exception or accept-all challenge handler.
+
+If the device presents a self-signed certificate and a product experiment is still
+warranted, stop and obtain explicit user approval for that specific TV fingerprint.
+Only a stored, per-TV leaf SHA-256 pin may be tested with the scoped policy; a pin
+learned from the same unauthenticated first connection does not prove first-contact
+identity. A changed certificate must require reapproval/re-pairing.
+
+## Reconnect, revoke and lifecycle cases
+
+After approval, terminate/relaunch the app and reboot the phone once. Verify a stored
+token reconnects without pairing, including the locked/first-unlock behavior that the
+chosen Keychain accessibility permits. Revoke the controller in the TV's device list,
+then reconnect: the app must become unauthorized, delete the rejected token, and ask
+for explicit pairing again. The app's Forget TV action must delete both token and trust
+record; removing the controller on the TV is a separate TV-menu action.
+
+Run a TV-off case, a LAN interruption, a selected-TV switch, and a phone suspend/reopen.
+No command may be replayed or drained after reconnect. A command whose deadline expires
+while disconnected must be reported unavailable/expired and discarded.
+
+Record every offered directional, Select, Back, Home, playback and volume key separately.
+Hide or disable any key without evidence. Do not test service-menu, factory, power or
+purchase actions. Do not mark this TV or any Samsung model compatible from a simulator,
+fake socket, unit test or successful WebSocket write alone.