From 2f8e788fe6cd64fa3e7e84bb657617d40bc65257 Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Tue, 13 Oct 2026 15:52:36 +1100 Subject: [PATCH] Decision: drop Device Owner (needs a factory reset); phone client blocks via Accessibility Service + overlay + tamper alert --- AGENTS.md | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 90894dd..9479330 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -55,6 +55,9 @@ Check these first. Two are missing and will stop you later if ignored. **Do not start Phase 5 until the Android toolchain question is answered.** +Phase 5 does **not** need Device Owner and does **not** require a factory reset — see +§13. Any ordinary Android phone works, including one already in use. + ## 3. Users and roles | User | Can do | @@ -82,6 +85,9 @@ Check these first. Two are missing and will stop you later if ignored. | FR-13 | Alerts via Apprise when a limit is hit or a device goes offline too long. | | FR-14 | Fail safe: when a device cannot reach the broker, it keeps its last state. | | FR-15 | Audit log: every state change, who made it, and when. | +| FR-16 | Phone client blocks by **interruption**, not suspension: an Accessibility Service detects a blocked app in the foreground and a full-screen overlay blocks it. No Device Owner, no factory reset. | +| FR-17 | **Tamper alert.** If the Accessibility Service is disabled, the app is force-stopped, or the overlay permission is revoked, report it to the Control Service immediately and alert Sam. **This is the real enforcement.** | +| FR-18 | Site filtering on the phone uses a device-local **VpnService**. No router, no Pi-hole. | ## 5. Screens and UX flow @@ -162,7 +168,7 @@ The Hub interface is frozen in `central_ai_llm_master/docs/ask-contract.md`. | Port | Allocate one (suggest **8791**). Record it once chosen. | | URL | `webrestrict.lab.audasmedia.com.au` via Caddy on `.35` | | Auth | **Separate session login.** | -| Kids' phone client | **Kotlin**, Android Device Owner | +| Kids' phone client | **Kotlin**, Android **Accessibility Service + overlay**. NOT Device Owner — see §13. | | Kids' computer client | **Python** (`psutil`, `pystray`) | ## 10. Rules and constraints @@ -200,9 +206,14 @@ Python client: subscribe to config, apply process blocking, report telemetry, ov warning, keep last state. *DoD:* a real Windows machine blocks a listed process during a scheduled window. -**Phase 5 — Phone client** -Kotlin Device Owner app: suspend listed packages, overlay, status view, telemetry. -*DoD:* a real Android phone suspends a listed app during a window. +**Phase 5 — Phone client (no-wipe)** +Kotlin app. An **Accessibility Service** detects a blocked app in the foreground; a +full-screen overlay blocks it. Usage Access supplies telemetry. A device-local +**VpnService** filters sites. +**No Device Owner. No factory reset.** The app installs like any other app and asks +for Accessibility + overlay permission. +*DoD:* on a real Android phone, opening a blocked app raises the block overlay, and +disabling the service raises a tamper alert that reaches Sam. **Phase 6 — Schedules, blocklists, allowlists** Editors in the dashboard. Allowlist honoured during a block. @@ -244,6 +255,19 @@ Resolved: 5. **Admin app** is a separate project (`kotlin_phone_app_admin`); it calls this service. 6. **Chores to unlock time** removed. Not in scope. +**Android client model (decided 2026-10-13):** + +**Device Owner is rejected.** It requires a factory reset, and Sam will not wipe the +kids' phones. The phone client blocks by **interruption** instead: + +- An **Accessibility Service** watches the foreground app. +- A **full-screen overlay** covers any blocked app. +- **Usage Access** supplies telemetry. +- A device-local **VpnService** filters sites. +- **The child can disable it.** That is accepted. The enforcement is the **tamper +alert** (FR-17), not the overlay. +- No wipe, no Device Owner, no managed profile. + Remaining: 1. Pass-through apps during a lock: confirm the list (Spotify, school sites). 2. Remote shutdown or sleep for a kid's computer, or blocking only?