@amityco/social-plus-vise 1.4.6 → 1.6.0

package/rules/channel-archive.yaml

@@ -0,0 +1,136 @@
+{
+  "domain": "channel-archive",
+  "schema_version": 1,
+  "rules": [
+    {
+      "id": "typescript.channel-archive.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "typescript", "types": ["ChannelRepository"], "members": ["getArchivedChannels"], "basis": "names-only" },
+      "title": "TypeScript archived-channels view should use the reactive getArchivedChannels LiveCollection",
+      "severity": "warning",
+      "rationale": "The archived-channels list is a Live Collection — it updates as channels are archived/unarchived. A one-shot getArchivedChannelIds fetch (or getArchivedChannels with no callback) renders a list that never updates. Pass the live callback: ChannelRepository.getArchivedChannels(params, callback).",
+      "applies_when": {
+        "platforms": ["typescript"],
+        "outcomes": ["add-chat", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "typescript.channel-archive.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, non-updating archived-channels list is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["Archived channels list never updates", "Archive/unarchive not reflected"]
+    },
+    {
+      "id": "react-native.channel-archive.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "react-native", "types": ["ChannelRepository"], "members": ["getArchivedChannels"], "basis": "names-only" },
+      "title": "React Native archived-channels view should use the reactive getArchivedChannels LiveCollection",
+      "severity": "warning",
+      "rationale": "The archived-channels list is a Live Collection — it updates as channels are archived/unarchived. A one-shot getArchivedChannelIds fetch (or getArchivedChannels with no callback) renders a list that never updates. Pass the live callback: ChannelRepository.getArchivedChannels(params, callback).",
+      "applies_when": {
+        "platforms": ["react-native"],
+        "outcomes": ["add-chat", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "react-native.channel-archive.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, non-updating archived-channels list is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["Archived channels list never updates", "Archive/unarchive not reflected"]
+    },
+    {
+      "id": "android.channel-archive.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "android", "types": ["AmityChannelRepository"], "members": ["getArchivedChannels"], "basis": "names-only" },
+      "title": "Android archived-channels view should use the reactive getArchivedChannels LiveCollection",
+      "severity": "warning",
+      "rationale": "The archived-channels list is a Live Collection — it updates as channels are archived/unarchived. A one-shot fetch renders a list that never updates. Observe the PagingData stream: AmityChannelRepository.getArchivedChannels().doOnNext { _: PagingData<AmityChannel> -> }.subscribe().",
+      "applies_when": {
+        "platforms": ["android"],
+        "outcomes": ["add-chat", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "android.channel-archive.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, non-updating archived-channels list is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["Archived channels list never updates", "Archive/unarchive not reflected"]
+    },
+    {
+      "id": "ios.channel-archive.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "ios", "types": ["AmityChannelRepository"], "members": ["getArchivedChannels"], "basis": "names-only" },
+      "title": "iOS archived-channels view should use the reactive getArchivedChannels LiveCollection",
+      "severity": "warning",
+      "rationale": "The archived-channels list is a Live Collection — it updates as channels are archived/unarchived. A one-shot completion handler renders a list that never updates. Observe the collection: amityChannelRepository.getArchivedChannels() then .observe on the returned collection.",
+      "applies_when": {
+        "platforms": ["ios"],
+        "outcomes": ["add-chat", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "ios.channel-archive.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, non-updating archived-channels list is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["Archived channels list never updates", "Archive/unarchive not reflected"]
+    },
+    {
+      "id": "flutter.channel-archive.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "flutter", "types": ["AmityChannelRepository"], "members": ["getArchivedChannels"], "basis": "names-only" },
+      "title": "Flutter archived-channels view should use the reactive getArchivedChannels LiveCollection",
+      "severity": "warning",
+      "rationale": "The archived-channels list is a Live Collection — it updates as channels are archived/unarchived. A one-shot fetch renders a list that never updates. Wire a PagingController over getArchivedChannels: PagingController(pageFuture: (token) => ...getArchivedChannels().getPagingData(token: token, limit: 20)).",
+      "applies_when": {
+        "platforms": ["flutter"],
+        "outcomes": ["add-chat", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "flutter.channel-archive.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, non-updating archived-channels list is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["Archived channels list never updates", "Archive/unarchive not reflected"]
+    }
+  ]
+}

package/rules/feed.yaml

@@ -68,6 +68,28 @@
         }
       }
     },
+    {
+      "id": "ios.feed.source-used",
+      "version": 1,
+      "title": "iOS feed integration must use SDK post APIs",
+      "severity": "warning",
+      "rationale": "A community/profile-only SDK integration is not an add-feed implementation. Feed surfaces must query or create SDK posts and render SDK post data.",
+      "applies_when": {
+        "platforms": ["ios"],
+        "outcomes": ["add-feed", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "ios.feed.source-used" }
+        ],
+        "attestation": {
+          "allowed": false,
+          "host_agent_min_confidence": "high",
+          "human_allowed": false,
+          "evidence_required": []
+        }
+      }
+    },
     {
       "id": "typescript.feed.target.literal",
       "version": 1,
@@ -1547,9 +1569,9 @@
       "id": "typescript.feed.target-type-explicit",
       "version": 1,
       "symbol_anchored": {"platform":"typescript","basis":"pattern"},
-      "title": "Explicit targetType for TypeScript createPost calls must not be hardcoded to COMMUNITY",
+      "title": "TypeScript createPost targetType must be a valid, bound write target",
       "severity": "warning",
-      "rationale": "TypeScript feed targets must be passed dynamically (e.g. from props or state), not hardcoded as AmityPostTargetType.COMMUNITY.",
+      "rationale": "TypeScript createPost targets must resolve to a valid SDK write target (user or community) with a targetId from props/state/auth/route, never a global aggregate feed target.",
       "applies_when": {
         "platforms": [
           "typescript"
@@ -1573,7 +1595,7 @@
           "evidence_required": [
             {
               "field": "target_type_rationale",
-              "description": "Reason why this composer is hardcoded to a specific target type.",
+              "description": "Reason why this composer uses this targetType/targetId binding.",
               "upload_policy": "upload-with-consent"
             }
           ]
@@ -1584,9 +1606,9 @@
       "id": "react-native.feed.target-type-explicit",
       "version": 1,
       "symbol_anchored": {"platform":"react-native","basis":"pattern"},
-      "title": "Explicit targetType for React Native createPost calls must not be hardcoded to COMMUNITY",
+      "title": "React Native createPost targetType must be a valid, bound write target",
       "severity": "warning",
-      "rationale": "React Native feed targets must be passed dynamically (e.g. from props or state), not hardcoded as AmityPostTargetType.COMMUNITY.",
+      "rationale": "React Native createPost targets must resolve to a valid SDK write target (user or community) with a targetId from props/state/auth/route, never a global aggregate feed target.",
       "applies_when": {
         "platforms": [
           "react-native"
@@ -1610,7 +1632,7 @@
           "evidence_required": [
             {
               "field": "target_type_rationale",
-              "description": "Reason why this composer is hardcoded to a specific target type.",
+              "description": "Reason why this composer uses this targetType/targetId binding.",
               "upload_policy": "upload-with-consent"
             }
           ]
@@ -1621,9 +1643,9 @@
       "id": "android.feed.target-type-explicit",
       "version": 1,
       "symbol_anchored": {"platform":"android","basis":"pattern"},
-      "title": "Explicit targetType for Android createPost calls must not be hardcoded to COMMUNITY",
+      "title": "Android createPost targetType must be a valid, bound write target",
       "severity": "warning",
-      "rationale": "Android feed targets must be passed dynamically (e.g. from Intent extras or ViewModel state), not hardcoded as AmityPostTargetType.COMMUNITY.",
+      "rationale": "Android createPost targets must resolve to a valid SDK write target (user or community) with a targetId from Intent extras/ViewModel/auth/route state, never a global aggregate feed target.",
       "applies_when": {
         "platforms": [
           "android"
@@ -1647,7 +1669,7 @@
           "evidence_required": [
             {
               "field": "target_type_rationale",
-              "description": "Reason why this composer is hardcoded to a specific target type.",
+              "description": "Reason why this composer uses this targetType/targetId binding.",
               "upload_policy": "upload-with-consent"
             }
           ]
@@ -1658,9 +1680,9 @@
       "id": "flutter.feed.target-type-explicit",
       "version": 1,
       "symbol_anchored": {"platform":"flutter","types":["AmityPostTargetType"],"basis":"names-only"},
-      "title": "Explicit targetType for Flutter createPost calls must not be hardcoded to COMMUNITY",
+      "title": "Flutter createPost targetType must be a valid, bound write target",
       "severity": "warning",
-      "rationale": "Flutter feed targets must be passed dynamically (e.g. from Widget properties), not hardcoded as AmityPostTargetType.COMMUNITY.",
+      "rationale": "Flutter createPost targets must resolve to a valid SDK write target (user or community) with a targetId from Widget/auth/route state, never a global aggregate feed target.",
       "applies_when": {
         "platforms": [
           "flutter"
@@ -1684,7 +1706,7 @@
           "evidence_required": [
             {
               "field": "target_type_rationale",
-              "description": "Reason why this composer is hardcoded to a specific target type.",
+              "description": "Reason why this composer uses this targetType/targetId binding.",
               "upload_policy": "upload-with-consent"
             }
           ]
@@ -1695,9 +1717,9 @@
       "id": "ios.feed.target-type-explicit",
       "version": 1,
       "symbol_anchored": {"platform":"ios","types":["AmityPostTargetType"],"basis":"names-only"},
-      "title": "Explicit targetType for iOS createPost calls must not be hardcoded to COMMUNITY",
+      "title": "iOS createPost targetType must be a valid, bound write target",
       "severity": "warning",
-      "rationale": "iOS feed targets must be passed dynamically (e.g. from View state or initializer), not hardcoded as AmityPostTargetType.community.",
+      "rationale": "iOS createPost targets must resolve to a valid SDK write target (user or community) with a targetId from view/auth/route state, never a global aggregate feed target.",
       "applies_when": {
         "platforms": [
           "ios"
@@ -1721,7 +1743,7 @@
           "evidence_required": [
             {
               "field": "target_type_rationale",
-              "description": "Reason why this composer is hardcoded to a specific target type.",
+              "description": "Reason why this composer uses this targetType/targetId binding.",
               "upload_policy": "upload-with-consent"
             }
           ]

package/rules/for-you-feed.yaml

@@ -0,0 +1,110 @@
+{
+  "domain": "for-you-feed",
+  "schema_version": 1,
+  "rules": [
+    {
+      "id": "typescript.for-you-feed.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "typescript", "types": ["FeedRepository"], "members": ["getForYouFeed"], "basis": "names-only" },
+      "title": "TypeScript For-You feed should use the reactive getForYouFeed LiveCollection",
+      "severity": "warning",
+      "rationale": "The personalized For-You feed is a Live Collection — it updates as ranking and freshness change. A one-shot fetch-and-map renders a stale feed. Pass the live callback: FeedRepository.getForYouFeed(params, callback). Gate on getForYouFeedSetting and fall back to the global feed when For-You is disabled (AmityForYouFeedDisabledError).",
+      "applies_when": {
+        "platforms": ["typescript"],
+        "outcomes": ["add-feed", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "typescript.for-you-feed.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, non-updating For-You feed is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["For-You feed never updates", "Stale personalized ranking"]
+    },
+    {
+      "id": "react-native.for-you-feed.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "react-native", "types": ["FeedRepository"], "members": ["getForYouFeed"], "basis": "names-only" },
+      "title": "React Native For-You feed should use the reactive getForYouFeed LiveCollection",
+      "severity": "warning",
+      "rationale": "The personalized For-You feed is a Live Collection — it updates as ranking and freshness change. A one-shot fetch-and-map renders a stale feed. Pass the live callback: FeedRepository.getForYouFeed(params, callback). Gate on getForYouFeedSetting and fall back to the global feed when For-You is disabled (AmityForYouFeedDisabledError).",
+      "applies_when": {
+        "platforms": ["react-native"],
+        "outcomes": ["add-feed", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "react-native.for-you-feed.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, non-updating For-You feed is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["For-You feed never updates", "Stale personalized ranking"]
+    },
+    {
+      "id": "android.for-you-feed.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "android", "types": ["AmityFeedRepository"], "members": ["getForYouFeed"], "basis": "names-only" },
+      "title": "Android For-You feed should use the reactive getForYouFeed LiveCollection",
+      "severity": "warning",
+      "rationale": "The personalized For-You feed is a Live Collection — it updates as ranking and freshness change. A one-shot fetch renders a stale feed. Observe the PagingData stream: AmityFeedRepository.getForYouFeed().doOnNext { _: PagingData<AmityPost> -> }.subscribe(). Gate on getForYouFeedSetting and fall back to the global feed when disabled.",
+      "applies_when": {
+        "platforms": ["android"],
+        "outcomes": ["add-feed", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "android.for-you-feed.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, non-updating For-You feed is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["For-You feed never updates", "Stale personalized ranking"]
+    },
+    {
+      "id": "ios.for-you-feed.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "ios", "types": ["AmityFeedRepository"], "members": ["getForYouFeed"], "basis": "names-only" },
+      "title": "iOS For-You feed should use the reactive getForYouFeed LiveCollection",
+      "severity": "warning",
+      "rationale": "The personalized For-You feed is a Live Collection — it updates as ranking and freshness change. A one-shot completion handler renders a stale feed. Observe the collection: amityFeedRepository.getForYouFeed() then .observe. Gate on getForYouFeedSetting and fall back to the global feed when disabled (forYouFeedDisabled).",
+      "applies_when": {
+        "platforms": ["ios"],
+        "outcomes": ["add-feed", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "ios.for-you-feed.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, non-updating For-You feed is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["For-You feed never updates", "Stale personalized ranking"]
+    }
+  ]
+}

package/rules/live-data.yaml

@@ -524,7 +524,8 @@
           "human_allowed": false,
           "evidence_required": []
         }
-      }
+      },
+      "symptoms": ["notLoggedIn", "NOT_LOGGED_IN", "session is not established", "session not ready", "user is not logged in", "SessionState"]
     },
     {
       "id": "flutter.live-collection.session-ready-requery",
@@ -546,7 +547,8 @@
           "human_allowed": false,
           "evidence_required": []
         }
-      }
+      },
+      "symptoms": ["notLoggedIn", "NOT_LOGGED_IN", "session is not established", "session not ready", "user is not logged in", "SessionState"]
     },
     {
       "id": "ios.live-collection.session-ready-requery",
@@ -568,7 +570,8 @@
           "human_allowed": false,
           "evidence_required": []
         }
-      }
+      },
+      "symptoms": ["notLoggedIn", "NOT_LOGGED_IN", "session is not established", "session not ready", "user is not logged in", "SessionState"]
     },
     {
       "id": "typescript.live-collection.session-ready-requery",
@@ -590,7 +593,8 @@
           "human_allowed": false,
           "evidence_required": []
         }
-      }
+      },
+      "symptoms": ["notLoggedIn", "NOT_LOGGED_IN", "session is not established", "session not ready", "user is not logged in", "SessionState"]
     },
     {
       "id": "react-native.live-collection.session-ready-requery",
@@ -612,7 +616,8 @@
           "human_allowed": false,
           "evidence_required": []
         }
-      }
+      },
+      "symptoms": ["notLoggedIn", "NOT_LOGGED_IN", "session is not established", "session not ready", "user is not logged in", "SessionState"]
     }
   ]
 }

package/rules/message-search.yaml

@@ -0,0 +1,136 @@
+{
+  "domain": "message-search",
+  "schema_version": 1,
+  "rules": [
+    {
+      "id": "typescript.message-search.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "typescript", "types": ["MessageRepository"], "members": ["searchMessage"], "basis": "names-only" },
+      "title": "TypeScript message search should use the reactive, paginated Search Message LiveCollection",
+      "severity": "warning",
+      "rationale": "In-chat message search is a paginated Live Collection. A one-shot searchMessage (no callback) renders only the first page and never updates as messages arrive or sync. Pass the live callback: MessageRepository.searchMessage(params, callback).",
+      "applies_when": {
+        "platforms": ["typescript"],
+        "outcomes": ["add-chat", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "typescript.message-search.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, single-page message search is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["Message search shows only first page", "Stale message-search results"]
+    },
+    {
+      "id": "react-native.message-search.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "react-native", "types": ["MessageRepository"], "members": ["searchMessage"], "basis": "names-only" },
+      "title": "React Native message search should use the reactive, paginated Search Message LiveCollection",
+      "severity": "warning",
+      "rationale": "In-chat message search is a paginated Live Collection. A one-shot searchMessage (no callback) renders only the first page and never updates as messages arrive or sync. Pass the live callback: MessageRepository.searchMessage(params, callback).",
+      "applies_when": {
+        "platforms": ["react-native"],
+        "outcomes": ["add-chat", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "react-native.message-search.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, single-page message search is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["Message search shows only first page", "Stale message-search results"]
+    },
+    {
+      "id": "android.message-search.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "android", "types": ["AmityMessageRepository"], "members": ["searchMessages"], "basis": "names-only" },
+      "title": "Android message search should use the reactive, paginated Search Message LiveCollection",
+      "severity": "warning",
+      "rationale": "In-chat message search is a paginated Live Collection. A one-shot fetch renders only the first page and never updates. Observe the PagingData stream: AmityMessageRepository.searchMessages(...).doOnNext { _: PagingData<AmityMessage> -> }.subscribe().",
+      "applies_when": {
+        "platforms": ["android"],
+        "outcomes": ["add-chat", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "android.message-search.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, single-page message search is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["Message search shows only first page", "Stale message-search results"]
+    },
+    {
+      "id": "ios.message-search.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "ios", "types": ["AmityMessageRepository"], "members": ["searchMessages"], "basis": "names-only" },
+      "title": "iOS message search should use the reactive, paginated Search Message LiveCollection",
+      "severity": "warning",
+      "rationale": "In-chat message search is a paginated Live Collection. A one-shot completion handler renders only the first page and never updates. Observe the collection: amityMessageRepository.searchMessages(options:) then .observe on the returned collection.",
+      "applies_when": {
+        "platforms": ["ios"],
+        "outcomes": ["add-chat", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "ios.message-search.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, single-page message search is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["Message search shows only first page", "Stale message-search results"]
+    },
+    {
+      "id": "flutter.message-search.live-collection",
+      "version": 1,
+      "symbol_anchored": { "platform": "flutter", "types": ["MessageRepository"], "members": ["searchMessage"], "basis": "names-only" },
+      "title": "Flutter message search should use the reactive, paginated Search Message LiveCollection",
+      "severity": "warning",
+      "rationale": "In-chat message search is a paginated Live Collection. A one-shot fetch renders only the first page and never updates. Wire a PagingController over the SearchMessageLiveCollection: PagingController(pageFuture: (token) => messageRepository.searchMessage(...).getPagingData(token: token, limit: 20)).",
+      "applies_when": {
+        "platforms": ["flutter"],
+        "outcomes": ["add-chat", "setup-live-data", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "flutter.message-search.live-collection" }
+        ],
+        "attestation": {
+          "allowed": true,
+          "host_agent_min_confidence": "high",
+          "human_allowed": true,
+          "evidence_required": [
+            { "field": "query_lifetime", "description": "Why a one-shot, single-page message search is appropriate here.", "upload_policy": "upload-with-consent" }
+          ]
+        }
+      },
+      "symptoms": ["Message search shows only first page", "Stale message-search results"]
+    }
+  ]
+}

package/rules/sdk-lifecycle.yaml

@@ -2323,6 +2323,29 @@
       },
       "symptoms": ["Dependency-only integration", "Static social shell", "No SDK-backed runtime data"]
     },
+    {
+      "id": "ios.sdk.source-used",
+      "version": 1,
+      "title": "iOS SDK dependency must be used by product source",
+      "severity": "warning",
+      "rationale": "Installing the iOS social.plus SDK is not an integration. Product Swift source must use the SDK or UIKit manager beyond static initialization: login/register a runtime user and query or create social.plus data.",
+      "applies_when": {
+        "platforms": ["ios"],
+        "outcomes": ["setup-sdk", "setup-live-data", "add-feed", "add-comments", "add-chat", "add-community", "add-follow", "validate-setup"]
+      },
+      "enforcement": {
+        "deterministic": [
+          { "check": "validator-finding-absent", "finding_rule_id": "ios.sdk.source-used" }
+        ],
+        "attestation": {
+          "allowed": false,
+          "host_agent_min_confidence": "high",
+          "human_allowed": false,
+          "evidence_required": []
+        }
+      },
+      "symptoms": ["Dependency-only integration", "Static social shell", "No SDK-backed runtime data"]
+    },
     {
       "id": "react-native.ui.runtime-probe-copy",
       "version": 1,