---
description: iOS Frontend Refactor Wave 0 的本地实现覆盖、验证证据与未决门禁
status: request_changes
updated: 2026-08-12
sources:
  - repo://ailoha-agent-iOS@5e6ac6e41c53780c85808c92290d2bd38f809123
  - repo://ailoha-brain/tasks/active/IOS-20260812-frontend-refactor-wave0
confidence: high
sensitivity: internal
---

# Wave 0 Implementation Overlay

## 状态边界

- 固定基线：`feat/revert-main-latest-two@5e6ac6e41c53780c85808c92290d2bd38f809123`。
- 本地候选：`bat/IOS-20260812-frontend-refactor-wave0` 隔离 worktree；未 commit、push、开 PR、merge 或 release。
- 当前结论：last verdict 88-file manifest `6faf73967263cfc4c7953101632427f26f48997713f5c0bc2d00300394f9b86a` 为 `request_changes`（0 P0 + 6 P1）。该轮证明共享 analyzer cache 被原地加入 derived field，后续 mutation 会把无关 schema failure 当成 kill，因此旧 credential83/83 与三条 semantic negative 收据失效。Current successor已用 immutable cache、per-mutant isolation、target-diagnostic attribution、全 fact source binding、closure/callable/method-value exact regressions重跑 credential90/90；完整Lightweight通过，并冻结为88-file `2fadb1c1…95e0`，等待独立复审。Hosted65/65、ARPC6/6、account/effect89/89继续保留，不能外推为当前 SEC-001 关闭。
- Figma：本波不改变 UI 或视觉合同；问卷节点 lifecycle 仍是 unknown，不用作实现输入。

## checkpoint 当前状态

### 0 · Hosted App test substrate

- 新增 `AilohaTests` hosted target 与 `AilohaTests.xctestplan`。
- 共享 Scheme 移除不存在的 legacy testable，绑定真实 test plan。
- `xcodebuild -list` 显示 5 个 target；最小 app-owned smoke test 可加载 `TaskStateManager`。

### 1 · SEC-001 credential logging — exact request_changes / local remediation

- APNs token、Soniox API key、Screenshot update token 与两个 SharedConstants token setter 不再记录值或前缀，只记录结果。
- `check_credential_log_privacy.py` 进入默认 Lightweight，已知 seam 的 mutation 会 RED。
- 固定基线被新守卫拒绝，证明 guard 不是“只会对当前代码报绿”。
- Current successor 的 cache record保持canonical immutable，derived offset只写副本；每个mutant隔离cache，只有目标privacy-policy诊断可计为kill。Helper、invocation、binding、local、alias绑定source offset/slice并各有omission negative；required/default + typealias closure、higher-order source、direct/bound/optional/factory callable、parenthesized/assigned method value均进入90/90。旧83数量保持失效，不与新矩阵拼接。

### 2 · PRIV-001 account isolation — independently closed / integration pending

- 已建立 `AccountScopeResetCoordinator`、生产 `AccountLogoutTransaction`、进程 `AccountScopeEpoch`、跨进程 session 与 Main App `AccountScopeLease`。
- Home / Completed / TaskChat REST、Contact / Calendar / ARPC Task、Home/image/token refresh 的迟到回写均绑定 lease/generation；App Group ledger 与 task counts 使用 session envelope，raw purge 不再用 filtered getter 假验证。
- Generated/direct Alamofire request 在 builder 创建时绑定 immutable lease；Session 关闭自动起发，adapter/retry/401 只能沿用同一 lease，真实 task 创建后由 registry 校验并 resume。stale 路径先取消具体 `URLSessionTask`、再取消 Alamofire request；该 hosted 用例曾 RED（transport count 1），修复 direct-cancel 后 GREEN。
- TaskInteraction、EventKit 与 active legacy Screenshot/BGProcessing 共用 lease/session 并在 reset 取消已登记工作；raw App Group 读取、解码、协调或删除失败均阻止 identity release。
- 当前候选以 App Group tombstone 让 logout 开始即不可捕获新 session，以持久 journal + recovery shell/quarantine 幂等续跑；journal 缺失、损坏或不可读都继续 quarantine，不再被 `try?` 折叠成“无需恢复”。Calendar/Contact create 在系统副作用前 prepare durable intent + opaque marker，成功后再 bind external ID；Calendar mirror ledger 额外持久化 backend ID 与 `prepared/linkPending/linkConfirmed/unknownOutcome/backendDeletePending/deletePending`。生产删除入口在 backend DELETE 前为普通 linked mirror 或既有 pending-create owner 持久化 `backendDeletePending`；response lost、backend 404 或成功后 durable phase-transition failure 都保留同一 owner，startup 先幂等重试 backend delete，确认 absent 后才转 `deletePending`、执行 EventKit delete/absence readback/complete。pending cleanup 先于 `mirrorEnabled` preference gate，断开 System Calendar 不能绕过责任；账户切换才补偿旧 session 的 EventKit object。
- Screenshot writer 与 reset 协调同一 screenshots directory，writer 在临界区前后校验 session，reset 排空旧 writer、raw verify 空后才发 receipt。普通 logout 在 credential purge 前严格撤销当前 device mapping，再结束已捕获 A Activity，并重扫 owner 不匹配的远程卡与 session notification；本地卡只由 session-bound durable registry 识别，不再用 `taskId == nil` 推断。这一 fail-closed 合同仍有两个明示未知：离线/过期 token 会进入 recovery shell；后端 push-to-start canonical owner payload 尚未验证。
- Logout transaction 现在在同一个 Calendar serial owner 内先权威/idempotent 结算当前 session 的 `backendDeletePending`，再原子提交 recovery journal 与 session tombstone；generic reset reconciler 若仍遇到未知 backend outcome，会保留 ledger 并 fail closed，不删除 EventKit 也不冒充完成。backend-only 与 linked 两条 `response-loss → logout/reset` hosted probe 固定结算发生在 reset commit 前。

## 攻击审查反例账本

以下合并两轮独立复审。旧反例保留为历史事实；“当前回应”只表示实现已进入候选，不能由 Task Chief 自行把独立 verdict 改成 approved。

| 优先级 | 历史反例 / 影响 | 当前 remediation 候选 | 复审状态 |
|---|---|---|---|
| P0 | Generic retry 可把 A payload 换成 B token | builder-bound lease + actual Alamofire first-send/network/401 tests | pending independent review |
| P0 | TaskInteraction 权限 await 后可写 EventKit/提交 A widget | entry lease + pre/post effect check + stale compensation + zero-write test | pending independent review |
| P0 | Legacy Screenshot URL/BG work 在 reset 后继续上传/ARPC/EventKit | account-scoped task registry + reset cancellation + side-effect lease | pending independent review |
| P1 | 跨文件 helper、多行 property/closure、换行类型 closure 与 opaque flow 绕过 guard | conservative repository fixed point + exact compile-valid mutants；current credential 40/40 killed | pending independent review |
| P1 | coordinated read/decode error 被折叠成空数组 | throwing raw verification + corrupt-data failure injection | pending independent review |
| P1 | component receipt 外推 production closure | actual interceptor/401/EventKit/active entrypoint tests；当前 hosted 65/65 | protected CI/UI/system replay 仍未有 |
| P0 | `requestWillResume` 并非 Alamofire EventMonitor 事件 | `startRequestsImmediately:false` + real task create registry + `resumeIfCurrent` + after-adapt race test | pending independent review |
| P0 | logout rotate 发布可被并发 Intent 捕获的过渡 session | App Group tombstone 原子 revoke；capture/isCurrent fail closed；登录 transaction 最后 activate | pending independent review |
| P0 | active Calendar backend→EventKit mirror 无 lease | mutation 入口、response、serialized mirror、system write 与 UI commit 贯穿同一 lease | pending independent review |
| P0 | stale Contact/EventKit 补偿删除失败被吞 | durable compensation ledger + retry/readback + failure injection | pending independent review |
| P0 | Live Activity 与 legacy local notification 未纳入 identity-release gate | capture A activity IDs + session notification namespace + awaitable/verified cleanup | pending independent review |
| P1 | 跨文件 neutral source helper、多行 computed property 或 closure-valued source 在另一文件入 sink | 保守 source/property/closure-return summary + exact compile-valid mutants；40/40 killed | pending independent review |
| P0 | journal 不可读被 `try?` 当成无 pending，启动自动 retry 可退出 quarantine | read error 一律 recovery-required + 启动/运行中回归 | pending independent review |
| P0 | system effect 成功到 ledger external ID 登记之间存在 crash window | effect 前 prepare durable intent + opaque marker，effect 后 bind，重启可重建 | pending independent review |
| P0 | logout 快照 Activity IDs 后可迟到 A 卡 | strict device revoke + owner policy + post-snapshot rescan | pending independent review |
| P0 | Calendar mirror 在 EventKit create 后、backend link durable commit 前清 ledger；same-session restart/错误 link/response-lost 无恢复状态 | backend-ID/phase ledger 保留到 exact GET；unknown outcome 与 marker failure 幂等续跑，跨 session 才补偿删除 | closed for exact `afd14a4e…d3a30`; later exact regressions found no reopening |
| P0 | Screenshot writer 过 session precheck 后暂停，可越过 reset empty receipt 再写 | writer/reset directory coordination + critical-section session recheck + throwing stale cleanup/readback | pending independent review |
| P1 | `taskId == nil` 被猜作 local placeholder，在 owner guard 前跳过 | owner guard 先执行；session-bound local owner registry 决定 local/remote，reset 同步清 registry | pending independent review |
| P1 | 跨文件多行或换行类型声明的 closure-valued credential source 不进入 fixed point | closure block summaries 支持换行类型声明 + exact cross-file mutant | closed for exact `afd14a4e…d3a30`; later exact regressions found no direct reopening |
| P1 | Calendar startup recovery 绕过前台 `runSerialized`，可与 stale foreground create 重复消费同一 ledger | recovery 纳入同一 serial owner；foreground dequeue 后 re-GET backend link；deterministic concurrency test + 2 mutations | closed for exact `a6259a09…a191`; later exact regressions found no reopening |
| P1 | parenthesized multiline closure source、line-broken OSLog Logger alias sink 不进入 regex grammar | closure / Logger declaration parser 扩展 + 2 exact compile-valid mutants | closed for exact `a6259a09…a191`; direct cases remain closed, broader regex grammar P1 remains open |
| P1 | backend event 无 Apple link 时 `mirrorDelete` 直接返回，不消费同 backend ID 的 pending create ledger | 同一 serial owner 先解析/删除/readback absence，再 complete；失败保持 retryable；3 hosted cases + 2 mutations | pending independent review on `bb65577e…4fcc` |
| P1 | OSLog inventory 漏 factory-returned Logger 与同声明第二 binding | repository Logger summary + 2 exact compile-valid mutants；current credential 22/22 | pending independent review on `bb65577e…4fcc` |
| P1 | higher-order closure assignment 的 credential source 不进入跨文件 summary | 仅对 body 直接含 credential source 的 higher-order assignment 做保守 summary + exact mutant | pending independent review on `bb65577e…4fcc`; not a full Swift taint claim |
| P1 | failed pending-mirror delete 只有人工二次调用可重试；production startup 把 row 当 create/link 并 GET 已删除 backend | delete 前 durable `.deletePending`；startup 在 serial owner 内直接重试 EventKit delete、backend GET=0；hosted regression + 2 mutations | pending independent review on `0aaf88e6…a5686` |
| P1 | ordinary closure argument、调用 tainted helper 的 trailing closure 与 computed Logger property 不进入 source/sink fixed point | conservative direct/indirect closure summaries + computed Logger inventory；3 exact compile-valid mutants | pending independent review on `0aaf88e6…a5686`; not a full Swift taint claim |
| P1 | 普通 linked mirror delete 无 durable row，effect failure/crash 后 production startup 不可恢复 | 每次 linked delete 先 prepare `.calendarMirrorDelete` / `.deletePending`；failure 与 completion-failure 都由 startup 直接重试；2 hosted cases + mutation | pending independent review on `97f1b83c…060ec` |
| P1 | `mirrorEnabled` preference 早于 pending cleanup，可绕过 owner obligation | pending cleanup 先于 preference gate；disabled-preference hosted case + mutation | pending independent review on `97f1b83c…060ec` |
| P1 | labeled closure、tainted-property trailing closure 与 typed-factory computed Logger 仍漏 summary | repository closure/logger fixed point + 3 exact compile-valid mutants；current credential 28/28 | pending independent review on `97f1b83c…060ec`; not a full Swift taint claim |
| P1 | production backend DELETE 早于 durable local owner；commit→response-lost/crash 可留下无 ledger EventKit mirror | pre-request `.calendarMirrorDelete/backendDeletePending`；startup idempotent backend delete/404 后转 `deletePending`；response-lost 与 phase-failure hosted cases + 3 mutations | pending independent review on `b915cf74…6257` |
| P1 | Logger-valued alias、`Logger.init` 与 qualified constructor 绕过 sink inventory | Logger binding alias fixed point + unified constructor patterns；3 exact compile/typecheck-valid mutants；current credential 31/31 | pending independent review on `b915cf74…6257`; not a full Swift taint claim |
| P1 | 无 Apple link 的 backend-only Calendar event 在 durable intent 前发送 DELETE；commit→response-lost 后 startup 无 owner | externalID 可为空的 `.calendarMirrorDelete/backendDeletePending` 在网络前持久化；startup 幂等重试，确认 success/404 后 complete；2 hosted cases + mutation | closed for exact `a8b8cc2c…d7906`; current regression review pending |
| P1 | immediate Logger receiver、parenthesized / optional / computed alias 与 `.notice` 绕过 sink grammar | constructor receiver + alias fixed point + optional member access + Logger level set；5 exact compile/typecheck-valid mutants | closed for exact `a8b8cc2c…d7906`; current regression review pending; not a full Swift taint claim |
| P1 | logout session revoke 后 generic reset 会错误 complete 未知结果的 Calendar `backendDeletePending`，或只删 EventKit 而不确认 backend DELETE | 同一 Calendar serial owner 内先结算 pending backend outcome，再提交 journal/session revoke；generic reset 对未知 outcome 保留 ledger并 fail closed；backend-only + linked hosted probes 与 2 mutations | closed for exact `987a1b8b…d739`; current Swift source unchanged / regression review pending |
| P1 | typed shorthand `Logger = .init(...)` 与 outer-parenthesized `(Logger(...))` 绕过 known-sink inventory | typed Logger shorthand + conservative outer-parenthesis recognition；2 exact typecheck-valid mutants | closed for exact `987a1b8b…d739`; current regression review pending; not a full Swift taint claim |
| P1 | Logger typealias / wrapper receiver grammar 仍可绕过 known-sink inventory | `45ba…` 已关闭裸 typealias 与 `Optional(Logger(...))!`；exact review 仍发现 `typealias X = (Logger)`、`Optional.some(Logger(...))!`、typed closure receiver 三条邻接反例 | open on exact `45ba8781…e44c`; prefer SwiftSyntax/AST or a versioned finite syntax contract |
| P1 / product-backend decision | strict server unregister 与 Live Activity owner schema | 客户端已 fail closed；离线 recovery UX 与后端 canonical owner 字段尚未验证 | open decision |

## 验证收据

| Gate | 结果 | 观察 |
|---|---|---|
| Current hosted Swift Testing | PASS 65/65 | iPhone 17 Pro / iOS 26.5；xcresult `/tmp/AilohaTests-Final-1270.xcresult`；新增 backend-only 与 linked `response-loss → logout/reset` production-path probes；真实账号 UI/system-surface replay 未运行 |
| Current mutation guards | CHIEF-LOCAL PASS | credential90/90 + account/external effect89/89；旧83收据保持失效，不外推独立批准 |
| ARPC Package | PASS 6/6 | Swift Package protocol/transport tests |
| Current test build | TEST SUCCEEDED | `xcodebuild test` 成功编译 App/Widget/Tests；xcresult 为本地临时 artifact，未受保护 |
| Lightweight / generic Debug / Release | CHIEF-LOCAL PASS | current系统Python Lightweight/HEAD RED/diff-check通过；Debug/Release因App Swift未变仅保留source-equivalent边界；未受保护 |
| Independent attack review | REVIEW PENDING | last verdict `6faf7396…9b86a`：0 P0 + 6 P1；current88-file `2fadb1c1…95e0`已冻结，等待送审 |

## 待决策与门禁

| ID | 决策 | 当前边界 | 解除条件 |
|---|---|---|---|
| W0-D01 | 是否配置 protected CI trust / artifact resolver | 本地 digest 与测试不能自证集成批准 | Reviewer/CI attestation 绑定 Goal + Evidence Manifest |
| W0-D02 | Python runtime 如何长期收敛 | 五个与本候选相邻的脚本已用 postponed annotations 兼容系统 Python 3.9.6，完整 Lightweight 通过 | 仓库仍需明确最低 Python 版本，避免后续脚本再分叉 |
| W0-D03 | Wave 1 先迁 Task owner 还是 Navigation effect | 两者耦合，但同时重写会扩大回归面 | 选定第一个垂直 slice、single writer、parity 与 rollback 指标 |
| W0-D04 | 哪个 Figma surface 是 current successor | 问卷不在 runtime 主路径，design lifecycle 未确认 | design owner 给出 current/dormant/superseded + successor tuple |
| W0-D05 | account/device/environment 远程撤销合同 | 当前客户端严格 unregister 后才 purge credential；离线、超时或过期 token 会保留 recovery shell | 后端确认 account-generation 原子失效或可恢复 revoke receipt，产品确认离线退出 UX |
| W0-D06 | recovery UX 的强度 | journal/quarantine/retry 已实现；corrupt journal 与真实 crash/relaunch 的用户体验仍未运行验证 | 真实 kill/relaunch、失败提示与幂等续跑 receipt |
| W0-D07 | durable purge 的验证语义 | filtered getter 不能证明 raw store 已删除 | raw decode count=0 + credential readback absent + failure injection |
| W0-D08 | Live Activity canonical owner | 客户端仅接管能从 attributes/widget data 证明 userId 的卡；missing/unknown fail closed | 后端 payload schema + 真实 push-to-start A→logout→B receipt |

## 尚未完成

- 没有声称整个 iOS 重构完成；Wave 1–5 仍未实施。
- 没有真实账号 UI E2E、生产 rollout、性能 trace 或 accessibility runtime receipt。
- 没有提交、PR、CI required check、merge、TestFlight 或发布证据。
- 最新完整独立 verdict 为 exact `6faf7396…9b86a` 的 `request_changes`（0 P0 + 6 P1）。65/65、credential90/90与account/effect89/89不能替代新的 exact independent approval；current88-file `2fadb1c1…95e0`已完成Lightweight并冻结，等待复审。

## Recovery

- credential value-free policy不可回滚。
- Account reset 只能回退到另一个经证明同时覆盖 in-memory、durable、credential 和 external-effect 边界的实现；不允许回到 partial cleanup。
- Hosted target可作为独立 substrate 保留；后续 Wave 必须继续复用行为测试，不用静态文档替代。