> Historical agent handoff. The integrated composition and current test status are documented in `docs/FIRST-DEVICE-PROTOTYPE.md` and `docs/VALIDATION.md`. Proposed wiring below has been incorporated or superseded.

# TVTransport integration proposal

Status: proposed by workstream A; integration owner review required before app wiring.

## Required seam with SecureStorage (E)

`TVTransport` consumes an injected `TVAuthorizationStore`. The store is keyed only by
the shared opaque television UUID and returns a token plus a scoped TLS policy. The
transport never knows about Keychain APIs, never caches the token outside the active
connection attempt, and never sends either value to Watch.

The proposed values are:

- `StoredTVAuthorization(token: String?, trust: TVTrustPolicy)`
- `TVTrustPolicy.systemDefault`
- `TVTrustPolicy.pinnedLeafCertificateSHA256(Data)` for a fingerprint that a user
  explicitly approved for this television
- async load, save-token, delete-token and delete-trust operations

Workstream E should conform its Keychain repository to this protocol. It should use
device-only accessibility, report locked/unavailable Keychain as an error, and keep
the consent record needed before returning a pin. A first-contact certificate is
never accepted merely because the transport observed it. Certificate capture and
the consent UI remain an integration task after physical TLS evidence exists.

Migration impact: none; no persisted format exists. If E chooses a differently
named public contract, the integrator can adapt it at composition or rename this
consumer-owned seam without changing actor behavior.

## Build wiring request

Add the `Adapters/TVTransport` library product to the iPhone target only. It depends
on the existing `RemoteCore` and `SamsungProtocol` products plus Apple Foundation,
Security and CryptoKit for the iOS URLSession adapter. Do not add it to watchOS.
The local package manifest exists only so workstream A can compile and run focused
tests before project-generator integration.

The pure Samsung event parser belongs to the already owned `SamsungProtocol` target;
no new shared domain type or command value is required.

## Test impact

Before merge, run the adapter package tests plus the root `WristivoKit` tests. The
integrator should then regenerate source membership and run both application builds.
Physical pairing, certificate behavior and token persistence remain explicitly
untested until the owner completes the manual hardware script.