@amityco/social-plus-vise 0.4.0

package/rules/live-data.yaml

@@ -0,0 +1,66 @@
+{
+  "domain": "live-data",
+  "schema_version": 1,
+  "rules": [
+    {
+      "id": "android.live.cleanup",
+      "version": 1,
+      "title": "Android live data observers must be cleaned up",
+      "severity": "warning",
+      "rationale": "Live Object and Live Collection observers should be disposed when their lifecycle owner ends.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.live.cleanup" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "lifecycle_owner", "description": "Lifecycle owner and cleanup location.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "flutter.live.cleanup",
+      "version": 1,
+      "title": "Flutter live data subscriptions must be cleaned up",
+      "severity": "warning",
+      "rationale": "Live Object and Live Collection subscriptions should be cancelled from dispose or equivalent cleanup.",
+      "applies_when": { "platforms": ["flutter"], "outcomes": ["setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.live.cleanup" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "lifecycle_owner", "description": "Lifecycle owner and cleanup location.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "typescript.live.cleanup",
+      "version": 1,
+      "title": "TypeScript live data subscriptions must be cleaned up",
+      "severity": "warning",
+      "rationale": "Live Object and Live Collection subscriptions should be unsubscribed from the owning component, route, or store lifecycle.",
+      "applies_when": { "platforms": ["typescript"], "outcomes": ["setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.live.cleanup" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "lifecycle_owner", "description": "Lifecycle owner and cleanup location.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "react-native.live.cleanup",
+      "version": 1,
+      "title": "React Native live data subscriptions must be cleaned up",
+      "severity": "warning",
+      "rationale": "Live Object and Live Collection subscriptions should be unsubscribed from the owning component, route, or store lifecycle.",
+      "applies_when": { "platforms": ["react-native"], "outcomes": ["setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "react-native.live.cleanup" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "lifecycle_owner", "description": "Lifecycle owner and cleanup location.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.live.cleanup",
+      "version": 1,
+      "title": "iOS live data observers must be cleaned up",
+      "severity": "warning",
+      "rationale": "Live Object and Live Collection notification tokens should be invalidated when the view, controller, or owning object's lifecycle ends.",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.live.cleanup" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "lifecycle_owner", "description": "Lifecycle owner and cleanup location (deinit, viewWillDisappear, etc.).", "upload_policy": "upload-with-consent" }] }
+      }
+    }
+  ]
+}

package/rules/push.yaml

@@ -0,0 +1,95 @@
+{
+  "domain": "push",
+  "schema_version": 1,
+  "rules": [
+    {
+      "id": "android.push.unregister.present",
+      "version": 1,
+      "title": "Android push unregister must exist on logout or user switch",
+      "severity": "warning",
+      "rationale": "Registered device tokens are associated with a user. Missing unregister can deliver notifications to the wrong user.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-push", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.push.unregister.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "trigger", "description": "Logout or user-switch flow that unregisters the device token.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "flutter.push.unregister.present",
+      "version": 1,
+      "title": "Flutter push unregister must exist on logout or user switch",
+      "severity": "warning",
+      "rationale": "Registered device tokens are associated with a user. Missing unregister can deliver notifications to the wrong user.",
+      "applies_when": { "platforms": ["flutter"], "outcomes": ["setup-push", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.push.unregister.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "trigger", "description": "Logout or user-switch flow that unregisters the device token.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "typescript.push.unregister.present",
+      "version": 1,
+      "title": "TypeScript push unregister must exist on logout or user switch",
+      "severity": "warning",
+      "rationale": "Registered device tokens are associated with a user. Missing unregister can deliver notifications to the wrong user.",
+      "applies_when": { "platforms": ["typescript"], "outcomes": ["setup-push", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.push.unregister.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "trigger", "description": "Logout or user-switch flow that unregisters the device token.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "react-native.push.unregister.present",
+      "version": 1,
+      "title": "React Native push unregister must exist on logout or user switch",
+      "severity": "warning",
+      "rationale": "Registered device tokens are associated with a user. Missing unregister can deliver notifications to the wrong user.",
+      "applies_when": { "platforms": ["react-native"], "outcomes": ["setup-push", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "react-native.push.unregister.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "trigger", "description": "Logout or user-switch flow that unregisters the device token.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.push.unregister.present",
+      "version": 1,
+      "title": "iOS push unregister must exist on logout or user switch",
+      "severity": "warning",
+      "rationale": "Registered device tokens are associated with a user. Missing unregister can deliver notifications to the wrong user.",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-push", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.push.unregister.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "trigger", "description": "Logout or user-switch flow that unregisters the device token.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "android.push.firebase-config",
+      "version": 1,
+      "title": "Firebase configuration file must be present for Android push setup",
+      "severity": "warning",
+      "rationale": "Firebase Cloud Messaging requires google-services.json in the Android app module to obtain device tokens. Without it, the SDK cannot register for push notifications.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-push"] },
+      "enforcement": {
+        "blockers": [
+          {
+            "check": "file-absent",
+            "path": "app/google-services.json",
+            "reason": "google-services.json is missing from the app module. Download it from your Firebase project console (Project settings → Your apps → Android app → google-services.json) and place it at app/google-services.json before push registration can work."
+          }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            {
+              "field": "config_location",
+              "description": "Where the Firebase configuration is loaded from if not the default app/google-services.json path.",
+              "upload_policy": "upload-with-consent"
+            }
+          ]
+        }
+      }
+    }
+  ]
+}

package/rules/sdk-lifecycle.yaml

@@ -0,0 +1,422 @@
+{
+  "domain": "sdk-lifecycle",
+  "schema_version": 1,
+  "rules": [
+    {
+      "id": "android.permission.internet",
+      "version": 1,
+      "title": "Android INTERNET permission must be declared",
+      "severity": "error",
+      "rationale": "The SDK needs network access. Missing INTERNET permission blocks social.plus API calls on Android.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.permission.internet" }],
+        "attestation": { "allowed": false, "host_agent_min_confidence": "high", "human_allowed": false, "evidence_required": [] }
+      }
+    },
+    {
+      "id": "android.application.class",
+      "version": 1,
+      "title": "Android SDK setup should use an Application class",
+      "severity": "warning",
+      "rationale": "Application startup avoids repeated SDK setup from Activity, Fragment, or UI lifecycle recreation.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.application.class" }],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "file_path", "description": "Application or startup file containing SDK setup.", "upload_policy": "redact-paths-under: [\"src/secrets/\", \"config/credentials/\"]" },
+            { "field": "entrypoint_chain", "description": "Call chain from app startup to SDK setup.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      }
+    },
+    {
+      "id": "android.setup.present",
+      "version": 1,
+      "title": "Android SDK setup must be present",
+      "severity": "warning",
+      "rationale": "The SDK must be initialized before login or social.plus API usage.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.setup.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "file_path", "description": "Source file containing SDK setup.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "android.setup.lifecycle",
+      "version": 1,
+      "title": "Android SDK setup should not run in screen lifecycle",
+      "severity": "warning",
+      "rationale": "Screen lifecycle setup can reinitialize the SDK and create race conditions.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.setup.lifecycle" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "entrypoint_chain", "description": "Call chain proving setup runs once at app startup.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "android.setup.region",
+      "version": 1,
+      "title": "Android setup must specify region or endpoint",
+      "severity": "warning",
+      "rationale": "The SDK region must match the customer's social.plus console project.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.setup.region" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "region_source", "description": "Where region or endpoint is configured.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "android.login.present",
+      "version": 1,
+      "title": "Android login must be present",
+      "severity": "warning",
+      "rationale": "Login must happen after user identity is known and before subscriptions or API calls.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.login.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "login_flow", "description": "Where login is called after user identity is known.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "android.sdk.version.pinned",
+      "version": 1,
+      "title": "Android SDK dependency should not use a floating version",
+      "severity": "warning",
+      "rationale": "Floating SDK versions can change APIs or behavior between CI runs without an explicit customer review.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.sdk.version.pinned" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "version_source", "description": "Dependency file or version catalog proving the SDK version is controlled.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "flutter.binding.initialized",
+      "version": 1,
+      "title": "Flutter binding must be initialized before async SDK setup",
+      "severity": "warning",
+      "rationale": "Flutter async setup should call WidgetsFlutterBinding.ensureInitialized before runApp.",
+      "applies_when": { "platforms": ["flutter"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.binding.initialized" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "file_path", "description": "Flutter entrypoint file.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "flutter.setup.present",
+      "version": 1,
+      "title": "Flutter SDK setup must be present",
+      "severity": "warning",
+      "rationale": "The SDK must be initialized before login or social.plus API usage.",
+      "applies_when": { "platforms": ["flutter"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.setup.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "file_path", "description": "Source file containing SDK setup.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "flutter.setup.region",
+      "version": 1,
+      "title": "Flutter setup must specify region or endpoint",
+      "severity": "warning",
+      "rationale": "The SDK region must match the customer's social.plus console project.",
+      "applies_when": { "platforms": ["flutter"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.setup.region" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "region_source", "description": "Where region or endpoint is configured.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "flutter.login.present",
+      "version": 1,
+      "title": "Flutter login must be present",
+      "severity": "warning",
+      "rationale": "Login must happen after user identity is known and before subscriptions or API calls.",
+      "applies_when": { "platforms": ["flutter"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.login.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "login_flow", "description": "Where login is called after user identity is known.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "flutter.sdk.version.pinned",
+      "version": 1,
+      "title": "Flutter SDK dependency should not use a floating version",
+      "severity": "warning",
+      "rationale": "Floating SDK versions can change APIs or behavior between CI runs without an explicit customer review.",
+      "applies_when": { "platforms": ["flutter"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.sdk.version.pinned" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "version_source", "description": "pubspec.yaml or dependency override proving the SDK version is controlled.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "typescript.sdk.version.pinned",
+      "version": 1,
+      "title": "TypeScript SDK dependency should not use a floating version",
+      "severity": "warning",
+      "rationale": "Floating SDK versions can change APIs or behavior between CI runs without an explicit customer review.",
+      "applies_when": { "platforms": ["typescript"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.sdk.version.pinned" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "version_source", "description": "package.json, lockfile, or package manager catalog proving the SDK version is controlled.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "react-native.sdk.version.pinned",
+      "version": 1,
+      "title": "React Native SDK dependency should not use a floating version",
+      "severity": "warning",
+      "rationale": "Floating SDK versions can change APIs or behavior between CI runs without an explicit customer review.",
+      "applies_when": { "platforms": ["react-native"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "react-native.sdk.version.pinned" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "version_source", "description": "package.json, lockfile, or package manager catalog proving the SDK version is controlled.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "typescript.client.create",
+      "version": 1,
+      "title": "TypeScript client initialization must be present",
+      "severity": "warning",
+      "rationale": "The client must be created before login or social.plus API usage.",
+      "applies_when": { "platforms": ["typescript", "react-native"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.client.create" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "file_path", "description": "Source file containing client initialization.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "typescript.client.region",
+      "version": 1,
+      "title": "TypeScript client must specify region or endpoint",
+      "severity": "warning",
+      "rationale": "The SDK region must match the customer's social.plus console project.",
+      "applies_when": { "platforms": ["typescript", "react-native"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.client.region" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "region_source", "description": "Where region or endpoint is configured.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "typescript.login.present",
+      "version": 1,
+      "title": "TypeScript login must be present",
+      "severity": "warning",
+      "rationale": "Login must happen after user identity is known and before subscriptions or API calls.",
+      "applies_when": { "platforms": ["typescript", "react-native"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.login.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "login_flow", "description": "Where login is called after user identity is known.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.dependency.manifest",
+      "version": 1,
+      "title": "iOS project must have a dependency manifest",
+      "severity": "warning",
+      "rationale": "Foundry needs Podfile or Package.swift to verify the SDK dependency is present.",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.dependency.manifest" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "manifest_path", "description": "Path to the Podfile, Package.swift, or other iOS dependency manifest.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.dependency.sdk",
+      "version": 1,
+      "title": "iOS dependency manifest must include the social.plus SDK",
+      "severity": "warning",
+      "rationale": "The Amity iOS SDK dependency must be declared in the project's dependency manifest.",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.dependency.sdk" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "manifest_path", "description": "Manifest declaring the social.plus SDK dependency.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.sdk.version.pinned",
+      "version": 1,
+      "title": "iOS SDK dependency should not use a floating version",
+      "severity": "warning",
+      "rationale": "Floating SDK versions can change APIs or behavior between CI runs without an explicit customer review.",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.sdk.version.pinned" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "version_source", "description": "Package.swift, Podfile, or lockfile proving the SDK version is controlled.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.setup.present",
+      "version": 1,
+      "title": "iOS AmityClient must be initialized",
+      "severity": "warning",
+      "rationale": "The SDK must be initialized before login or social.plus API usage.",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.setup.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "file_path", "description": "Swift file containing AmityClient initialization.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.setup.region",
+      "version": 1,
+      "title": "iOS AmityClient initialization must specify region",
+      "severity": "warning",
+      "rationale": "The SDK region must match the customer's social.plus console project.",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.setup.region" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "region_source", "description": "Where region is configured (for example AmityRegion.EU).", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.login.present",
+      "version": 1,
+      "title": "iOS login must be present",
+      "severity": "warning",
+      "rationale": "Login must happen after user identity is known and before subscriptions or API calls.",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.login.present" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "login_flow", "description": "Where login is called after user identity is known.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.setup.lifecycle",
+      "version": 1,
+      "title": "iOS SDK setup must not run inside a view or scene lifecycle",
+      "severity": "warning",
+      "rationale": "Initializing AmityClient inside viewDidLoad / viewWillAppear / scene(_:willConnectTo) re-runs setup as the user navigates between screens. Setup belongs in app process startup (AppDelegate.application(_:didFinishLaunchingWithOptions:) or @main App.init).",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.setup.lifecycle" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "entrypoint_chain", "description": "Call chain from app startup to AmityClient setup.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "android.session.renewal",
+      "version": 1,
+      "title": "Android login must pass an AmitySessionHandler that renews tokens",
+      "severity": "warning",
+      "rationale": "Access tokens expire in production. Without a session handler that calls renewal.renew() in sessionWillRenewAccessToken, the SDK cannot refresh sessions and customers see silent auth failures.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.session.renewal" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "session_handler", "description": "Where AmitySessionHandler.sessionWillRenewAccessToken implementation lives.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "flutter.session.renewal",
+      "version": 1,
+      "title": "Flutter login must pass an AmitySessionHandler that renews tokens",
+      "severity": "warning",
+      "rationale": "Access tokens expire in production. Without a session handler that calls renewal.renew() in sessionWillRenewAccessToken, the SDK cannot refresh sessions and customers see silent auth failures.",
+      "applies_when": { "platforms": ["flutter"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.session.renewal" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "session_handler", "description": "Where the Dart session handler implementation lives.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.session.renewal",
+      "version": 1,
+      "title": "iOS login must pass an AmitySessionHandler that renews tokens",
+      "severity": "warning",
+      "rationale": "Access tokens expire in production. Without an AmitySessionHandler that calls renewal.renew() in sessionWillRenewAccessToken, the iOS SDK cannot refresh sessions and customers see silent auth failures.",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.session.renewal" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "session_handler", "description": "Where AmitySessionHandler.sessionWillRenewAccessToken implementation lives.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "typescript.session.renewal",
+      "version": 1,
+      "title": "TypeScript client login must pass a session handler that renews tokens",
+      "severity": "warning",
+      "rationale": "Access tokens expire in production. Without a sessionHandler / sessionWillRenewAccessToken calling renewal.renew(), the SDK cannot refresh sessions and customers see silent auth failures.",
+      "applies_when": { "platforms": ["typescript"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.session.renewal" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "session_handler", "description": "Where the TypeScript session handler that renews tokens lives.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "react-native.session.renewal",
+      "version": 1,
+      "title": "React Native client login must pass a session handler that renews tokens",
+      "severity": "warning",
+      "rationale": "Access tokens expire in production. Without a sessionHandler / sessionWillRenewAccessToken calling renewal.renew(), the SDK cannot refresh sessions and customers see silent auth failures.",
+      "applies_when": { "platforms": ["react-native"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "react-native.session.renewal" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "session_handler", "description": "Where the React Native session handler that renews tokens lives.", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "android.auth.no-literal-user-id",
+      "version": 1,
+      "title": "Android login must not pass a hardcoded user identity",
+      "severity": "warning",
+      "rationale": "userId comes from the host app's auth state (session, account manager, identity provider). A literal userId in source ships a single-user demo to production.",
+      "applies_when": { "platforms": ["android"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "android.auth.no-literal-user-id" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "identity_source", "description": "Where the runtime userId comes from (DI scope, route param, account manager, etc.).", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "flutter.auth.no-literal-user-id",
+      "version": 1,
+      "title": "Flutter login must not pass a hardcoded user identity",
+      "severity": "warning",
+      "rationale": "userId comes from the host app's auth state. A literal userId in source ships a single-user demo to production.",
+      "applies_when": { "platforms": ["flutter"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "flutter.auth.no-literal-user-id" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "identity_source", "description": "Where the runtime userId comes from (provider, riverpod, bloc, etc.).", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "ios.auth.no-literal-user-id",
+      "version": 1,
+      "title": "iOS login must not pass a hardcoded user identity",
+      "severity": "warning",
+      "rationale": "userId comes from the host app's auth state (KeychainStore, identity provider, account manager). A literal userId in source ships a single-user demo to production.",
+      "applies_when": { "platforms": ["ios"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "ios.auth.no-literal-user-id" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "identity_source", "description": "Where the runtime userId comes from (Keychain, account service, dependency injection, etc.).", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "typescript.auth.no-literal-user-id",
+      "version": 1,
+      "title": "TypeScript login must not pass a hardcoded user identity",
+      "severity": "warning",
+      "rationale": "userId comes from the host app's auth state (auth context, route loader, session). A literal userId in source ships a single-user demo to production.",
+      "applies_when": { "platforms": ["typescript"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "typescript.auth.no-literal-user-id" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "identity_source", "description": "Where the runtime userId comes from (auth context, session cookie, route loader, etc.).", "upload_policy": "upload-with-consent" }] }
+      }
+    },
+    {
+      "id": "react-native.auth.no-literal-user-id",
+      "version": 1,
+      "title": "React Native login must not pass a hardcoded user identity",
+      "severity": "warning",
+      "rationale": "userId comes from the host app's auth state. A literal userId in source ships a single-user demo to production.",
+      "applies_when": { "platforms": ["react-native"], "outcomes": ["setup-sdk", "setup-push", "setup-live-data", "add-feed", "validate-setup"] },
+      "enforcement": {
+        "deterministic": [{ "check": "validator-finding-absent", "finding_rule_id": "react-native.auth.no-literal-user-id" }],
+        "attestation": { "allowed": true, "host_agent_min_confidence": "high", "human_allowed": true, "evidence_required": [{ "field": "identity_source", "description": "Where the runtime userId comes from (auth context, secure storage, etc.).", "upload_policy": "upload-with-consent" }] }
+      }
+    }
+  ]
+}