sam/internet_use_control
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 5.1: kids' Android client (Accessibility block overlay + tamper alert)

Browse Source 
Add android/, a normal Gradle/Kotlin project with its own wrapper. It
blocks by interruption: an Accessibility Service watches the foreground
package and a full-screen overlay covers any listed app while the device
is locked (FR-16). No Device Owner, no factory reset, no managed profile.

The client subscribes to the retained restrict/<device>/config topic on
the 8883 TLS plane, keeps the last config on disk so a broker-less device
keeps its rules (FR-14), and reports tampering on its own status topic
(FR-17): a disabled service, a revoked overlay permission, or a
force-stop seen on the next start. The Control Service now parses the
tamper field and raises an Apprise alert, so it reaches Sam.

The block path and the tamper alert are proven on the headless pixel35
emulator on .27; see android/README.md and android/tools/emu-proof.sh.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Sam Rolfe
2026-10-13 20:17:22 +11:00
parent 8c42daf4d9
commit e018c3bfa8
39 changed files with 2323 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
README.md
View File

@@ -471,10 +471,37 @@ cache in `.gocache/` (gitignored), so nothing in the repository ends up owned by
root. `make mqtt-verify` never touches the shared Mosquitto: it stages a scratch
broker on `127.0.0.1:18883` and removes it afterwards.
## Kids' Android client (Phase 5.1)
`android/` is the kids' phone app: a normal Gradle project with its own
`gradlew`. It blocks by **interruption** — an Accessibility Service sees the
foreground package and a full-screen overlay covers any app on the blocklist
while the device is locked (FR-16). There is **no Device Owner**, no factory
reset and no managed profile; the child can disable it, and the enforcement is
the tamper alert (FR-17).
A tamper report rides the device's own status topic, because that is the only
topic its broker ACL may write:
```json
{"online":true,"tamper":{"kind":"accessibility_disabled","detail":"the service was destroyed"}}
```
`internal/mqtt` parses it, `internal/alert` records a `tamper` alert and delivers
it through Apprise, so it reaches Sam. The client also reports a revoked overlay
permission and a force-stop on the next start. It keeps the last config on disk,
so a broker-less device keeps its rules (FR-14).
The block path and the tamper alert are proven on the headless `pixel35`
emulator on `.27`; see `android/README.md` and `android/tools/emu-proof.sh`.
## Layout
```
cmd/control/ service entry point (+ hash-password, mqtt-clients, rollup, keycode, alerts, usage)
android/ kids' Android client (Gradle, Kotlin; Accessibility + overlay)
app/src/main/java/… Accessibility Service, overlay, block rule, MQTT, tamper report
tools/emu-proof.sh headless emulator proof (block overlay + tamper)
internal/config/ environment configuration
internal/store/ SQLite open, migrations, audit, devices + state
devices.go device registry, desired state, lock + grant expiry