reis-mobile 0.3.6 → 0.4.0

package/skills/android-play-billing-library-version-upgrade/references/migration-logic.md

@@ -0,0 +1,78 @@
+## High-Impact Migration Logic
+
+### 1. Connection Management (The v8+ Reconnection Shift)
+
+**Intent**: Move from developer-managed state (manual retries) to
+library-managed state.
+
+- **Remove** : Manual `startConnection()` calls or retry timers inside `onServiceDisconnected()`.
+- **Add** : `.enableAutoServiceReconnection()` to `BillingClient.Builder`.
+- **Logic** : In v8+, the library handles transient disconnections. Your `onServiceDisconnected` must only be used for logging or updating UI state (e.g., "Billing service temporarily unavailable").
+
+### 2. Product Querying \& Models (The v5-v8 Architectural Shift)
+
+**Intent**: Support the "One Product, Multiple Offers" model introduced in v5
+and refined in v8.
+
+- **Data Model Swap** :
+  - **Legacy** : `SkuDetails` (1:1 mapping of ID to price).
+  - **Modern** : `ProductDetails`. A single `ProductDetails` can contain multiple `SubscriptionOfferDetails` (Base Plans + Offers).
+- **Result Handling (v8+ Logic)** :
+  - **Change** : `queryProductDetailsAsync` no longer returns a list in the listener.
+  - **New Intent** : You must receive a `QueryProductDetailsResult` object.
+  - **Refactor** : `kotlin
+    // PBL 8+ Pattern
+    billingClient.queryProductDetailsAsync(params) { result: QueryProductDetailsResult ->
+    val responseCode = result.billingResult.responseCode
+    val productDetailsList = result.productDetailsList // Retrieve list from result object
+    // Process list...
+    }`
+
+### 3. Subscription Modernization (v6 \& v7)
+
+**Intent**: Support "Base Plans" and "Offers" instead of legacy standalone SKUs.
+
+- **Subscription Upgrades/Downgrades (v6+)**:
+
+  - **Legacy** : `setOldSkuPurchaseToken()` in `BillingFlowParams`.
+  - **Modern** : Use `SubscriptionUpdateParams`. You must specify the `PurchaseToken` of the existing subscription and the `ReplacementMode` (which replaces the deprecated `ProrationMode`).
+  - **Logic** : Verify that the `ReplacementMode` matches the business intent (e.g., `CHARGE_FULL_PRICE` versus `WITH_TIME_PRORATION`).
+- **Installment Plans (v7+)**:
+
+  - **Intent**: Allow users to pay for a subscription in monthly installments.
+  - **Check** : Look for `InstallmentPlanDetails` within `SubscriptionOfferDetails`. If the app supports high-ticket subscriptions, it is mandatory to implement the `installmentPlanDetails` UI.
+
+### 4. Purchase Handling \& History (v6+)
+
+**Intent**: Move away from local-only purchase caches to real-time status
+checks.
+
+- **Active Purchases** :
+  - **Deprecated** : `queryPurchases()` (synchronous).
+  - **Mandatory** : `queryPurchasesAsync()`. You must pass `QueryPurchasesParams` containing the `ProductType` (`INAPP` or `SUBS`).
+- **Purchase History (Pagination Intent)** :
+  - **v6+ Change** : `queryPurchaseHistoryAsync` is optimized for pagination.
+  - **Logic** : If the app has thousands of historical transactions, verify you are using the `PurchaseHistoryRecord` list correctly to avoid memory overhead.
+
+### 5. Security \& Pending Transactions (The "Always On" Rule)
+
+- **Mandatory** : `enablePendingPurchases()` has been required since v3, but in v8+, verify that it is called before `.build()`. You must also include `.enableOneTimeProducts()` on the `enablePendingPurchases()` builder.
+- **Optional** : If the app sells prepaid subscriptions, you must also include `.enablePrepaidPlans()`.
+- **Intent**: This handles "Slow/Delayed" payments (like cash or bank transfers). Without this, the app will crash on initialization in modern versions.
+
+### 6. SDK \& Environment Requirements
+
+- **PBL 7.0** : Requires `compileSdk 34` or higher.
+- **PBL 8.0** : Requires `compileSdk 34` or higher.
+- **PBL 9.0** : Requires `compileSdk 35` or higher.
+- **Kotlin** : Verify that `kotlin-stdlib` is updated to at least 1.9.x to support new library coroutine extensions.
+
+### 7. User-Facing Features (Post-Upgrade Recommendations)
+
+Once the upgrade is complete, the following features are enabled by these
+versions:
+
+- **v7** : **Installments** (Monthly payments for annual plans).
+- **v8** : **Prepaid Plans** (Users can top-up time without auto-renewing).
+- **v8** : **Personalized Pricing** (Show legal disclosure if price varies by user).
+- **v9** : **In-App Price Reviews** (Users can accept upcoming subscription price increases directly inside the app without leaving for the Play Store; capped by Google at a maximum of once every 7 days).

package/skills/android-play-billing-library-version-upgrade/references/version-checklist.md

@@ -0,0 +1,54 @@
+## Play Billing Library: Smart Version-Specific Checklist
+
+Use this checklist to verify that every technical requirement between your
+\[Current Version\] and \[Target Version\] has been met.
+
+## PBL v1.x through v3.x
+
+- \[ \] **\[v1.0\] Builder Pattern** : Verify `BillingClient.newBuilder(context)` is used.
+- \[ \] **\[v2.0\] Mandatory Acknowledgment** : Verify `acknowledgePurchase()` or `consumeAsync()` is called within 3 days.
+- \[ \] **\[v2.0\] Response Types** : Logic must handle `BillingResult` objects instead of raw integers.
+- \[ \] **\[v3.0\] Legacy Removal** : Verify `ChildDirected` and `UnderAgeOfConsent` parameters are deleted.
+
+## PBL v4.x Series
+
+- \[ \] **Async Purchasing** : Confirm `queryPurchases()` is replaced with `queryPurchasesAsync()`.
+- \[ \] **Multi-SKU Accessors** : Replace `getSku()` with `getSkus()` (returns a list) in `Purchase` objects.
+- \[ \] **Subscription Refactor** : Verify `setSubscriptionUpdateParams()` is used for change logic.
+
+## PBL v5.x Series
+
+- \[ \] **Data Model Swap** : Replace all instances of `SkuDetails` with `ProductDetails`.
+- \[ \] **Personalized Pricing** : Implement `setIsOfferPersonalized()` for EU price disclosures.
+
+## PBL v6.x Series
+
+- \[ \] **Replacement Mode** : Replace `ProrationMode` with the `ReplacementMode` enum.
+- \[ \] **User Choice Billing** : Replace `AlternativeBillingListener` with `UserChoiceBillingListener`.
+
+## PBL v7.x Series
+
+- \[ \] **SDK Compliance** : `compileSdk` is set to 34 or higher.
+- \[ \] **Pending Purchases** : Replace parameterless `enablePendingPurchases()` with `enablePendingPurchases(PendingPurchaseParams)`.
+- \[ \] **API Cleanup** : Replace `setOldSkuPurchaseToken()` with `setOldPurchaseToken()`.
+
+## PBL v8.x Series
+
+- \[ \] **SDK Compliance** : `compileSdk` is set to 34 or higher.
+- \[ \] **Terminology Shift**: Rename "in-app items" to "one-time products" in UI/strings.
+- \[ \] **Signature Enforcement** : `onProductDetailsResponse` signature MUST be `(BillingResult, QueryProductDetailsResult)`.
+- \[ \] **SUBS Offer Token** : For `SUBS` type, `ProductDetailsParams` MUST include an `offerToken`.
+- \[ \] **Auto-Reconnection** : Verify `enableAutoServiceReconnection()` is used in the builder.
+- \[ \] **Min SDK Increase** : Verify `minSdkVersion` is at least 23.
+
+## PBL v9.x Series
+
+- \[ \] **SDK Compliance** : `compileSdk` is set to 35 or higher.
+- \[ \] **API Removals** : Ensure all usages of `SkuDetails`, `SkuDetailsParams`, and `SkuDetailsResponseListener` are removed and replaced with their `ProductDetails` equivalents.
+- \[ \] **Blocked Store Error Handling** : If targeting restricted device modes (e.g., kids modes), ensure `androidx.core` is at v1.9+ and update error logic to catch `BILLING_UNAVAILABLE` instead of `ERROR`.
+- \[ \] **External Payment Program Null-Safety** : If using developer-provided billing, update `DeveloperProvidedBillingDetails.getLinkUri()` logic to explicitly check for both `null` and empty string (`""`) values before parsing.
+
+## Future Versions (PBL 10.0.0+)
+
+- \[ \] **Dynamic Checklist Generation** : For any version \>=10.0.0, you **MUST** synthesize a new checklist for each new version header found in the [Release Notes](https://developer.android.com/google/play/billing/release-notes).
+- \[ \] **Identify Version Delta** : Review "Breaking Changes" and "Removed APIs" for the new version and create a list of terms to `grep`.

package/skills/android-play-policy-insights/SKILL.md

@@ -0,0 +1,172 @@
+---
+name: android-play-policy-insights
+description: Automated auditor designed to verify Android applications against Google Play Policy domains. It cross-references static code analysis with Play Store declarations to generate deterministic compliance reports, identifying undeclared data collection, architectural risks, and missing disclosures across Permissions and APIs Hygiene, User Account and Identity, and Data Safety and Privacy domains.
+license: Apache-2.0
+source: https://github.com/android/skills
+intents: [release]
+stacks: [android]
+metadata:
+  author: Google LLC
+  last-updated: '2026-07-13'
+  keywords:
+  - account deletion
+  - accessibility api
+  - all files access
+  - audio recording
+  - audit
+  - compliance
+  - contacts access
+  - data disclosure
+  - data safety
+  - data safety label
+  - data transmission
+  - demo credentials
+  - exact alarm
+  - foreground services
+  - location access
+  - login credentials
+  - manifest hygiene
+  - package visibility
+  - permissions hygiene
+  - photo and video access
+  - photopicker
+  - play policy
+  - pre-submission audit
+  - privacy policy
+  - prominent disclosure
+  - restricted permissions
+  - scoped storage
+  - sms and call log
+  - static analysis
+  - target sdk
+  - user consent
+---
+
+# Play Policy Insights: data safety, login credentials, and restricted permissions
+
+You must audit Android apps for three specific policy domains. You must check
+data safety, demo login credentials, and restricted permissions.
+
+## Path Resolution
+
+*   **repo_root**: Absolute path to the directory containing this `SKILL.md`.
+*   **app_dir**:: Absolute path to the directory containing app's code.
+*   **temp_dir**: Absolute path to the scratch directory at the workspace root.
+    It is located at `.scratch/play_policy_insights_<uuid>`. **Containment
+    Mandate**: You must confine all file system writes, intermediate artifacts,
+    and logs strictly to this directory. This ensures the skill remains portable
+    and safe across diverse execution environments, including local harnesses
+    and CI/CD pipelines, by avoiding reliance on system-level temporary paths or
+    user home directories.
+
+## Critical mandates
+
+-   **Execution Mode Awareness** Before starting Phase 2, evaluate if your
+    execution environment provides a tool to spawn or delegate tasks to
+    general-purpose sub-agents (e.g., tools often named `invoke_agent`,
+    `delegate_task`, or `spawn_worker`, using generic agent profiles like
+    'generalist' or 'coding_agent').
+
+-   If **YES**, you MUST use **Mode A (Delegation)**.
+
+-   If **NO**, use **Mode B (Sequential Self-Execution)**. You must read the
+    prompt files intended for the subagents, follow their instructions, and
+    write the expected output files to disk.
+
+-   **Sub-agents orchestration:**
+
+    -   If you use "Mode A (Delegation)", wait for "SUCCESS" confirmation from
+        sub-agents to know when they are done.
+
+    -   **Idempotency & Timeout Safeguard**: If a sub-agent fails or times out,
+        you MUST verify the presence and integrity of its target output file
+        (e.g., `<temp_dir>/worker_<goal_name>.json`) before retrying. If the
+        file exists and contains valid JSON, treat the execution as **SUCCESS**
+        and proceed. Otherwise, retry up to three times.
+
+-   **Fail-fast mandate:** The automated audit in Phase 1 is the source of
+    truth. If `orchestrator.py` fails, you must stop immediately with an
+    explanation of failure. Do not use manual auditing as a fallback.
+
+## The two-phase protocol
+
+### Phase 1: Fact gathering and triage
+
+1.  **Initialize and triage**:
+    -   Run `python3 <repo_root>/scripts/orchestrator.py init <app_dir>`.
+    -   This will create the scratch environment, perform static analysis, map
+        the codebase, identify audit goals, and produce prompts for subagents
+        for each audit goal and prompts for designated critic and aggregator
+        subagents.
+    -   You must wait (up to 5 minutes) for the script to finish.
+2.  **Capture environment**: Note values of the `temp_dir`, and
+    `activated_goals` from the JSON output. You will need them in Phase 2.
+3.  **Evaluate goals**: If `activated_goals` is empty, skip to step 3 of Phase 2
+    (Aggregation). Otherwise, proceed to step 1 of Phase 2 (Detailed analysis).
+
+### Phase 2: Goal-oriented audit
+
+Determine your execution capabilities and proceed with either Mode A OR Mode B.
+
+#### Mode A: Orchestrator WITH Delegation Capabilities (Parallel)
+
+1.  **Detailed analysis**: For each goal in `activated_goals` (e.g.,
+    `permissions_and_apis`, `data_safety_part_1`, `data_safety_part_2`),
+    delegate to a sub-agent. **Concurrency Limit:** You must not spawn more than
+    3 sub-agents simultaneously. Spawn the first batch of up to 3, wait for
+    their completions, and then spawn the next batch. Repeat until all goals are
+    complete. Pass the prompt: `"Read your instructions from
+    <temp_dir>/prompt_worker_<goal_name>.md and execute. MANDATORY: You must
+    use your file-writing capabilities to save your final JSON findings directly
+    to the file system at <temp_dir>/worker_<goal_name>.json. You are strictly
+    forbidden from outputting the JSON in your chat response. To minimize
+    context usage, your final response must be exactly 'SUCCESS' and nothing
+    else."` **Validate**: Confirm every
+    `<temp_dir>/worker_<goal_name>.json` exists and contains valid JSON. If a
+    sub-agent fails or times out, but the valid JSON output file is already
+    present on disk, do NOT retry; proceed normally. Only retry the
+    corresponding worker (up to three times) if the file is missing or invalid.
+2.  **Aggregate Findings**: Execute the python aggregation command:
+   `python3 <repo_root>/scripts/orchestrator.py aggregate <temp_dir>`. This
+   produces `aggregated_findings.json` and returns a JSON object containing
+   `critic_chunks` representing the number of chunks to verify (e.g.,
+   `{"temp_dir": "...", "critic_chunks": 2}`).
+3.  **Parallel Critic review**: For each chunk index `i` from 1 to
+   `critic_chunks`, delegate to a sub-agent. **Concurrency Limit:** You must not
+   spawn more than 3 critic sub-agents simultaneously. Batch them in groups of 3
+   as above. Pass the prompt:
+   `"Read your instructions from <temp_dir>/prompt_critic_<i>.md and execute. MANDATORY: You must use your file-writing capabilities to save your final JSON findings directly to the file system at <temp_dir>/critic_output_<i>.json. You are strictly forbidden from outputting the JSON in your chat response. To minimize context usage, your final response must be exactly 'SUCCESS' and nothing else."`
+   **Validate**: Confirm each `<temp_dir>/critic_output_<i>.json` exists and
+   contains valid JSON before proceeding. If it failed or timed out, but the
+   valid JSON file is present, proceed normally. Otherwise, retry that specific
+   critic chunk.
+4.  **Proceed to Finalization** (Step 4 below)
+
+#### Mode B: Orchestrator WITHOUT Delegation Capabilities (Sequential)
+
+1.  **Detailed Analysis**: For each goal in `activated_goals`, sequentially:
+    -   Read the contents of `<temp_dir>/prompt_worker_<goal_name>.md`.
+    -   Execute the instructions contained within that file yourself.
+    -   **CRITICAL**: You MUST format your findings exactly as requested in the
+        prompt and save them to `<temp_dir>/worker_<goal_name>.json`. **Do not**
+        summarize findings in your thoughts or chat; move to the next task.
+    -   **Validate**: Confirm `<temp_dir>/worker_<goal_name>.json` exists before
+        moving to the next goal.
+2.  **Aggregate Findings**: Execute the python aggregation command:
+   `python3 <repo_root>/scripts/orchestrator.py --aggregate <temp_dir>`.
+   This produces `aggregated_findings.json` and returns a JSON object containing
+   `critic_chunks` representing the number of chunks to verify.
+3.  **Sequential Critic review**: For each chunk index `i` from 1 to
+   `critic_chunks`, sequentially:
+    -   Read the contents of `<temp_dir>/prompt_critic_<i>.md`.
+    -   Execute the steps yourself and save your findings to
+      `<temp_dir>/critic_output_<i>.json`.
+    -   **Validate**: Confirm `<temp_dir>/critic_output_<i>.json` exists before
+      moving to the next chunk.
+4.  **Proceed to Finalization** (Step 4 below)
+
+#### Finalization (Both Modes)
+
+4.  **Present findings**: Run `python3 <repo_root>/scripts/generate_report.py <temp_dir>`. 
+    It will produce `<temp_dir>/compliance_report.md`. Present this output file to user.
+5.  **STOP**: The audit is complete. Await further instructions.

package/skills/android-play-policy-insights/resources/common_mandates.md

@@ -0,0 +1,100 @@
+# Execution Mandates
+
+### Technical Rules
+
+1.  **Absolute Paths Only**: Always resolve and use absolute paths.
+2.  **Containment**: Write all artifacts strictly within `{{TEMP_DIR}}`.
+3.  **Fail-fast**: If any required input file is missing, stop immediately and
+    report the failure.
+
+### Surgical Input Protocol & Efficient Search (MANDATORY)
+
+-   **Direct Evidence First**: Prioritize files listed in the **Context &
+    Evidence** sections. Use the provided file/line evidence (e.g., from Data
+    Sources or Sinks) to jump directly to the relevant code. Do not perform
+    broad workspace searches if these surgical starting points are available.
+-   **Path Filtering Over File Crawling**: Locate target files by name, path, or
+    extension *first* using directory/file listing tools before performing any
+    text/content-based searches. Restrict searches and file reads strictly to
+    the target `{{APP_DIR}}`.
+-   **Strict Exclusions (The Noise Wall)**: Configure search, glob, and find
+    tools to ignore build, cache, dependencies, and testing folders. You MUST
+    exclude matches from: `**/build/**`, `**/.gradle/**`, `**/.scratch/**`,
+    `**/androidTest/**`, `**/test/**`, `**/node_modules/**`.
+-   **Targeted Extensions**: Restrict content searches and file reads strictly
+    to source and configuration files: `.java`, `.kt`, `.xml`, `.gradle`, `.kts`
+    (and `.js`, `.ts`, `.jsx`, `.tsx`, `.dart` if a hybrid/cross-platform
+    environment is analyzed). Never search or read inside compiled `.class`
+    files, binary resources, or output assets.
+-   **Surgical Queries & Limiters**: Use highly specific search patterns (e.g.,
+    search for `getLastKnownLocation` or `deleteAccount` instead of general
+    words like `location` or `delete`). If search tools support limits or
+    pagination, cap results at a maximum of 50 matches. Do not load unlimited
+    search results into your context window.
+-   **Parallel Reading Required (Turn Efficiency)**: You are operating under a
+    strict maximum turn limit. To prevent timeouts, you MUST request to read
+    multiple target files concurrently in a single response. Do not read the
+    evidence files sequentially one-by-one. Issue all of your file-reading tool
+    calls simultaneously whenever possible.
+
+### Evidentiary Standard & Guardrails (CRITICAL)
+
+To prevent over-auditing, false positives, and speculative "prosecution" of
+compliant code during extrapolation:
+
+1.  **Presumption of Compliance**: Treat code as compliant unless there is
+    *definitive, visible evidence* in the provided files of a policy violation.
+    If code is ambiguous, or if network/database logic is hidden behind
+    abstractions (e.g., calling an interface or repository method like
+    `clearSession()`), you must assume standard compliant behavior. Do NOT guess
+    or speculate about what happens behind interfaces.
+2.  **Benefit of the Doubt**: When compliance cannot be strictly verified due to
+    code abstractions or missing source file contexts, you must downgrade your
+    finding:
+    -   Never flag a `🔴 Critical` or `🟡 Important` finding based on suspicion or
+        lack of context.
+    -   Instead, output a `🔵 Suggestion` (informational) to advise the developer
+        on what to double-check in their backend or configuration.
+3.  **Exclusion of Local State**: Local-only processing (e.g., caching theme
+    settings, user-selected visual configurations, or on-device-only database
+    operations) is explicitly exempt from Data Safety collection or Account
+    Deletion mandates.
+4.  **Concrete Attributions**: Every `🔴 Critical` or `🟡 Important` finding must
+    cite the exact file, line number, or configuration block containing the
+    direct violation. If you cannot cite the exact line of code containing the
+    violation, you cannot flag it as a violation.
+5.  **Empty-List Discipline**: If no policy violations, discrepancies, or review
+    items are identified during your audit, you MUST represent this as an empty
+    array `[]` for that field (e.g., `"findings": []`, `"verified_findings":
+    []`, or `"manual_verification_required": []`). **DO NOT** populate arrays
+    with "dummy" objects, placeholder strings, or `"N/A"` / `"None"` values.
+6.  **Heuristics & Extrapolation Boundaries**: Whenever applying specific
+    heuristics defined in your goal (e.g., searching for implicit logger leaks
+    or
+    SDK siphoning), you must strictly bound them to the provided evidence and
+    their immediate callers. You are strictly forbidden from initiating broad,
+    unbounded searches for custom paths or variables across the wider codebase.
+    Base your extrapolation only within the specific files already provided to
+    you in the prompt.
+
+### Finalization & Output Mandates (CRITICAL)
+
+-   **Iterative Saving**: If your investigation requires multiple steps, save
+    partial or intermediate JSON states to disk as you progress. Do not hold all
+    data in memory until the very end to prevent data loss upon interruption.
+-   **Strict File Output (NO TRIPLE BACKTICKS)**: You MUST save your final JSON
+    output to disk at the exact path specified in the goal schema using your
+    file-writing capabilities.
+    -   **CRITICAL: The content written to the file MUST be pure, raw JSON. DO
+        NOT wrap the contents inside the JSON file with Markdown code blocks
+        (such as triple backticks `json ...`). Writing markdown blocks into the
+        file makes the JSON unparseable by the compiler.**
+-   **NO Chat Summaries**: **MANDATORY: DO NOT summarize your findings, explain
+    your reasoning, or output JSON in your final chat response.** Your chat
+    output wastes context and is ignored by the orchestrator.
+-   **Verification Before Termination**: You MUST only terminate and return the
+    "SUCCESS" string *after* you have explicitly verified that your JSON file
+    successfully wrote to disk and contains valid JSON (e.g., by reading the
+    file back or checking the directory contents).
+-   **Final response**: Your final response MUST be exactly the word: "SUCCESS"
+    and nothing else.

package/skills/android-play-policy-insights/resources/compliance_report_template.md

@@ -0,0 +1,59 @@
+# Play Policy Compliance Report: {{app_name_id}}
+
+**Status:** {{overall_compliance}} **Scan Date:** {{current_date}}
+
+> **Disclaimer:** This report is generated by an AI automated scanner and is for
+  **informational and advisory purposes only**. It does NOT constitute legal
+  advice, a guarantee of Play Store approval, or a definitive compliance check.
+  The Google Play Review team has final authority. Undiscovered issues may still
+  exist. The developer retains sole responsibility and liability for the apps’
+  security, data privacy compliance, and final Play Store submission.
+
+---
+
+## Policy Risks & Recommendations
+
+*Review these identified risks and follow the suggested recommendation steps.*
+
+{{findings_detail}}
+
+---
+
+## Data Safety Discrepancies
+
+Review these discrepancies between detected behavior and Play Store
+declarations. Discrepancies may stem from data collection/sharing practices or
+new code features not yet reflected in your Data Safety label.
+
+{{data_safety_table}}
+
+{{suggested_declaration_section}}
+
+{{local_access_section}}
+
+---
+
+## Remediation Checklist
+
+Follow these personalized steps to resolve the identified risks.
+
+{{personalized_checklist}}
+
+---
+
+### Play Store Compliance Status Legend
+
+| Overall Status | Meaning & Rejection Risk | Required Action |
+| :--- | :--- | :--- |
+| **🟢 Compliant** | The application code and metadata appear fully compliant with analyzed Play Store policies. No active policy violations or high-risk discrepancies were identified. | **No issues detected**: No active policy violations were identified by this automatic scan. |
+| **🟡 Needs Review** | No critical violations were found in the code, but the app implements features requiring manual Play Console configurations (e.g., submitting **Reviewer Demo Credentials** for login screens) or requests restricted, high-risk permissions (e.g., Exact Alarms, All Files Access, or Background Location) requiring Play Console declaration forms. | **Must Review**: Review the findings. You must either **migrate to modern scoped alternatives (highly recommended)** to bypass declaration scrutiny, OR **manually verify that your Play Console settings (like Reviewer Credentials and Declaration Forms) are completely and carefully configured** before submitting. |
+| **🔴 Non-Compliant** | Severe, direct policy violations (e.g., silent background data tracking, default-only permission abuse) or active Data Safety declaration mismatches were identified. | **Must Fix**: Immediate rejection or account-level policy suspension risk. You must remediate these issues before submitting to the Play Store. |
+
+<br>
+
+| Finding Severity | Description | Action Required |
+| :--- | :--- | :--- |
+| **🔴 Critical** | Direct, verified policy violation (e.g., unauthorized data collection/sharing). | Critical action recommended. |
+| **🟡 Important** | Deprecated permission use or API discrepancy where scoped pathways are mandated. | **Should Fix**: Highly recommended to migrate to prevent manual reviewer flags. |
+| **🔵 Suggestion** | Standard advisory reminder or administrative checklist item (fully compliant). | **Good to Know**: Clean-path confirmation or helper checklist. |
+

package/skills/android-play-policy-insights/resources/critic.md

@@ -0,0 +1,86 @@
+# Review of specialized policy findings (Chunked Critic)
+
+Review a specific chunk of identified policy findings to identify potential
+false positives, exaggerated claims, or inaccuracies due to lack of evidence.
+
+### Provided context files
+
+The prompt provides absolute paths to files and directories:
+- `{{TEMP_DIR}}`: The temporary scratch directory for this audit.
+- `input_file`: `{{TEMP_DIR}}/input_critic_{{CHUNK_INDEX}}.json` contains the
+  chunk of findings to verify.
+
+### Instructions
+
+1.  **Read input chunk**: Read the JSON object in
+   `{{TEMP_DIR}}/input_critic_{{CHUNK_INDEX}}.json`. The keys (e.g. `"1"`,
+   `"2"`, `"3"`) correspond to the finding IDs.
+2.  **Verify each finding**:
+    -   For each finding, analyze its evidence against the source files in
+      `{{APP_DIR}}`.
+    -   Determine the verdict:
+        -   `"VERIFIED"`: True Positive. The codebase confirms the policy
+          violation.
+        -   `"MANUAL_REVIEW"`: Ambiguous code or abstract logic where automatic
+          verification is impossible.
+        -   `"PRUNED"`: False Positive. The codebase is compliant, or the
+          finding is not supported by actual evidence.
+    -   Provide your verification details in the output JSON.
+3.  **Optional Editorial Overrides**: If (and only if) you need to edit, refine,
+   or moderate the worker finding's text, you may include one or more of these
+   optional keys to your decision object. **If you agree with the worker's text,
+   you MUST omit these keys entirely from your JSON.**
+    -   `"issue_summary"`: Write a more accurate, tailored summary.
+    -   `"severity"`: Set to `"CRITICAL"`, `"IMPORTANT"`, or `"SUGGESTION"` to
+      override.
+    -   `"recommendation"`: Write a tailored, codebase-specific remediation
+      step.
+4.  **Save Results**: Save your final "Thin JSON" mapping to
+   `{{TEMP_DIR}}/critic_output_{{CHUNK_INDEX}}.json`.
+
+### Audit principles for false positive detection
+
+-   **Environment detection**: **Do not** flag emulator or root detection as
+  violations unless evidence shows malicious intent or review evasion.
+-   **Speculative collection**: Prune claims based solely on permission
+  presence. Require evidence of actual data access and transfer (whether
+  off-device network egress or on-device sharing to a third-party app).
+-   **Standard patterns**: **Do not** flag standard Android architectural
+  patterns unless used maliciously.
+-   **Surgical Evidence Standard**: Prune or downgrade any finding where the
+  worker has speculated on a transmission pathway that cannot be directly
+  verified in the immediate source files, or where the finding fails to cite a
+  concrete file and line number containing the direct policy violation.
+-   **Data Safety Flag Verification**: If a finding includes Data Safety flags
+  (e.g., `user_initiated`, `is_third_party`), strictly verify them. If the
+  worker claims `user_initiated: true`, ensure there is undeniable evidence of
+  explicit user interaction triggering the transfer. If the worker claims
+  `is_third_party: true`, verify the sink is definitively outside the
+  developer's control (e.g., Android Share Sheet, Social Media SDK). If evidence
+  is lacking, downgrade the finding or use `"issue_summary"` to correct the
+  claim.
+-   **Gatekeeper Validation**: If a worker claims a finding is compliant because
+  a disclosure exists (`prominent_disclosure_status: "DISCLOSED"`), you MUST
+  verify that the UI acts as a strict gatekeeper. If data collection begins
+  before the user taps "Accept", or if they can dismiss it and continue,
+  override the `"severity"` to `"CRITICAL"` and explicitly state the gatekeeper
+  is invalid.
+
+### Output JSON format
+
+**Important**: The output must be a pure JSON object mapping the sequential
+finding IDs from your input file to their decisions. If there are no findings in
+the chunk, return `{}`.
+
+```json
+{
+  "1": {
+    "action": "VERIFIED | MANUAL_REVIEW | PRUNED",
+    "confidence": "High | Medium | Low",
+    "critic_justification": "A concise, technical explanation of your decision based on codebase evidence.",
+    "issue_summary": "OPTIONAL: Overridden issue summary text",
+    "severity": "OPTIONAL: CRITICAL | IMPORTANT | SUGGESTION",
+    "recommendation": "OPTIONAL: Overridden recommendation text"
+  }
+}
+```