49 lines
2.4 KiB
Markdown
49 lines
2.4 KiB
Markdown
> Historical agent handoff. The integrated composition and current test status are documented in `docs/FIRST-DEVICE-PROTOTYPE.md` and `docs/VALIDATION.md`. Proposed wiring below has been incorporated or superseded.
|
|
|
|
# TVTransport integration proposal
|
|
|
|
Status: proposed by workstream A; integration owner review required before app wiring.
|
|
|
|
## Required seam with SecureStorage (E)
|
|
|
|
`TVTransport` consumes an injected `TVAuthorizationStore`. The store is keyed only by
|
|
the shared opaque television UUID and returns a token plus a scoped TLS policy. The
|
|
transport never knows about Keychain APIs, never caches the token outside the active
|
|
connection attempt, and never sends either value to Watch.
|
|
|
|
The proposed values are:
|
|
|
|
- `StoredTVAuthorization(token: String?, trust: TVTrustPolicy)`
|
|
- `TVTrustPolicy.systemDefault`
|
|
- `TVTrustPolicy.pinnedLeafCertificateSHA256(Data)` for a fingerprint that a user
|
|
explicitly approved for this television
|
|
- async load, save-token, delete-token and delete-trust operations
|
|
|
|
Workstream E should conform its Keychain repository to this protocol. It should use
|
|
device-only accessibility, report locked/unavailable Keychain as an error, and keep
|
|
the consent record needed before returning a pin. A first-contact certificate is
|
|
never accepted merely because the transport observed it. Certificate capture and
|
|
the consent UI remain an integration task after physical TLS evidence exists.
|
|
|
|
Migration impact: none; no persisted format exists. If E chooses a differently
|
|
named public contract, the integrator can adapt it at composition or rename this
|
|
consumer-owned seam without changing actor behavior.
|
|
|
|
## Build wiring request
|
|
|
|
Add the `Adapters/TVTransport` library product to the iPhone target only. It depends
|
|
on the existing `RemoteCore` and `SamsungProtocol` products plus Apple Foundation,
|
|
Security and CryptoKit for the iOS URLSession adapter. Do not add it to watchOS.
|
|
The local package manifest exists only so workstream A can compile and run focused
|
|
tests before project-generator integration.
|
|
|
|
The pure Samsung event parser belongs to the already owned `SamsungProtocol` target;
|
|
no new shared domain type or command value is required.
|
|
|
|
## Test impact
|
|
|
|
Before merge, run the adapter package tests plus the root `WristivoKit` tests. The
|
|
integrator should then regenerate source membership and run both application builds.
|
|
Physical pairing, certificate behavior and token persistence remain explicitly
|
|
untested until the owner completes the manual hardware script.
|