From 6591951c8d675712b2209a988bc278c28afd80be Mon Sep 17 00:00:00 2001 From: null Date: Wed, 19 Aug 2026 22:17:01 -0500 Subject: [PATCH] docs: the export's device checks are a release gate, not a memory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Storage Access Framework path is covered by Robolectric — the intent contract, the bytes reaching the stream, a failing stream never reported as done, and cacheDir empty afterwards — but no test reaches a real document provider, and the picker UI itself has not been driven on a device. Recorded as three checklist rows rather than claimed. The only emulator running on this machine belongs to another project, and starting one on top of it was not worth the contention. Co-Authored-By: Claude Opus 5 (1M context) --- docs/security/SECURITY_CHECKLIST.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/security/SECURITY_CHECKLIST.md b/docs/security/SECURITY_CHECKLIST.md index da432a7..5f33b32 100644 --- a/docs/security/SECURITY_CHECKLIST.md +++ b/docs/security/SECURITY_CHECKLIST.md @@ -62,6 +62,9 @@ The one group that is not generic. Every item proves part of - [ ] Release build has verbose logging off and no raw cycle date in any crash payload — proves §45's logging rule survived the build type - [ ] Delete My Data removes the rows and is irreversible after confirmation — proves the promise in Settings is true - [ ] Export produces only the user's own data, to a location they chose — proves export is not an accidental leak path +- [ ] The export run once on a device, end to end through the system save dialog — proves the Storage Access Framework path works against a real document provider, which no Robolectric test reaches +- [ ] The exported file opened and read — proves it is the human-readable archive §35 asks for, and that the dates in it are the dates the user entered +- [ ] An export attempted while the app lock is on, returning through the lock screen — proves the destination is written only after the unlock, and written once ### The compliance bar, which is not the launch bar