mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 18:14:03 +01:00
Krzysztof kuhy Rudnicki
f33fd03a16
setApplicationHidden drops a package from the default PackageManager enumeration even though it stays installed=true, so a sweep querying with flags 0 could never see anything it had already hidden. That made packagesToShow permanently empty: measured on device, a pass following one that hid three apps reported "hid 0, restored 0" and left them hidden with no way back. Query with MATCH_UNINSTALLED_PACKAGES instead. Hiding the enforcer itself is the other unrecoverable case, since it takes the escape hatch and the trigger with it. The exporter now injects com.kuhy.focus_owner into both the day and night allowlists so the decision layer cannot propose it, and the runner keeps its point-of-use skip to cover a policy asset rendered before this fix or hand-edited. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YQLwdquDCNmWtvgi3Lk72J
18 lines
1.6 KiB
JSON
18 lines
1.6 KiB
JSON
{
|
|
"title": "focus_owner: keep the unhide path reachable and never hide the enforcer",
|
|
"objective": "A Device Owner enforcement pass could put the device into a state it could not leave. Hidden packages drop out of the default PackageManager enumeration, so the allowlist sweep could never see them again and nothing could be un-hidden; and hiding the enforcer itself would take the escape hatch and the trigger with it. Both paths are unrecoverable from the device, so both are closed here.",
|
|
"acceptance_criteria": [
|
|
"installedThirdPartyPackages() queries with MATCH_UNINSTALLED_PACKAGES so already-hidden packages remain visible to the sweep",
|
|
"A pass following one that hid apps reports a non-empty packagesToShow and can restore them",
|
|
"The exporter injects the enforcer package into both the day and night allowlists, so the decision layer never proposes hiding it",
|
|
"EnforcementRunner keeps the point-of-use skip for its own package, covering a policy asset rendered before this fix or hand-edited",
|
|
"python_pkg/focus_policy stays at 100% branch coverage, including the new export behaviour"
|
|
],
|
|
"out_of_scope": [
|
|
"Changing which third-party apps the policy blocks",
|
|
"The night-curfew schedule itself",
|
|
"Any change to Device Owner provisioning or the escape hatch mechanism"
|
|
],
|
|
"verifier": "python -m pytest python_pkg/focus_policy --cov=python_pkg.focus_policy (123 passed, 100% branch coverage); on-device: a pass that hid three apps previously reported 'hid 0, restored 0' and left them hidden permanently — see focus_owner/docs/profile-owner-verification-2026-08-09.md"
|
|
}
|