forked from c-fu/arah2
58 lines
4.5 KiB
Markdown
58 lines
4.5 KiB
Markdown
# Phase 3: Mini App Shell + Geolocation — Verification
|
||
|
||
**Verified:** 2026-10-23
|
||
**Method:** goal-backward against ROADMAP §Phase 3 success criteria, after in-execution debug rounds 1–6 (see 03-DEVICE-MATRIX.md) and the user's final device-matrix verdict ("device matrix passed").
|
||
|
||
## Success Criteria
|
||
|
||
### SC1 (GEO-01) — Android: grant, live position on Rams basemap, permission persists — ✅ PASS
|
||
- Real Android phone, Telegram webview: boot reaches LIVE, `s ok` (probe round 7), position marker on the Rams basemap.
|
||
- Probe round 6 root-caused the last blocker: the server's HMAC validator excluded the Ed25519 `signature` field from the data-check-string (spec: exclude ONLY `hash` for the bot's own check). Fixed + regression-tested (T2b vectors, 50 bot tests) + live-verified (signed-with-signature initData → 200).
|
||
- User-confirmed reopen behavior: no second permission prompt.
|
||
|
||
### SC2 (GEO-02) — fallback chain recovers origin — ✅ PASS (with a recorded upgrade)
|
||
- Telegram Desktop delivered a **native** geolocation fix (`s ok · loc live`) — stronger than the designed denial-class fallback (research's issue-#77 assumption retired on that client).
|
||
- The chat-keyboard fallback route is fully implemented and gated: `POST /api/location-fallback` (claim-scoped), `GET /api/location` relay, 60s bounded client poll, `?pin=1` harness capture — 48 bot + 33 web tests green. Not exercised live on-device because no tested client landed in the denied class during the matrix; the plain-browser leg proves the deliberate denied surface.
|
||
|
||
### SC3 (PX-02) — deliberate denied state, themes, Rams-constant map — ✅ PASS
|
||
- Plain-browser leg evidence: `leg5-plain-browser-evidence.png` (real-browser capture at the deployed origin) — denied card over the Rams shell, red LOCATION OFF lamp, no blank, no off-Telegram settings CTA (version gate `19a51e5`).
|
||
- 7/7 capture suite includes light + dark live shots; theme-slot machine tested (PX02 gates); copy en+ms verbatim from the UI-SPEC (COPY1–6 gates).
|
||
|
||
### SC4 (GEO-03) — no coordinate persists — ✅ PASS
|
||
- Automated runtime probe: localStorage/sessionStorage/cookies/IndexedDB all empty after a real boot-to-live cycle (03-04 capture harness).
|
||
- Session token memory-only (D-03/D-07); KV namespaces TTL-only (PG1/PG2 gates from 03-01).
|
||
|
||
### SC5 — device-matrix exit pass — ✅ PASS (user verdict, 2026-10-23)
|
||
- Android ✅ · Telegram Desktop ✅ (native fix) · plain browser ✅ (denied by design) · theme flip ✅ (per user verdict) · iOS — not available: **UNVERIFIED — no device** (recorded honestly per the matrix protocol; does not block v1 KL-metro scope, flagged for Phase 7 hardening).
|
||
|
||
## Debug rounds during execution (summary)
|
||
|
||
| Round | Symptom | Root cause | Fix |
|
||
|---|---|---|---|
|
||
| 1 | No webview entry; dead CTAs on awaiting card | Menu button was `commands` (phase 2); wiring only on first denied instance | `set-menu-button.mjs` (web_app); wire both instances |
|
||
| 2 | No prompt / no enable path | `openSettings()` never invoked | LOCATION SETTINGS CTA + `locationManagerUpdated` re-run |
|
||
| 3 | App behaves as off-Telegram everywhere | `telegram-web-app.js` never loaded (research erratum) | Script tag in `<head>` |
|
||
| 4 | Settings CTA missing on main denied card | Patch attached to wrong instance | Both instances |
|
||
| 5 | Buttons "dead" | Diagnostic probe added (removed at exit) | On-screen category-only probe |
|
||
| 6 | `s tampered` on real clients | HMAC dcs excluded `signature` (spec: hash only) | Validator fix + T2b regressions + live 200 proof |
|
||
| 7 | Probe readings decoded; CTA visible off-Telegram | SDK stub defines LocationManager at v6.0 | CTA eligibility = chain's 8.0 version gate |
|
||
|
||
## Requirements coverage
|
||
|
||
- **GEO-01** ✅ · **GEO-02** ✅ (native-desktop upgrade recorded) · **GEO-03** ✅ · **PX-02** ✅
|
||
|
||
## Verdict
|
||
|
||
**PHASE 3: PASSED** — 4/4 plans executed; 5/5 success criteria met (iOS leg honestly UNVERIFIED, no device). Phase 4 (destination-search-+-kl-gazetteer) is next.
|
||
|
||
## Exit addendum (2026-10-23, post-verdict)
|
||
|
||
- Diagnostic probe removed (commit `fc99745`, deploy `dc0307ea`) — the probe's
|
||
exit obligation; final capture suite 7/7 green without it.
|
||
- GEO-03 runtime probe updated: the official `telegram-web-app.js` (debug
|
||
round 3) writes exactly one sessionStorage key (`__telegram__initParams`,
|
||
SDK launch bookkeeping, no coordinates). The probe now allowlists that
|
||
single platform key and still fails on ANY other write (`8a5c8b4`).
|
||
Our app's own surfaces remain byte-empty — the D-07 law holds.
|
||
- Final gates at close: web 33/33 · bot 50/50 · captures 7/7 · theme audit clean.
|