[captcrock]

What this is

The first build of TST Assist per docs/tst-assist-android.md (v2.0 plan, paste ends at §9.4 S1). A pure-JVM Kotlin core, built and tested, plus the Android side written against framework APIs. CI runs the JVM suite and a real assembleDebug; both are green.

In this PR

core/ (JVM, 254 tests, ./gradlew :core:test)

• Action grammar (plan §7): closed verb set, strict parser, first non-empty line only, hints must exist in the current observation.
• Observation model: node filter with window z-order and dedupe (C4), coverage detector (C1), session-stable hint table with a one-step quarantine on freed numbers (C3), screen fingerprint for the stale-hint check, paging at 60 with more. Labels render as one bounded escaped token so screen text can never open or close the <<OBS block.
• Policy pack (plan §4): policy/policy.yaml as ordered data rules; policy/cases.yaml conformance suite (every rule has a case); Kotlin enforcer with the silent / once / every / refused gate; sensitive controls in EN and ES.
• Task loop: step budget, loop detector, one repair then stop-and-ask, task grant once, a card per Tier 2 action, stale-screen refusal, kill switch polled before every step and execution, intent-lock re-confirm.
• Injection suite over the loop: hostile screen text, prose and JSON replies, multi-line replies, invented hints, non-allowlisted apps, app drift, keyguard, missing grant. Nothing executes beyond the grammar and the gate.
• Redactor ported from tstd's logging.py (same five patterns, structure scrub, idempotent).
• Config presets in tstd's config.yaml shape (desktop presets copied, plus device and home), and the cost meter with tstd's cache-honesty rule (absent cache figure is not zero).
• Audit: desktop schema v1 and v2 replayed verbatim, a v3 phone migration (actions, approvals, device id), and BEFORE UPDATE / DELETE triggers that make append-only real. CSV and JSONL export with the desktop's columns.
• Network: bind rules mirroring ws.py and tailscale_bind.py (loopback always, one Tailscale extra, never unspecified), token and hello handshake, Endpoints as the single place a connection is made (hosts not named in config are refused), OpenAI-compatible provider client, and a source scan that fails if anything else opens a connection.
• Steering: rules-file boundary (ASSISTANT.md, CHARTER.md, profiles/, policy.yaml, escapes and symlinks), instruction stack with token estimate, default ASSISTANT.md.
• Wire: client-side model of tstd's WebSocket protocol; unknown event kinds dropped and counted, malformed frames counted, approve/deny/always-allow messages matching approval.ts, sequence tracking, checked against TST Desk's own protocol-fixtures.json.

app/ (Android, framework APIs only, assembleDebug green in CI, not yet run on a phone)

• Accessibility service: tree walker with stable identities, observer, executor (accessibility actions first, gesture fallbacks second).
• Approval surface: overlay highlight and card plus a notification with Approve and Deny; timeout is deny.
• Kill switch: Quick Settings tile and Stop on the task notification.
• Notification listener with inline reply; assistant-role services; Keystore-wrapped secret store; SQLite executor; foreground task service; settings activity with a policy self-check.
• Task wiring: cloud planner (brain tier, metered, spend cap ends the turn), audit listener (every step, approval and model call is an INSERT), planner selection that says plainly what is missing.

docs/: the plan as supplied, a decision log (TM-001 to TM-009), README.

Still landing on this branch

• docs/reality-check.md: the plan's claims checked line by line against TST Desk's code, plus the counterpoints that survived an adversarial review. The review is running.

Not done

• Device mode (on-device model), voice, vision fallback, Home-mode session UI: later milestones per the plan.
• Nothing has run on a phone yet. The APK builds in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vyo2hxtfWppNVyy99Q8GmZ