Device signal and backend contract catalog

How collection is organized

A probe is an independently executed group of related observations. Each probe can succeed, be skipped, time out, or return an error without invalidating the rest of the event.

Backend event contract

Design the ingestion boundary around the stable event envelope and an open map of probe outcomes. Probe IDs and successful data fields are additive, so consumers should tolerate unknown keys while validating the fields they use.

type RawSignalEvent = {
  session_id: string;
  client_id?: string;
  event_type: "device_intel_collection";
  schema_version: number;
  collected_at: string; // ISO 8601
  probes: Record<string,
    | { status: "success"; data: Record<string, unknown> }
    | { status: "skipped"; reason: string }
    | { status: "timeout" }
    | { status: "error"; error: string }
  >;
};

Remaining migration work: standalone lint and package-content gates next; transaction lifecycle, GL coexistence and physical-device QA remain release gates. Independent contract tooling, iOS/Web SDKs, Flutter/Capacitor bindings, registry releases and ecosystem documentation are still pending. See the migration checklist for completion gates and the unresolved legacy active Frida boundary.

The standalone Android SDK currently exposes device identity, locale, native runtime timing, native numeric vectors, audio output properties, application metadata, hardware, fonts, passive OS integrity, local network observations, telephony, cached location, media/Bluetooth/finite app audit, device security posture, point-in-time transaction context, and the GPU benchmark workload. Explicit transaction observation sessions are a separate API. A native Android example consumes these sixteen collection methods plus start/read/stop session controls without React Native and collects only after an explicit button press. GPU collection is rejected on the UI thread and must run on a host-owned worker; its 50 ms draw-loop target is a budget, not an end-to-end deadline, and caller timeouts do not cancel native driver work. An instrumented test suite asserts that GPU collection restores a caller's prior EGL binding, leaves none behind when there was none, and never terminates the process-shared display; it was executed on an Android emulator, which is not driver validation. Physical-device GL QA remains a release gate. Protected fields require permissions already granted to the host app; collection never requests permissions or a fresh location fix. JavaScript/native numeric comparisons remain in the React Native binding. Audio latency is estimated from output-buffer and sample-rate properties, not measured with playback or loopback. This is a partial SDK under development; no Maven artifact is published and existing probe defaults and permissions are unchanged.

Media collection preserves sensitive accessibility component names and finite package-list matches; empty results can reflect visibility limits or legacy read-failure fallbacks. Bluetooth reads bonded-device count only, with host-owned permissions and no discovery, device names or addresses. Device security posture reports hardware features and settings, not biometric enrollment or authentication, and does not start transaction observers. React Native transaction observation now detaches on host pause/destroy and reattaches on a later collection. Standalone hosts own explicit main-thread sessions. Historical events can span gaps; unavailable current capture coverage is omitted, and partial obscuration is omitted below Android 10. See the lifecycle migration notes; these changes are not yet published.

Passive integrity includes process-local Frida evidence, but no localhost TCP scan. The active Frida scan now belongs to a separate optional Android component whose contract permits loopback socket I/O only; its React Native default, fields and types are unchanged, and its Maven artifact is unpublished. Finite package observations depend on host package visibility: false can mean not visible, not necessarily absent. The standalone SDK adds no package queries.

Application metadata covers only the host application's own package and preserves signing and installer fields, including the installerPackage compatibility alias. Hardware includes the existing Android storage observations. Font collection is expensive and high entropy: invoke it explicitly in the standalone SDK for a documented purpose. These extractions preserve existing React Native probe defaults and collection behavior and add no permissions.

runtime_timing remains disabled by default. On Android, native clock sampling uses the standalone Android SDK core; JavaScript and JS-to-native duration measurements remain in the React Native binding. If no positive native intervals are observed, native resolution, median, p95, and median absolute deviation fields are omitted. A clock-read failure fails collection instead of producing zero-valued timing data. The standalone Android SDK is still in development and has no published Maven artifact.

Probe catalog

Search probe IDs, field names, purposes, permissions, and data categories. Filters can be combined with the search. High-sensitivity and expensive probes require additional purpose, retention, and calibration review.

Showing all 19 probes and 322 fields.

On narrow screens, each probe is shown as a readable card. Open its field list to see types and copy JSON paths.

Independent probe outcomes

Source of truth

The typed catalog in src/probeCatalog.ts is authoritative. It includes every selectable field, purpose, data category, platform, sensitivity level, permission note, and default state.

Open the full data dictionary on GitHub.