feat: add generic text onboarding use case for Hello Harnex

[daniele21]

Outcome

Hello Harnex can be authorized against a deliberate host-owned generic-text-generation capability and run ordinary bounded TEXT inference without borrowing RedactGuard's PII workflow. Creating an app connection also has an observable mutation path: the same canonical Applications state owner handles the action, and the UI shows saving, success or actionable failure adjacent to the create action.

Product impact

• Depth: PRODUCT_FEATURE

User/problem/outcome: Android developers evaluating Harnex need a neutral first integration rather than a domain-specific PII contract, and the current app-connection creation flow can appear to do nothing after submission. This slice adds the smallest host-owned generic TEXT capability needed by Hello Harnex and makes connection creation feedback explicit.

Risks/assumptions: a generic capability could blur Harnex into a chatbot or weaken host authority. The implementation therefore keeps it TEXT-only, stateless, non-thinking, bounded, model/preset-host-owned and available only to an explicitly AUTHORIZED application with an enabled persisted binding.

Decision: BUILD the bounded onboarding capability; do not generalize model selection, arbitrary JSON schema, multi-turn chat or product-specific policy through this surface.

Success: Hello Harnex sends its prompt unchanged as TEXT through the public Consumer SDK lifecycle, while unauthorized/disabled connections remain fail-closed and create-connection outcomes are visible.

Scope / risk

Owners changed: phone Host Control Plane seeding/policy/runtime binding, Applications route/mutation wiring, Hello Harnex sample + tests, Consumer capability documentation.

Material risks: shared-runtime authorization/policy, use-case resolution, app-connection mutation UX, external Consumer sample lifecycle. No public SDK type/API change, persistence schema migration, native/JNI change, model binary or signing-policy weakening.

What changed

• add ACTIVE generic-text-generation with published Quality / qwen35-text-quality preset;
• add TEXT-only Consumer policy and runtime resolver for explicitly authorized generic bindings;
• preserve Binder UID/package/signer + persisted Control Plane authority;
• route Applications mutations through the canonical activity-owned Applications ViewModel callbacks and place create feedback directly after the action;
• convert Hello Harnex from document-pii-detection/JSON schema to unchanged text input + ConsumerOutputConstraint.Text;
• add unit/instrumentation regressions for generic policy, fail-closed authorization, exact Hello request and create-button feedback;
• update sample and canonical Consumer capability docs.

Delivery / validation

• Stage: INTEGRATION
• Selected profile: FULL
• Execution: REMOTE_AUTOMATED
• Exact head: 16e059f2e908f40933a5a0236d6e33f265cb6e52
• Exact base: dev@d60c0ff9560d6eed225e4fd6e02e746f18625935
• /preflight auto: PASS, selected INTEGRATION / FULL
• Android validation: PASS, including format/static, all-module tests/compile, direct-contract checks and Android native packaging
• Repository validation: PASS
• Repository health: PASS
• Documentation validation: PASS
• Phone cold-start emulator evidence: PASS
• Phone Models UI evidence: PASS
• exact-head and tree-equivalent reusable validation evidence: published

The separate Consumer SDK validation workflow is not path-applicable to this change because the PR does not alter the public SDK/Binder/public ABI or its external-consumer fixture. The selected FULL validation still compiles the packaged consumer fixture/direct-contract boundary.

E2E / environment

The affected complete workflow is Consumer authorization -> assigned use case/preset -> activation/prepare/session/generation. The create-connection UI has focused Compose instrumentation assertions for submit + Saving/Saved/Failed feedback. Emulator UI/cold-start evidence is green on the exact head.

Physical ARM64/JNI/GGUF/memory/thermal evidence is unchanged by this feature and remains separate release evidence; emulator/CI proof is not relabeled as physical proof.

Documentation

Updated durable owners:

• docs/shared-runtime/consumer-api/capabilities-and-policy.md
• samples/README.md
• samples/hello-harnex/README.md

docs/product.md remains unchanged: the feature preserves the existing mission/non-goal that Harnex owns governed infrastructure and is not a general-purpose chatbot.

Remaining gaps

No automated integration blocker remains for this PR. No new REAL_ENVIRONMENT claim or requirement is introduced by this change. Broader physical-device/release qualification remains owned by the repository's existing release evidence.

Safety / privacy

No model binaries, credentials, signing material, private paths, prompts or generated output were added as repository evidence. Generic execution remains local-only and fail-closed under the existing Android identity + Harnex authorization chain.

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto