The Real-Artifact Guarantee
Every Android-applicable module produces a device-extractable artifact, shared-prefs XML, a file in the app sandbox or on external storage, an HTTP
request, a clipboard entry, a posted Notification, a broadcast, a bound-service
reply, and so on. The exact extraction command (adb / drozer) for each
module lives in the evidence block of
automation/vuln_manifest.json
(fidelity tier, native-backed flag, artifact channels, and the pull command).
The aggregate audit is tracked in automation/artifacts/fidelity_audit.md.
This is verifiable end-to-end on a device with
automation/scripts/verify_all_modules.sh, which walks every module by search,
triggers its demo action(s), and asserts an evidence panel appears, on-device
proof the vulnerable path ran in each module.
iOS evidence tiers
On iOS the same walk runs via the wired RunnerUITests XCUITest target. Because
iOS lacks several Android trust boundaries, each iOS-enabled module is classified
by how real its finding is: A (pure-Dart real I/O, a real NSUserDefaults
plist / SQLite / socket / ciphertext, incl. the Keychain modules), B-real
(the 5 resilience modules plus the App Group shared-container module, backed
by real Swift probes in
ios/Runner/DvmaNativeProbes.swift, App
Group is entitlement-gated and degrades honestly), B-nosim (native-bridge
modules modelling Android-only boundaries with no iOS equivalent, kept as an
honest in-Dart simulation), and C (iOS-only App Intents / Shortcuts /
Universal-Link / WKWebView surfaces still simulated). The per-module breakdown
lives in docs/ios_parity_audit.md,
generated by automation/scripts/ios_parity_audit.py so it stays in sync with
the registry.