`apps/mobile/device-proof-evidence/CAPTURE-RUNBOOK.md`

44 lines
# GovArbitrage — Physical-Device Proof Capture Runbook (TK-10279)

**Agent:** govarb-device-proof · **Device:** physical iPhone 17 Pro Max (iOS 26.6.1; identifier intentionally kept out of git)
**App:** GovArbitrage · bundle `com.abrams.govarbitrage` · Build 5 (ASC cloud build; no local .ipa)

## GATES (never cross)
- ❌ No App Store Connect writes · ❌ No Resolution Center reply · ❌ No binary upload · ❌ No resubmit
- ❌ Do not complete Sign in with Apple / any identity action — only prove it is *available*
- ✅ Read-only device inspection + local screen recording + local evidence only

## Precondition
Device must be ONLINE (unlocked + "Trust This Computer" accepted). Monitored by dev-monitor.sh.
Set `GOVARB_DEVICE_UDID` from `xcrun devicectl list devices` before sourcing the helpers.

## Steps once ONLINE
1. **Verify device identity/OS**
   `xcrun devicectl device info details --device "$GOVARB_DEVICE_UDID"`
   → capture productType, osVersionNumber, deviceName → save `device-info.txt`
2. **Confirm app installed** (build 5 via TestFlight — cannot side-load, no local .ipa)
   `xcrun devicectl device info apps --device "$GOVARB_DEVICE_UDID" | grep -i govarbitrage`
   - Installed → proceed. Not installed → BLOCKER: build 5 must be installed on device
     via TestFlight (Steve action); cannot upload/install (gated). Surface + hold.
3. **Start screen recording** of the physical device (QuickTime New Movie Recording → iPhone source,
   or Control Center on-device recording). Save MP4/MOV to this dir.
4. **Launch app cold** `xcrun devicectl device process launch --device <UDID> com.abrams.govarbitrage`
5. **Drive the required journey** (taps on device — human/XCUITest):
   cold launch → Opportunities list → open a listing → detail showing **valuation / cost / ROI / max bid**
   → Settings → **connection test** → (optional) show **Sign in with Apple availability** (do NOT sign in).
6. **Stop recording**, save as `govarbitrage-device-proof-<ISO>.mov`, plus key still frames.
7. Log every step to TK-10279 as TK_AGENT=govarb-device-proof. Report evidence path. Do NOT touch ASC.

## 🔒 MANDATORY before ANY upload — privacy pre-scan (added 2026-09-03)
The first recording passed codec validation but leaked a private Messages thread → rejected.
`verify-recording.sh` is codec-only. So BEFORE treating any recording as uploadable:
```
bash device-proof-evidence/verify-recording.sh <file>        # codec/duration/black
bash device-proof-evidence/privacy-scan.sh   <file> 1        # PII pre-scan (step=1s for the real screen)
```
`privacy-scan.sh` samples frames through a LOCAL vision model ($0) and exits nonzero if it sees a
notification, Messages/SMS, a name, phone, email, or a visible password. **Verified 2026-09-03: it
flags the quarantined PII recording (4 frames, rc=1).** Use step=1 for the final screen (a <3s
notification banner can slip a coarser sample). A CLEAN pre-scan is NECESSARY, NOT SUFFICIENT — a
human must still eyeball the whole recording before Steve replies to Apple.