docs(p0): compact MVP spec for Android Oboe focus

docs/SOP_AGENT_OPERATIONS.md

@@ -0,0 +1,46 @@
+# SOP Agent Operations — Standing Rules
+
+## Core Agent Rules
+1. Default to P0. Do not implement P1/P2 unless explicitly requested.
+2. Preserve traceability: commit messages, PR descriptions, tests, and review notes must cite decision/requirement IDs.
+3. Make the smallest compliant change. Avoid architecture invention.
+4. If requirements conflict, precedence is: Product Decision Register > SysRS > SysDes > SRS > SAD > SDD > Verification/Release/Security docs.
+5. If a task requires exact historical detail, inspect `phase_index.json`; do not load the obsolete full bundle.
+
+## Required Review Gates
+- Architecture boundary review for Flutter/Rust/bridge/protocol/storage/audio changes.
+- Privacy review for diagnostics, logging, crash handling, analytics, upload, identifiers, or support artifacts.
+- Security review for secure storage, redaction, secrets, dependencies, and supply chain.
+- Release review for platform build, signing, SDK, store, and artifact policy.
+- Localization review for product strings and server-content preservation.
+
+## Testing SOP
+- Unit tests: Rust core, DTO transforms, storage, redaction, decision logic.
+- Widget tests: Material 3 components, state tokens, localization, accessibility semantics, adaptive layouts.
+- Integration tests: bridge events/errors, protocol adapter state, diagnostics export, storage migration.
+- Platform tests: secure storage, audio capture/playback, permissions, hotkeys/PTT, packaging.
+- Acceptance tests: use platform P0 acceptance docs before any release promotion.
+
+## Build SOP
+- Keep repo layout canonical: `apps/chanora_flutter/`, `core/chanora_core/`, `crates/chanora_*`.
+- Pin `flutter_rust_bridge` 2.x.
+- Use bundled `rusqlite` for embedded SQLite.
+- Android minSdk = 28; target API must match current Google Play requirement on upload date.
+- iOS minimum = 13; App Store upload SDK gate must be checked on actual upload date.
+
+## Privacy/Security SOP
+- No telemetry in MVP.
+- No crash reporting unless approved.
+- No automatic diagnostic upload.
+- Diagnostics are local export only and must redact secrets.
+- Product-owned strings may be localized; server-originated content must be preserved verbatim.
+- Secrets never enter logs, diagnostics, SQLite, screenshots, or crash-like artifacts.
+
+## Release SOP
+- Release sequence: Internal Alpha -> External Beta -> MVP Public.
+- Public/store release requires legal/trademark/OSS license confirmation.
+- Staged platform release is allowed when documented.
+- Every release must include version, commit/tag, artifact list, known issues, test evidence, and go/no-go result.
+
+## Agent Refusal / Escalation Conditions
+Stop implementation and ask for owner approval when asked to add or change: telemetry, crash reporting, diagnostic uploads, backend service, multi-server active sessions, platform scope, license, trademark/non-affiliation text, secret-storage policy, or target SDK/minimum OS baseline.