mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 20:07:04 +01:00
Krzysztof kuhy Rudnicki
82e206116a
The enforcer failed in both directions: nothing blocked at home, and everything blocked at the office. The comparison was never inverted -- `metres <= threshold` was always right. Three separate causes: Only ACCESS_COARSE_LOCATION was declared. Android 12+ fuzzes coarse to a ~1-2 km grid against a 150 m fence, so a fix taken at home routinely landed outside it, read as AWAY, and restored every app the geofence exists to hide. FINE is now declared and self-granted by the device owner, along with coarse and background, re-asserted every pass so a reinstall cannot silently drop it. There were three states but two behaviours. LOCATION_UNKNOWN applies the identical sweep to AT_HOME -- correct fail-closed design, indistinguishable from outside. And nothing ever requested a fix: the pass read whatever another app happened to cache, so at the office with no navigation running the cache was empty. Passes now acquire a fix inside a location-typed foreground service, bounded at 20 s, and treat anything older than 30 min as no fix. That window is deliberately longer than the 15-minute cadence; a shorter one marks the newest cache stale on every pass of an idle phone and blocks everything. None of it was diagnosable. `adb logcat -d -s FocusOwner:V` came back empty while dumpsys showed 82 alarms had fired, and `run-as` is refused on the release build device owner requires. So the pass now writes a ring-buffered JSONL record read back in-app: reason, distance vs the fence, fix age/provider/accuracy, curfew state, and every hidden app with the rule that hid it. Coordinates are never recorded -- a distance is enough to debug a geofence, and this is a home address. Also fixed along the way: - Hysteresis keyed off `isEnforcing`, which is true under AWAY too because YouTube stays hidden, so the threshold was permanently radius+hysteresis. It now keys off whether the previous pass was inside the fence. - The scheduler's curfew-boundary alarms were documented but never scheduled; both callers invoked `scheduleNext()` bare, so 05:00 could land 15 min late. - Installing over the app cancelled its pending alarms, so `adb install -r` silently stopped enforcement until someone opened the app. MY_PACKAGE_REPLACED now re-arms it, verified on device without launching the app. - A wrong-typed log record threw instead of being skipped, and the exception escaped far enough to leave the page stuck busy -- which disables the release-device-owner button, the one control that must work when everything else has gone wrong. - `lib/enforcement.dart` was a second decision layer with no always-blocked concept, cited by KDoc as pinned by a `PolicyParityTest` that never existed. It would have made the new screen report YouTube visible while it is hidden. Deleted; the UI renders the Kotlin record rather than re-deciding. - Anchoring home accepted a stale or unknown-precision fix. A wrong home offsets the fence everywhere and forever, which is what produced a 766 m reading while standing at home. Policy: Play Store is allowed by day (not during curfew) so infakt can be installed and updated; the sweep is default-deny for third-party packages, so anything installed from Play is hidden on the next at-home pass. Tachiyomi's per-source extension apks are covered by a new prefix allowlist rather than an exact list that goes stale whenever an extension is installed. `export.py` stopped subtracting the allowlist from `blockable_system_packages`. Sweepable is not hideable: that list decides which system packages are eligible for a decision, and `isAllowed` is what protects them. Removing an allowed system package from the sweep freezes it in its last state -- it would have stranded Play hidden permanently the moment it was allowlisted. Verified on the Pixel 6a: FINE granted POLICY_FIXED, `applied AT_HOME` with a 0 m distance from a +/-11 m GPS fix, YouTube/Chrome/Firefox absent from `pm list packages -e`, Play Store, infakt, RunnerUp and all five Tachiyomi packages present. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HjxL9kdAzZmGqQA5tMNrZ8 |
||
|---|---|---|
| .. | ||
| agent-automation-bootstrap.json | ||
| android-ui-element-driver-2026-08-10.json | ||
| app-icons-generator-2026-07-19.json | ||
| archwiki-rag-corpus-2026-07-19.json | ||
| billsplit-apk-buildable-2026-08-03.json | ||
| billsplit-move-2026-08-03.json | ||
| brother-printer-file-length-split-2026-07-17.json | ||
| brother-printer-status-accuracy-2026-07-17.json | ||
| bucket-catch-2026-06-27.json | ||
| byox-ladder-2026-07-17.json | ||
| cloud-gallery-2026-07-12.json | ||
| cloud-gallery-coverage-lint-deploy-2026-07-12.json | ||
| code-tutor-2026-07-10.json | ||
| diet-guard-gatelock-migration-2026-06.json | ||
| diet-guard-meal-and-trigger-fix-2026-06-10.json | ||
| digital-wellbeing-bypass-hardening-2026-05.json | ||
| dns-filtering-parked-2026-08-05.json | ||
| dot-resolver-and-policy-asset-2026-08-05.json | ||
| epopeja-karta-icon-2026-08-03.json | ||
| extract-dufs-cloud-repo-2026-07-12.json | ||
| extract-inline-python-2026-06-06.json | ||
| extract-session-autopsy-2026-07-26.json | ||
| file-length-split-2026-06-14.json | ||
| focus-mode-daemon-file-length-2026-07-17.json | ||
| focus-owner-decision-wiring-2026-08-09.json | ||
| focus-owner-enforcement-engine-2026-08-09.json | ||
| focus-owner-geofence-and-observability-2026-08-14.json | ||
| focus-owner-location-and-workout-2026-08-09.json | ||
| focus-owner-restore-path-2026-08-09.json | ||
| focus-owner-service-layer-2026-08-09.json | ||
| geofenced-allowlist-rewrite-2026-08-11.json | ||
| guard-lib-migration-2026-07-04.json | ||
| i3bar-claude-usage-icons-cleanup-2026-08-10.json | ||
| import-media-archives-2026-07-12.json | ||
| kcd2-balatro-single-joker-face-2026-07-25.json | ||
| kcd2-dice-solver-deploy-responsive-io-2026-07-26.json | ||
| kcd2-dice-solver-initial-commit-2026-07-21.json | ||
| keepass-multidevice-sync-2026-07-12.json | ||
| linux-config-cleanup-2026-05.json | ||
| linux-config-polling-hardening-2026-05-14.json | ||
| linux-config-runtime-hardening-2026-05-08.json | ||
| linux-config-scripts-split-2026-05.json | ||
| makepkg-stale-lock-wrapper-2026-07-16.json | ||
| mandatory-hooks-2026-08-03.json | ||
| media-cloud-sync-2026-07-12.json | ||
| morning-routine-unified-2026-05-25.json | ||
| mtk-root-toolkit-2026-08-04.json | ||
| pacman-hook-stall-2026-08-03.json | ||
| pc-polling-runtime-validation-2026-05-10.json | ||
| persistent-adb-2026-08-03.json | ||
| phone-curfew-demo-net-stopgap-2026-06-13.json | ||
| phone-focus-cpu-hardening-2026-07-10.json | ||
| phone-focus-mode-fresh-install-2026-05-31.json | ||
| phone-focus-mode-netd-cache-fix-2026-05.json | ||
| phone-night-curfew-2026-06-13.json | ||
| protondb-gold-silver-fix.json | ||
| pylint10-r0801-schema-validation-2026-06.json | ||
| reverse-survivors-2026-08-03.json | ||
| reverse-survivors-difficulty-tiers-2026-08-09.json | ||
| reverse-survivors-director-powers-2026-08-09.json | ||
| reverse-survivors-gameplay-extension-2026-08-09.json | ||
| reverse-survivors-status-effects-2026-08-09.json | ||
| root-cleanup-2026-05-14.json | ||
| run-sh-wrapper-smoke.json | ||
| screen-locker-scheduled-skip-2026-05.json | ||
| screen-locker-sick-tracker-2026-05-14.json | ||
| screen-locker-weekly-check-2026-05-28.json | ||
| session-autopsy-package-2026-07-25.json | ||
| session-autopsy-turn-efficiency-2026-07-26.json | ||
| shell-tests-arch-container-2026-07-19.json | ||
| shellcheck-ci-green-2026-08-04.json | ||
| shellcheck-strict-gate-2026-08-03.json | ||
| shutdown-override-i3blocks-sync-2026-07-10.json | ||
| stats-hltb-fixes-2026-05-28.json | ||
| steam-backlog-cache-refetch-reduction-2026-05-08.json | ||
| steam-backlog-finished-only-next-pick-2026-05.json | ||
| steam-backlog-module-split-2026-05.json | ||
| steam-backlog-protected-ids-2026-05-14.json | ||
| steam-backlog-whitelist-hardening-2026-05.json | ||
| steam-library-hide-fix-2026-05-17.json | ||
| sync-tests-fix-coverage-2026-05.json | ||
| syncyomi-library-recovery-2026-08-09.json | ||
| template.json | ||
| tether-enforcer-hotspot-bypass-2026-07-13.json | ||
| unrooted-focus-mode-policy-and-owner-app-2026-08-05.json | ||
| usage-report-hz-cpu-fix-20260604.json | ||
| vendor-agent-skills-import.json | ||
| wake-alarm-gatelock-migration-2026-06-22.json | ||
| wake-alarm-hibernate-2026-05.json | ||
| wake-alarm-loudness-typeable-2026-05.json | ||
| wake-alarm-plug-fans-warnings-2026-05.json | ||
| wake-alarm-refactor-2026-05-30.json | ||
| wake-alarm-restore-display-test-gap-2026-06-22.json | ||
| wsg-grabber-2026-07-27.json | ||