4.5 KiB
4.5 KiB
Phase 3: Mini App Shell + Geolocation — Verification
Verified: 2026-10-23 Method: goal-backward against ROADMAP §Phase 3 success criteria, after in-execution debug rounds 1–6 (see 03-DEVICE-MATRIX.md) and the user's final device-matrix verdict ("device matrix passed").
Success Criteria
SC1 (GEO-01) — Android: grant, live position on Rams basemap, permission persists — ✅ PASS
- Real Android phone, Telegram webview: boot reaches LIVE,
s ok(probe round 7), position marker on the Rams basemap. - Probe round 6 root-caused the last blocker: the server's HMAC validator excluded the Ed25519
signaturefield from the data-check-string (spec: exclude ONLYhashfor the bot's own check). Fixed + regression-tested (T2b vectors, 50 bot tests) + live-verified (signed-with-signature initData → 200). - User-confirmed reopen behavior: no second permission prompt.
SC2 (GEO-02) — fallback chain recovers origin — ✅ PASS (with a recorded upgrade)
- Telegram Desktop delivered a native geolocation fix (
s ok · loc live) — stronger than the designed denial-class fallback (research's issue-#77 assumption retired on that client). - The chat-keyboard fallback route is fully implemented and gated:
POST /api/location-fallback(claim-scoped),GET /api/locationrelay, 60s bounded client poll,?pin=1harness capture — 48 bot + 33 web tests green. Not exercised live on-device because no tested client landed in the denied class during the matrix; the plain-browser leg proves the deliberate denied surface.
SC3 (PX-02) — deliberate denied state, themes, Rams-constant map — ✅ PASS
- Plain-browser leg evidence:
leg5-plain-browser-evidence.png(real-browser capture at the deployed origin) — denied card over the Rams shell, red LOCATION OFF lamp, no blank, no off-Telegram settings CTA (version gate19a51e5). - 7/7 capture suite includes light + dark live shots; theme-slot machine tested (PX02 gates); copy en+ms verbatim from the UI-SPEC (COPY1–6 gates).
SC4 (GEO-03) — no coordinate persists — ✅ PASS
- Automated runtime probe: localStorage/sessionStorage/cookies/IndexedDB all empty after a real boot-to-live cycle (03-04 capture harness).
- Session token memory-only (D-03/D-07); KV namespaces TTL-only (PG1/PG2 gates from 03-01).
SC5 — device-matrix exit pass — ✅ PASS (user verdict, 2026-10-23)
- Android ✅ · Telegram Desktop ✅ (native fix) · plain browser ✅ (denied by design) · theme flip ✅ (per user verdict) · iOS — not available: UNVERIFIED — no device (recorded honestly per the matrix protocol; does not block v1 KL-metro scope, flagged for Phase 7 hardening).
Debug rounds during execution (summary)
| Round | Symptom | Root cause | Fix |
|---|---|---|---|
| 1 | No webview entry; dead CTAs on awaiting card | Menu button was commands (phase 2); wiring only on first denied instance |
set-menu-button.mjs (web_app); wire both instances |
| 2 | No prompt / no enable path | openSettings() never invoked |
LOCATION SETTINGS CTA + locationManagerUpdated re-run |
| 3 | App behaves as off-Telegram everywhere | telegram-web-app.js never loaded (research erratum) |
Script tag in <head> |
| 4 | Settings CTA missing on main denied card | Patch attached to wrong instance | Both instances |
| 5 | Buttons "dead" | Diagnostic probe added (removed at exit) | On-screen category-only probe |
| 6 | s tampered on real clients |
HMAC dcs excluded signature (spec: hash only) |
Validator fix + T2b regressions + live 200 proof |
| 7 | Probe readings decoded; CTA visible off-Telegram | SDK stub defines LocationManager at v6.0 | CTA eligibility = chain's 8.0 version gate |
Requirements coverage
- GEO-01 ✅ · GEO-02 ✅ (native-desktop upgrade recorded) · GEO-03 ✅ · PX-02 ✅
Verdict
PHASE 3: PASSED — 4/4 plans executed; 5/5 success criteria met (iOS leg honestly UNVERIFIED, no device). Phase 4 (destination-search-+-kl-gazetteer) is next.
Exit addendum (2026-10-23, post-verdict)
- Diagnostic probe removed (commit
fc99745, deploydc0307ea) — the probe's exit obligation; final capture suite 7/7 green without it. - GEO-03 runtime probe updated: the official
telegram-web-app.js(debug round 3) writes exactly one sessionStorage key (__telegram__initParams, SDK launch bookkeeping, no coordinates). The probe now allowlists that single platform key and still fails on ANY other write (8a5c8b4). Our app's own surfaces remain byte-empty — the D-07 law holds. - Final gates at close: web 33/33 · bot 50/50 · captures 7/7 · theme audit clean.