fix: make consumer capabilities discoverable before activation

[daniele21]

Outcome

Refresh the Aura↔Harnex regression repair onto the current dev baseline and close the capability-discovery, emulator control-state, model-readiness and activation-residency defects exposed by Aura's hardened two-APK journey.

Root-cause repairs

• move the emulator-only Room-backed shell control off BroadcastReceiver.onReceive() via goAsync() and a background thread;
• declare Aura release/debug packages in <queries> so Android package visibility does not hide the installed Consumer from startup discovery;
• seed both Aura use cases as PENDING from the exact observed package/signer identity;
• separate capability discovery from runtime execution: capability discovery may project the currently authorized/bound Control Plane execution before activation, while HarnessPhoneBindingRegistry still requires an active activation for external runtime execution;
• prefer the activation-bound profile once activation exists, preserving public preset identity across activation/capability/runtime lifecycle;
• make the emulator-only Aura assignment toggle preserve the Control Plane invariant that a default binding cannot be disabled: disabling clears isDefault, while re-enabling the canonical schema binding restores it only when no competing current default exists;
• separate configured capability profile resolution from current model inventory so missing installed bytes remain UNAVAILABLE_MODEL rather than collapsing into an unassigned use case;
• fix the schema→category same-artifact profile transition: activation residency now protects the exact (modelDigest, modelProfileId) rather than every resident profile sharing the digest. Distinct Aura schema/category profiles remain distinct; after the schema activation releases, the category activation may evict the idle schema profile and load its own profile, while an active lease still protects its exact resident profile.

Root-cause evidence

The cross-profile failure was reproduced independently in ActivationProfileSwitchRegressionTest: schema activation/residency followed by release and category activation on the same digest previously caused the category prepare path to hit MODEL_PROTECTED_BY_ACTIVATION. Validate #4417 passed on exact reproducer HEAD 8e3f7c4b27b05e07772f9371befc31f3f750612f, proving the conflict before the repair. The regression now asserts the opposite: released schema residency switches successfully to the category profile, while same-profile active leases continue to block unload.

Boundary / invariants

• Binder UID → exact package → current signer → persisted Harnex authorization → enabled use case remains unchanged and fail-closed.
• Aura remains independently signed and starts PENDING; explicit authorization is required before a Consumer client is created.
• Runtime generation cannot fall back to a phone-global selected model or to the pre-activation capability projection.
• Missing model bytes remain a readiness failure; activation/runtime setup still require actual inventory and normal model verification.
• Aura schema inference and category classification preserve distinct host-owned model-profile identities.
• GgufModelProfile remains the exact load identity; same digest does not imply profile equivalence or permit silent handle reuse.
• Production Control Plane model validation is unchanged; only the emulator-only test control creates a valid disabled-binding revision.
• The shell bridge remains emulator-only, android.permission.DUMP protected and absent from production variants.
• No Binder widening, cloud fallback or content logging is introduced.

Release identity

• base: dev@dc30739d760762e4d965b570f17aec74d4f43237
• current candidate: 9074cf8d7dd5b90f5e49f6b3fc41622512faccbc
• PRODUCT_LOCAL / INTEGRATION / STRONG / REMOTE_AUTOMATED
• fix: restore Aura emulator discovery and control #565 is superseded and closed.

The Harnex dev base remains unchanged at the SHA above.

Harnex validation state

• root-cause reproducer HEAD 8e3f7c4b27b05e07772f9371befc31f3f750612f: Validate #4417 green, proving the old same-digest cross-profile conflict;
• implementation HEAD 9a4e717877e4e56626e150c8114b3a7934294e98: remote preflight Validate #4423 green at STRONG, including selected Android validation and native packaging;
• final exact HEAD 9074cf8d7dd5b90f5e49f6b3fc41622512faccbc: documentation validation green and remote preflight Validate #4427 green at STRONG, including Android validation, native packaging, repository validation and exact-head reusable evidence publication.

AUTOMATED_PREFLIGHT_CONFIRMED for Harnex on the exact candidate above.

Exact-pinned Aura downstream acceptance

The previously remaining discriminating gate has now passed against this exact Harnex candidate.

Aura PR #24 final automated candidate:

• Aura base: dev@4d816359470a0bff2d2397b567faa117ec1e4c89;
• Aura exact HEAD: b09c7764b7a9df75af720a53f762bf63792fa976;
• Repository health feat(evaluation): complete EVAL-E-08 quality aggregation on current dev #138 / run 34686690859;
• selector: FULL;
• engineering baseline, web validation, browser critical journeys with FULL_MEDIA, exact Harnex rebuild/publish and Android API 36 preflight: SUCCESS.

The exact-pinned Android evidence proves the required lifecycle sequence: Host absent fail-closed → PENDING/authorization boundary → assignment/readiness transitions → schema/category generation/profile switch → cancellation/cleanup and reconnect/restart behavior. The packaged Aura arbitrary-header flow then completes Harnex schema/category assistance, explicit mapping confirmation, Aura deterministic extraction, Review and verified commit.

Material G2 evidence on the final Aura HEAD includes:

• host-absent OK (1 test);
• authorized packaged lifecycle OK (1 test);
• packaged import status: PASS;
• ledgerBeforeConfirm = 0 and ledgerRows = 0 before verified commit;
• exactly two committed synthetic expenses, both constrained to Aura category Food;
• metadataClean = true with no Harnex/import provenance persisted;
• post-G2 adb_state=device and emulator_state=alive;
• following packaged WebView persistence/deep-link/restart verification passes.

Aura Android evidence artifact 10296365183 records Harnex source revision 9074cf8d7dd5b90f5e49f6b3fc41622512faccbc and contains non-empty required FULL_MEDIA: instrumentation (~46.5s), Harnex two-APK (~61.8s), WebView (~12.4s), plus 1080x2400 screenshots for all three journeys.

Earlier Aura runs #129/#133 and the first Android attempt of #137 reached functional G2 PASS before a remote AVD disappeared during post-G2 media collection. Aura retained those failures, hardened resource/health diagnostics, and a same-SHA #137 rerun passed. Final #138 passed Android without that failure. No Harnex product contract or evidence gate was weakened to obtain green status.

The previously stated exact-pinned Aura deterministic blocker is therefore satisfied. Aura W13 physical/model/accessibility/privacy-governance release qualification remains separate REAL_ENVIRONMENT evidence and does not replace or invalidate this automated cross-repo acceptance.

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto

[daniele21]

/preflight auto