{"slug":"ios-fleet-recording-qa","total":3,"limit":100,"offset":0,"since":null,"commits":[{"hash":"7f0c634","date":"2026-09-12 06:40:19 -0700","author":"Steve Abrams","subject":"selftest: cover the credential lens (it shipped untested)","body":"The credential lens landed in a23289a — flagging a visible username, API secret,\nbasic-auth blob or backend host in a submission clip — but selftest.sh was\nwritten before it and never exercised it. Zero of the six cases touched it, so\na broken lens would have passed the suite silently. That is the exact thing\nCLAUDE.md forbids: a check with no negative test proving it goes red.\n\nThree cases added, one of which is the half that usually gets skipped:\n  - D_cred.mov (Username / demo_reviewer / an agentabrams host) -> lens MUST fire\n  - D_cred.mov -> verdict MUST stay TECH_PASS_PRIVACY_PENDING, because the lens\n    warns by design (Apple 2.1 item #4 explicitly ASKS for demo credentials, so\n    visible credentials must never hard-fail a clip)\n  - C.mov (clean) -> lens MUST stay silent: the false-positive guard\n\nProven by fault injection, not just by passing: neutering all four CRED_*\npatterns makes the suite report \"credential lens did NOT fire\" / SOME FAILED;\nrestoring them returns ALL PASS (9/9). recording-qa.sh verified byte-identical\nto HEAD afterwards, so the injection left no residue.\n\nAlso re-verified the pre-existing gate end to end before touching it: ffprobe,\nffmpeg, tesseract and shasum all present, and the original 6 cases still pass —\nincluding the two that matter most for App Review, a simulator clip rejected as\nREJECTED_NOT_DEVICE and --approve refusing to bind a review to a PII clip.\n\nRefs TK-11155.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>"},{"hash":"a23289a","date":"2026-09-03 14:13:07 -0700","author":"Steve Abrams","subject":"recording-qa: add credential lens — flag visible username/API-secret/basic-auth/backend-host in submission clips","body":"Found empirically under TK-11155: the real GovArbitrage on-device capture\n(1320x2868, 68s) passed the gate TECH_PASS + 'OCR clean' while its Settings\nframe showed a plaintext 'Username admin' and the backend host\nhttps://auctions.agentabrams.com. The OCR scan only looked for\nemail/phone/street-address, so credentials were invisible to it.\n\nAdds a 4th lens over the SAME already-extracted frames (no extra cost):\nvisible username, api-key/secret/bearer/token, Basic <base64>, and internal\nbackend hosts. Credential labels sit on their own OCR line above the value\n('Username\\n\\nadmin'), so it matches a newline-flattened copy, skips masked\nvalues (dots/asterisks), and drops label-plus-ordinary-word noise.\n\nWARNS, never hard-fails: Apple's Guideline 2.1 item #4 explicitly asks for\ndemo credentials, so visible creds must be a conscious choice, not a silent\npass. Verdicts and exit codes are unchanged; count surfaces in the human\noutput and as cred_hits in --json.\n\nVerified: selftest 6/6 PASS (no regression); real clip now reports 11 hits\nacross username + backend-host, exit still 0.\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01SEhnWQSSkAhSYxWXHJ3MCw"},{"hash":"bab2877","date":"2026-09-03 13:22:36 -0700","author":"Steve","subject":"ios-fleet-recording-qa: 2.1 device-recording QA gate (tech + OCR PII + human sidecar), self-test green","body":"Rebuilds the verify-recording/privacy-scan/readiness-probe the TK-11155 memos assumed existed.\nVerdicts: TECH_FAIL / REJECTED_NOT_DEVICE / PRIVACY_FLAGGED / TECH_PASS_PRIVACY_PENDING / READY_TO_SEND.\nDevice-metadata absence is a warning (AirDrop/re-encode strips it), not a false reject.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01YNivxV68DdxP1rvhViBfcN\n"}]}