app.mobile-monolith

@lssm-tech/app.mobile-monolith

The native auth client uses Better Auth 1.7's core social flow for generic OAuth; it no longer registers the removed generic-OAuth client plugin. This dependency compatibility fix does not establish native OPA/capture production parity.

Expo ContractSpec native superapp foundation with contract-driven auth, workspace, remote-config, RoleMorph, and managed CompanyOS proof surfaces.

The root route now enters a narrow, native proof flow:

• Reframes the former mobile landing companion into a native superapp shell foundation.
• Keeps the first proof intentionally narrow: auth/session entry, remote tenant/workspace config, workspace selection, ContractSpec-driven surfaces, RoleMorph personalization, and managed CompanyOS view-model adapters.
• Uses Expo Router for native routes while keeping route files thin; shell decisions should come from app-local contracts, handlers, runtime ports, and registries rather than route-level fixtures.
• Reuses shared marketing/catalog content only as secondary documentation/discovery surfaces, not as the primary shell purpose.
• A preview-registry entry or shared example preview is discovery-only; it is not a standalone Special Ops app shell.
• Prefers @lssm-tech/bundle.managed-companyos/view-models/* exports plus React Native adapters over direct SSR/web UI imports.
• Keeps provider execution fail-closed: no raw secrets in fixtures, snapshots, event payloads, or view-models.

This package intentionally does not attempt full web-monolith parity. It reuses shared CompanyOS view-model/data exports and avoids SSR/web UI imports unless RN compatibility is separately proven.

Special Ops managed app gate

Special Ops is a managed CompanyOS production candidate, not a standalone native shell. Mobile promotion must follow docs/runbooks/special-ops-monolith-production.md^† and prove the native route enters through AuthOS/session projection, remote workspace config, RoleMorph filtering, provider-safe degraded states, and the shared bundle view-model exports.

Native AuthOS discovers the same enabled login-method projection as web and supports email/password, email OTP, email magic link, and the six built-in social providers through bearer-backed Better Auth sessions and deep-link callbacks. The linked-accounts persona route provides the explicit link required before TikTok or a missing-email social identity can be used for login.

Required evidence before claiming mobile parity:

• bun test --cwd packages/apps/mobile-monolith
• bun run --cwd packages/apps/mobile-monolith typecheck
• import-boundary evidence showing no direct @lssm-tech/bundle.managed-companyos/ui, Next, DOM, or example-package runtime imports in the managed Special Ops path
• RoleMorph denial evidence for blocked/provider-impacting actions and no standalone Special Ops route outside the managed native shell

BillingOS native proof

The example preview registry includes a dedicated billingos-france-sme native proof. It renders quote, invoice, paid payment, France readiness, and operator approval-packet summary data through React Native primitives backed by deterministic src/examples/billingos-native-proof-data.ts constants. This is a native-safe proof path only: it must not import @lssm-tech/module.billing-os/ui, provider SDKs, credentials, network submission paths, PA submission, payment processing, or autonomous production billing execution.

Targeted BillingOS proof evidence:

bun test packages/apps/mobile-monolith/src/examples/native-preview-registry.test.ts packages/apps/mobile-monolith/src/examples/billingos-native-proof.test.ts
bun run --cwd packages/apps/mobile-monolith lint:check

Package-wide typecheck remains a separate mobile-host gate and is currently blocked by pre-existing workspace config/type issues unrelated to the BillingOS proof (bun:test and Node test/global types). The managed CompanyOS ./product-surfaces subpath is exported and covered by the mobile registry/import-boundary tests.

Préparation à la soumission d’applications

The native proof is configured for read-first App Store / Google Play review paths without committing provider credentials or production submission secrets.

• app.config.js declares the stable iOS bundle id (io.contractspec.expo-demo), Android package (io.contractspec.expo_demo), 1024×1024 proof icon/splash assets, and legal review links (https://contractspec.io/privacy, https://contractspec.io/terms, https://contractspec.io/support) under extra.appReview. It remains JavaScript so Expo SDK 57 can load it on Node 26 without relying on Node's removed TypeScript transform mode.
• iOS encryption and privacy posture is explicit: usesNonExemptEncryption: false, ITSAppUsesNonExemptEncryption: false, and an Expo ios.privacyManifests block that materializes PrivacyInfo.xcprivacy during prebuild/EAS. The current proof declares no tracking domains, no collected data types, and the UserDefaults required-reason API (CA92.1) used by the native shell/SDK layer.
• Android proof builds deny optional sensitive permissions by default (CAMERA, RECORD_AUDIO, fine/coarse location, contacts) and keep the permission list empty until a reviewed feature needs one.
• eas.json keeps build profiles and production submit profile credential-free; App Store Connect / Google Play submission credentials must remain in EAS/CI secret stores rather than source.

Targeted readiness evidence:

bun test packages/apps/mobile-monolith/src/app-submission-readiness.test.ts
bun run --cwd packages/apps/mobile-monolith lint:check
bun run --cwd packages/apps/mobile-monolith typecheck

Safety boundaries

• bun run dev
• bun run start
• bun run test
• bun run typecheck
• bun run lint:check

Architecture

• src/app/ contains Expo Router entry points and should remain thin.
• src/contracts/ defines mobile ContractSpec shell/session/config/workspace/surface contracts as they are introduced.
• src/handlers/ adapts deterministic local data and shared catalogs into operation results.
• src/screens/ owns React Native screen composition for shell, workspace, managed CompanyOS proof, and degraded states.
• src/examples/ and example preview components remain secondary discovery surfaces.

Public Entry Points

• Deployable Expo app with no published library exports.
• Primary runtime surfaces are Expo routes, mobile contracts/registries, and deterministic local handlers/ports.

Guardrails

• No full web-monolith parity in the mobile foundation pass.
• No unrelated API auth/database edits from this package lane.
• No direct @lssm-tech/bundle.managed-companyos/ui, next, react-dom, DOM global, or SSR-only component imports into the Expo shell unless compatibility is intentionally proven.
• Auth/session and remote config ports must be safe locally, redacted, deterministic in tests, and fail-closed when production credentials are unavailable.
• RoleMorph/persona differences must preserve denial evidence for blocked/provider-impacting actions.

Notes

This package may still carry legacy landing/example routes while the superapp shell is being built, but docs, metadata, and guardrail tests now track the approved superapp foundation direction.

Live OPA microphone workflow

/(persona)/meetings/[meetingRef] opens the live, authenticated recording workflow for a canonical meeting reference. Example deep link: contractspec-demo://meetings/meeting:example?locale=fr. The server must already recognize the meeting in the selected workspace. This is separate from the existing deterministic proof panels.

The screen loads effective server capture policy, requires recording/participant-notice acknowledgment, requests OS microphone access, records M4A into app-private document storage, and uploads digest-bound chunks through existing capture operations. Backgrounding stops and saves foreground capture; three hours is the recording ceiling for the configured transcription path. Upload failures preserve media and checkpoints. Resume rehashes acknowledged chunks before skipping them. Accepted uploads expose transcript refresh; no empty response is called a successful transcript.

Recovery manifests use AES-GCM with account-bound additional data; their keys live in Expo SecureStore. Completed recordings are sealed into independently authenticated AES-GCM chunks before upload. The raw temporary file is removed only after all encrypted chunks and their durable manifest are verified. Interrupted sealing retains a recoverable raw or encrypted copy. Active recording still uses the SDK’s app-private temporary file. Device backup exclusion, automatic local retention, active-recording crash recovery and storage-pressure behavior still require implementation/qualification. Deleting the local copy does not delete server media.

The SDK-compatible Expo audio/filesystem/crypto modules and microphone config plugin are installed. Background recording/playback are disabled; iOS privacy declarations now include audio and user content. Worklets and Babel preset dependencies required by the existing mobile bundler are explicit. EXPO_PUBLIC_COMPANYOS_API_URL selects the HTTPS API; native requests use refreshed bearer credentials without browser origin/cookie simulation.

Validation is separate: unit tests cover upload retry/tamper/source binding and auth/config; TypeScript checks pass. iOS and Android Metro exports now produce Hermes bytecode after isolating the AuthOS preview bridge plan from Better Auth server initialization. This is bundle validation only; signed-device behavior and runtime performance remain unqualified. No signed iOS/Android audio-permission, interruption, screen-reader, physical-device or app-store acceptance is claimed.

Implementation references: Expo Audio and Expo FileSystem. Expo documents device-disconnect interruption and document-directory recording; neither substitutes for device testing.

Completed-recording encryption

Sealed audio uses the account’s SecureStore-backed AES key and additional data binding account, local recording ID, server capture ID and chunk index. Upload decrypts only a bounded chunk at a time. Digests detect corrupted or substituted chunks before raw cleanup or transfer. Recovery distinguishes partial sealing, a committed sealed copy awaiting raw cleanup, and encrypted media with cleanup complete. Explicit local deletion removes raw remnants and the sealed recording directory.

This protects completed local recordings; it does not establish uninterrupted streaming encryption during microphone capture, backup exclusion, or legal-hold/retention behavior on devices. Those remain release gates.

Recording backup protection

Recording and local media preparation require the compiled OpaRecordingStorage module. On iOS it excludes and verifies the app documents directory, including temporary recordings and encrypted OPA files. Android disables legacy backup and provides explicit cloud/device-transfer exclusions; the native verifier checks the installed manifest resource and both exclusion sections.

Old binaries and Expo Go without the module fail closed before microphone access. Rebuild native projects after installing the config plugin. Existing backups are not retroactively removed. Physical-device backup/restore behavior, OEM differences and retention/legal-hold qualification remain open.

When native backup protection is missing or fails, the recording screen presents a localized protection-unavailable state and disables capture. Native failure details are not exposed. Transient capture/upload errors remain distinct and retain recoverable local media.

Exact recording reconciliation

Recorded transcript display requires both the canonical meeting and the exact sourceCaptureRef. Refresh recording status rechecks the saved capture identity and rejects stale revisions or changed consent/policy binding. Only an authenticated matching deleted state triggers local raw/encrypted-file cleanup; denial or unavailability preserves recoverable media. This is explicit refresh-based reconciliation, not a claim of push revocation or automatic retention.

Raw-file reads, encryption and deletion now require canonical SDK-generated recording paths under the current document audio directory. Arbitrary document files, sibling-prefix paths, encoded traversal and remote URLs are rejected before file access. iOS simulator application build and Android storage-module Kotlin compilation pass; neither proves physical-device backup/restore or recording behavior.

Recording startup is fenced across asynchronous protection, permission, consent, recorder preparation and manifest writes. A screen that backgrounds or unmounts cannot later activate the microphone from a stale continuation. Interrupted prepared recorders are stopped and recording audio mode is disabled. Foreground return requires a new explicit start; OS permission interruptions and cleanup still require signed-device QA.

Failed recording startup attempts release partially prepared native recorder resources and disable recording audio mode. If the server capture identity is known but the microphone never started, cleanup attempts an idempotent cancellation. A failed cancellation does not claim server cleanup succeeded; expired/orphaned capture recovery remains a server qualification requirement.

Automatic SDK completion and media-service-reset events enter the same recovery finalization as manual stop. Already-stopped recordings are not stopped twice; a nonempty file checkpoint is persisted before encryption. Empty or failed recording finalization remains an error, and failed encryption preserves the completed file for recovery. Device-specific interruption behavior still requires runtime QA.

Recorder errors, media-service resets and crash-recovered active recordings remain marked interrupted. The screen warns that recovered audio may be incomplete and requires explicit acknowledgment before upload. The upload protocol independently enforces that acknowledgment before network access, and encrypted checkpoints preserve interruption status. This is not a claim that a truncated or damaged native recording is playable; device recovery QA remains required.

A live recording screen pins its verified session token in memory and uses the same client for consent, upload, status reconciliation and transcript reads. If secure storage changes to another token or sign-out removes it, subsequent requests fail before network access. Reopen the screen to verify a new session; recovery manifests never contain credentials. This does not replace server membership/workspace checks or signed-device account-switch QA.

Credential change notifications carry no token payload. They abort recording-screen requests, invalidate startup continuations, clear displayed private content and stop active microphone capture while preserving the original account’s encrypted recovery files. A delayed SecureStore hydration cannot overwrite a newer sign-out, and pending manifest writes cannot restore a cleared screen. Device-level sign-out and workspace-switch behavior remain separate acceptance tests.

Secure session writes/deletions are serialized in call order. Sign-out invalidates in-memory authority immediately, then waits behind earlier storage writes before deleting the credential. A current persistence failure clears memory and blocks hydration in that process until a later successful mutation repairs storage. This does not guarantee durable deletion when the OS rejects Keychain/Keystore access; server-side revocation and cold-start verification remain required.

Upload receipts preserve source identity and nondecreasing revisions and chunk counts. Every acknowledged chunk count must describe the exact contiguous byte prefix of the sealed recording. A finish response must report processing or ready with the complete expected count and byte total; invalid receipts retain the last recovery checkpoint and cannot become accepted uploads.

Android application build evidence

The full debug application assembles successfully with the compiled OPA storage module and all four Android architectures. APK signature verification and inspection of the compiled manifest/data-extraction XML confirm the debug signature and backup/transfer exclusions. See docs/evidence/opa/android-native-assembly-2026-09-06.md at the repository root for the artifact checksum and exact scope. Release signing, installed-device audio behavior, backup/restore and provider journeys remain unqualified.

Private ad-hoc meetings

The native home opens Private meetings. The screen verifies the current session, reads a server-derived private scope guard, and persists a secure request intent before calling the creation API. Network retries keep the same request key; concurrent screens serialize the intent, and an unobserved completed request is resumed. Users can continue to recording or explicitly create another meeting. Creating the workspace does not grant recording consent or start a microphone.

The API persists a real private workspace before capture lookup. Session changes clear the screen and abort requests; a changed workspace guard requires reloading. Intent metadata is isolated by account and owner-scope digest in native secure storage. Installed-device and provider journeys remain release gates.

The native dependency catalog pins Babel 7.29.7 for Expo SDK 57 / Worklets 0.10.1 compatibility. The Worklets plugin uses Babel 7 presets internally; Babel 8 fails that pipeline. A transform-level regression test checks the resolved Babel majors and actual worklet metadata generation.

Recording requires both foreground app state and navigation focus. Leaving the capture screen stops and checkpoints active audio as interrupted, even when the navigation stack keeps the screen mounted. Returning never auto-resumes or revives an earlier permission/consent request. Recovered audio still requires explicit incomplete-recording acknowledgment before upload. This behavior is covered by lifecycle/start-protocol tests; physical-device navigation, audio interruption and screen-reader acceptance remain required.

The saved-recording controls now distinguish local discard from confirmed server deletion. Server deletion reads the exact current capture and uses its revision in the existing transition operation; a lost response retains local recovery media until retry observes an authenticated deleted state. Legal holds and denial remain failures. Confirmed deletion then removes the local copy. This applies to the capture and associated transcript; derived meeting notes/outcomes and backup erasure still require their separate retention/deletion qualification.

Encrypted recording manifest initialization and mutations serialize across mounted screens using the shared native storage queue. Saves reject a different active recording identity, stale capture revision or shorter acknowledged chunk prefix. Clears require the expected local recording identity, so an older screen cannot erase a newer recording's checkpoint. This is an in-process mobile-runtime guard, not a cross-process filesystem lock.

Interrupted encryption preserves the entire verified chunk-digest prefix while rechecking raw and encrypted media. Recovery never truncates later checkpoint evidence or rewrites an already verified chunk. Manifest guards reject changed digests, protection regression and changed finalized byte length. Published ciphertext is immutable even when its manifest write was interrupted: identical concurrent retries authenticate and reuse it, while different bytes fail without replacement. Raw media is removed only after the complete encrypted copy verifies. Hardware crash/recovery qualification remains required.

Completed native transcripts can now be edited as reviewed copies and explicitly approved or rejected through the existing transcript-review operation. The screen reuses the shared headless review hook with the pinned native capture client and Expo request IDs. Only server-derived review permission exposes mutation controls. Every request binds source and review revisions; responses must preserve the exact private capture and owner scope. Edited copies do not reuse original timestamps. Review creates no outcomes, Work tasks or outbound messages. English, French and Spanish copy distinguishes read-only, loading, denied, missing and uncertain-review states. Complete downstream-journey and physical-device acceptance remain open.

Native approved transcripts now connect to private meeting drafts using the shared outcome client and hook. Users can generate summaries, decisions, proposed actions and follow-up drafts, inspect source quotes and uncertainty, edit draft prose and action titles/details, and explicitly approve or request changes. Expo SHA-256 hashing preserves the existing browser retry identity. Accepted background jobs continue server-side; unmounting the screen aborts polling rather than cancelling accepted work. Responses remain private and bound to the exact approved source. The native client exposes these operations under outcomes with the same pinned bearer session. Native Work task-detail navigation, message delivery, full citation navigation and signed-device acceptance remain open.

Approved proposed actions now expose explicit creation in the selected CompanyOS Work workspace when the server supplies projection permission and target. Native users acknowledge workspace disclosure and separately confirm uncertain actions. The shared useProjectMeetingAction hook sends only approved source references and acknowledgment fields through opa.task.project; titles/details remain server-selected from the approved proposal. It verifies action, target, source revision and Work object/event references before reporting creation. Lost replies retry the same request, while changed source/target/client aborts stale completion. Server denial is distinct from an uncertain failure. Task-detail navigation and signed-device execution acceptance remain open.

Confirmed meeting-action projections now expose “Open task in Work” using the canonical Work object reference from the receipt. The native detail route reads the exact UUIDv7 object through the authenticated Work endpoint, shows server title/details/status/dates/estimate, and clears private data on session invalidation. Missing, denied and retryable states remain distinct. The screen is currently read-only; native editing/completion and signed-device acceptance remain open.

Work detail now reloads on each navigation focus. Blur aborts pending reads, unsubscribes session observers and clears displayed data; returning resolves current session authority again. Tests cover blur during session setup, token invalidation while reading, late response rejection and separate denied/missing/error states. This does not yet qualify physical-device navigation or workspace switching.

Work task detail now exposes canonical status choices when the authenticated read projection supplies canUpdateStatus. Missing permission is read-only. Native updates bind the displayed revision and reuse the same request key for an uncertain retry of the same status. Verified event identity, next revision, status and original workspace scope are required before reloading the task. Session invalidation and blur abort the client request without claiming to undo a possible server commit. Signed-device completion/reopening acceptance remains open.

OPA recording uploads now use the shared organization-planning-react/capture-media-upload protocol. The native wrapper preserves encrypted manifest ownership, interrupted-recording acknowledgment and MP4 source binding. Existing native recovery tests pass; this extraction does not qualify a signed device journey or activate processing.

Better Auth 1.7 native client

The native client uses the supported signIn.social and linkSocial methods for custom OAuth. The removed generic OAuth plugin is no longer imported. Local tests cover the social request shape and existing MFA authority transport; device login, provider registration and account migration are separate qualification requirements.

TOTP enrollment explicitly requests method: totp and rejects a different result. Unlink requires a specific linked account and resolves its unique current provider mapping before sending Better Auth's stored account ID. Missing or ambiguous mappings fail before the unlink request.