chanora/docs/implementation-status-2026-05-28.md

# Chanora Implementation Status — 2026-06-11

> **Updated from 2026-05-28 snapshot.** Changes since last report: poke notification system (protocol classification, bridge strength, Flutter notification service, settings UI, l10n, persistence), file transfer/avatar download with `chanora_cache` (cacache-backed content-addressed blob store), desktop Silero ONNX VAD, Windows PTT modernization, adaptive 3-panel layout, per-user volume controls, event-driven UI, real-time mic level metering, macOS permissions service, macOS lock-free audio event queue, iOS audio session controller, hard-mute owners service, voice join ordering service, shared app snackbar, chat panel widget, voice status summary widget, audio poisoned-mutex recovery, platform-aware client version, dead code removal, code deduplication, and multiple iOS/macOS/Android audio fixes.

**Workspace version:** `v0.2.0-beta.1`
**Flutter app version/build:** `0.3.0+100`
**CHANGELOG latest:** `v0.3.0`
**Rust crates:** 10 (core + 9 workspace crates; `chanora_cache` added since last report)
**Build status:** Host Rust workspace evidence shows all 10 crates compile cleanly. This does not claim Android target success; Android target compile/install/smoke evidence remains blocked locally as noted below.

---

## P0 / MVP

### Done

| Area | Evidence |
|---|---|
| App shell / startup | `main.dart` (2313 lines), `app_bootstrap.dart`, `RustLib.init()` wired |
| Flutter UI | Full widget set: `connect_widgets`, `snapshot_view`, `chat_views`, `chat_panel`, `voice_bar`, `voice_compact`, `voice_settings`, `voice_settings_controls`, `voice_status_summary`, `client_info_sheet`, `input_dialogs`, `bbcode_text`, `poke_notification_settings`, `app_snack_bar` |
| Material 3 + design tokens | `chanora_tokens.dart`, `platform_capabilities.dart` |
| Localization (en + zh-Hans) | `l10n/generated/app_localizations_en.dart` + `app_localizations_zh.dart`, `l10n.yaml` |
| Flutter/Rust bridge | `chanora_bridge` crate (2152-line `api.rs`), generated `frb_generated.rs`, Dart side generated; file transfer API surface added |
| Protocol adapter | `chanora_protocol` — `tsclientlib` isolated behind `ProtocolClient`, typed DTOs, `ProtocolError` catalogue; poke notification strength classification added |
| Connection lifecycle | `chanora_core` — supervisor task, exponential backoff reconnect (1s→60s), user-disconnect suppresses reconnect; core split into focused internal modules (`events.rs`, `network_diagnostics.rs`); poke strength event propagation; bounded disconnect shutdown |
| State sync reducer unit | `chanora_state` — `ConnectionState`, `channel_join`, snapshot/delta reducers, reconnect handling, deterministic ordering, malformed duplicate normalization, channel-delete/client cleanup, and reducer unit tests. Runtime core integration still uses snapshot/probe refresh paths and remains separate validation work. Event-driven delta stream replaces timer-based polling for live UI updates (`ProtocolDelta` enum). |
| Audio subsystem | `chanora_audio` — Opus encode/decode, HPF/NS/AEC3/AGC2 DSP, PTT backends (Windows/macOS/Linux/focused), iOS VoiceProcessingIO, Android Oboe, jitter buffer via `tsclientlib::audio::AudioHandler`, mixer, mute/deaf gates, release-tail timer, poisoned-mutex recovery, hardened realtime callback paths, and Windows/Linux desktop `VoiceActivity` through Silero ONNX VAD + desktop capture VAD path. macOS lock-free audio event queue and channel-aware render downmix. Apple CoreML Silero VAD scaffolding bundled (product `VoiceActivity` on iOS/macOS remains deferred per DEC-030). Mobile and unverified-platform `VoiceActivity` remain deferred per DEC-030. |
| Push-to-talk | Per-platform backends: Windows Raw Input + hook fallback (modernized), macOS Event Tap, Linux freedesktop portal, focused fallback; `PttCapabilityLevel` (L0–L3); missed-key-up watchdog; release-touch PTT fix; hard-mute owners service (`hard_mute_owners.dart`) |
| Voice controls UI | `voice_bar`, `voice_compact`, `voice_haptics`, `voice_level_meter` (30 Hz real-time mic input), `voice_platform`, `voice_status_summary`, `ptt_capability_badge`, `talk_power_warning` |
| Storage (non-secret) | `chanora_storage` — `BookmarkRepository` (SQLite/rusqlite bundled, schema v2), ChaCha20-Poly1305 encrypted passwords |
| Blob cache | `chanora_cache` — content-addressed blob cache for avatar/icon files, backed by `cacache` (crash-safe, integrity-verified), `av_<md5>`/`ic_<crc32>` key mapping, size-based eviction, separate from persistent storage |
| File transfer | Avatar/icon download wired through bridge (`api.rs` file transfer surface), `chanora_cache` for blob storage, FRB regenerated for file transfer API |
| Storage (secrets) | `IdentityFileStore` with platform keyring (Linux Secret Service, macOS Keychain, Windows Credential Manager, iOS Keychain); file fallback with 0600 perms |
| Diagnostics | `chanora_diagnostics` — `Redactor` (IP/host/email/token/path/secret scrubbing), `InMemoryLogSink`, `DiagnosticExport` JSON bundle, `KnownSecretRegistry`, panic hook |
| Server address resolution | `chanora_resolver` — SRV/TSDNS/DNS fallback |
| Server prefetch | `chanora_prefetch` crate + `prefetch_debouncer.dart` — invisible host-field prefetch, TTL cache, generation-safe |
| Poke notifications | Protocol-level poke strength classification, bridge `poke_strength` exposure to Flutter, `poke_notification_service.dart`, `poke_preferences_service.dart`, `poke_notification_settings.dart` (l10n en + zh), local notification plugin integration (Android + Apple), empty poke message support |
| Android platform | `android_voice_unit.rs`, `android_permissions_service.dart`, `MODE_IN_COMMUNICATION` routing, foreground service (`flutter_foreground_task`), per-ABI APK splitting |
| iOS platform | `ios_voice_unit.rs`, `ios_raw_unit.rs`, `ios_permissions_service.dart`, `ios_audio_session_controller.dart`, `AVAudioSession` integration, `audio_session` package, WebRTC VAD on iOS capture path |
| macOS platform | `macos_permissions_service.dart` (Input Monitoring, Local Network, Notifications), lock-free audio event queue, channel-aware render downmix, audio lifecycle MethodChannel, Local Network permission denial detection |
| Permission UX | `permission_state_banner.dart`, pre-request explainers |
| Adaptive layout | 3-panel adaptive layout with compact/medium/expanded breakpoints, chat panel switching, gesture-isolated PTT row on mobile |
| Bookmark UI | Save/connect/delete in `connect_widgets.dart` |
| Channel join | Tap-to-join with optional password, `channel_join_error_mapper.dart`, `channel_spacer.dart` |
| Chat | `chat_views.dart`, `chat_panel.dart`, BBCode rendering (`bbcode_text.dart`), per-user volume controls (`#17`), event-driven client info parity |
| Audio settings UI | `voice_settings.dart`, `voice_settings_controls.dart`, `audio_processing_config_state.dart`, `audio_device_list_tile.dart`, `audio_output_tile.dart` |
| Audio debug stats | `audio_debug_stats_panel.dart` |
| TS3 server link | `ts3_server_link.dart` — `ts3server://` URI parsing |
| UI preferences | `ui_preferences_service.dart`, `shared_preferences` |
| Connection phase state | `connection_phase_state.dart` |
| Snapshot state mapper | `snapshot_state_mapper.dart` |
| Back intent (Android) | `back_intent_policy.dart`, `back_intent_service.dart` |
| Audio lifecycle | `audio_lifecycle_service.dart` |
| Link trust | `link_trust_service.dart` |
| About dialog | Non-affiliation statement, dual-license declaration, NOTICE pointer |
| CI | GitHub Actions on every push |
| Workspace compiles | Host Rust workspace evidence shows all 10 crates build cleanly; Android target compilation remains blocked locally as noted below. |
| Shared UI utilities | `app_snack_bar.dart` — consistent error/info feedback styling |

### Partial / Scaffold Only

| Area | Gap |
|---|---|
| Event replay tooling | Reducer tests cover the state-sync contract, but standalone replay-file tooling remains a P1 verification gap. |
| Reducer runtime integration evidence | The standalone reducer is unit-tested, but `chanora_core` still refreshes UI state through snapshot/probe paths rather than folding all live protocol events through `chanora_state::reduce`. Live event-driven deltas (client join/leave/move/update, channel add/remove/update) now flow through `ProtocolDelta` enum for instant UI updates, but this is a separate path from the full reducer integration. |
| Mobile/macOS VoiceActivity | `assets/models/silero_vad.onnx` is bundled and used by the desktop VAD path where runtime evidence supports it; Apple CoreML Silero VAD scaffolding is bundled for iOS/macOS when the private `silero-coreml` SwiftPM package is available; mobile, macOS, and unverified-platform product `TransmitMode::VoiceActivity` remain disabled/deferred until a later baseline supplies backend enablement and verification evidence per DEC-030. |
| macOS build | Source-buildable only; no public release artifact is approved. |
| Windows build | Source-buildable only; no public release artifact is approved. |
| iOS build | Source-buildable/unsigned validation only; no TestFlight/App Store release artifact is approved. |

### Not Done (P0 blockers remaining)

| Item | Status |
|---|---|
| DEC-012 legal/trademark/OSS review | Explicitly open. Public release is blocked. |
| Android Keystore-backed DEK | Deferred to v1.1. Android still uses file-fallback for the Data Encryption Key. |
| Android target compile/install/smoke evidence | Blocked locally until the Android NDK compiler `aarch64-linux-android-clang` is available and `adb devices -l` shows an authorized device or emulator. |
| iOS `AVAudioSession.Mode.voiceChat` | Implemented in `apps/chanora_flutter/ios/Runner/AppDelegate.swift` with call-scoped activation (idle `.ambient` baseline; VoIP `.playAndRecord` + `.voiceChat` + `.mixWithOthers` engaged only on `BridgeEvent::AudioStarted` via `chanora/ios_audio_session` MethodChannel). iOS audio session controller (`ios_audio_session_controller.dart`) manages lifecycle. Release readiness still requires device audio validation and candidate evidence attachment. |
| Candidate state-sync evidence attachment | Reducer tests exist and pass locally; release readiness still needs candidate CI/run IDs and runtime integration evidence attached before public release approval. |

---

## P1 / Beta

### Done (promoted from Beta work)

| Area | Evidence |
|---|---|
| Diagnostics export UI | Diagnostics dialog in `main.dart`, `share_plus` for export |
| Reconnect banner | Referenced in CHANGELOG v0.4 |
| Identity persistence | `IdentityFileStore` shipped |
| Audio loopback/processing test hooks | `compare_baseline.rs`, `emit_baseline.rs` examples; `ptt_privacy.rs`, `linux_portal_smoke.rs` tests |
| Opus codec benchmarks | `benches/opus_codec.rs`, `benches/resampler.rs`, `benches/realtime_capture.rs` |
| Audio processing backend abstraction | `processor/mod.rs` with `sonora`, `webrtc_apm`, `noop` backends |
| Per-user mute | SRS-074 implemented in audio gate |
| Per-user volume | Per-user volume controls UI wired (`#17`), persistence and full mixer integration remain follow-up work |
| Protocol adapter isolation | SRS-053 trait boundary in place |
| Adaptive layout | 3-panel adaptive layout with compact/medium/expanded breakpoints (SRS-151 implemented), chat panel switching |

### Not Done (P1 backlog)

| Item | Notes |
|---|---|
| Per-user volume (SRS-075) | UI wired (`#17`); persistence and full mixer integration remain follow-up work |
| Recent servers persistence (SRS-085) | Not confirmed in storage crate |
| UI settings persistence (SRS-087) | Implemented for current P1 scope using `shared_preferences`: host, nickname, permission explanation flag, and theme mode (`system` / `light` / `dark`). SQLite-backed UI settings remain a future hardening option if multi-profile or transactional settings are introduced. |
| Event replay tool (SRS-061, SRS-098) | No replay infrastructure found |
| Network diagnostics (SRS-100) | Core tracks connect/disconnect counts and last-loss reasons in `network_diagnostics.rs`; export/integration evidence still needs release-candidate attachment |
| Side navigation rail for medium layout (SRS-153) | Adaptive layout supports compact/medium/expanded breakpoints; dedicated side navigation rail not confirmed |
| Keyboard focus traversal (SRS-160) | Not confirmed |
| Android audio focus / BT route changes (SRS-112) | Partial — `MODE_IN_COMMUNICATION` done; full focus/BT handling not confirmed |
| Windows installer packaging (SRS-116) | Not in rc.1 artifacts |
| Linux packaging (AppImage/Flatpak/deb/rpm) (SRS-118) | Not confirmed |
| Android AAB release build pipeline (SDD-109) | Referenced but not confirmed as CI-automated |
| iOS TestFlight/App Store build pipeline (SRS-120) | Deferred |
| Light/dark theme toggle (SAD-043) | Theme mode persisted (`system` / `light` / `dark` via `shared_preferences`); dedicated toggle UI confirmation needed |
| Audio device hot-plug recovery (SRS-082) | Noted as follow-up work in `chanora_audio/src/lib.rs` |

---

## P2 / Production

### Not Done (all P2 items pending)

| Item | Notes |
|---|---|
| DEC-012 legal sign-off | Hard blocker for public release |
| macOS signed + notarized builds (SRS-117) | Requires macOS build host |
| C4 architecture views in SAD (SAD-046) | Documentation artifact |
| ADRs for significant decisions (SAD-047) | Documentation artifact |
| Architecture glossary (SAD-055, SDD-063) | Documentation artifact |
| Staged rollout plan | `staged-release-plan.md` referenced but not confirmed complete |
| Bidirectional text (SRS-175) | Deferred |
| Expanded layout persistent side panes (SRS-154) | Deferred |

---

## SOP (Standing Operating Procedures)

### In Place

- Agent router + phase spec docs (in git history, currently untracked/renamed)
- `phase_index.json` machine-readable requirement index
- Conventional Commits style enforced
- Privacy/security gates documented (`SOP_AGENT_OPERATIONS.md`)
- Traceability chain: SysRS → SysDes → SRS → SAD → SDD
- `SECURITY.md`, `CONTRIBUTING.md`, `NOTICE`, dual-license files present

### Needs Attention

- Docs reorganization is largely complete. `docs/srs.md`, `docs/sysdes.md`, `docs/sysrs.md` are in the working tree. The agent spec docs have been superseded by the current document hierarchy.

---

## Summary

```
P0 / MVP:   ~90% done. Core product works end-to-end (connect, voice, chat,
            bookmarks, storage, diagnostics, poke notifications, file transfer/
            avatar download, event-driven UI, adaptive layout, per-user volume
            UI). Main blockers: DEC-012 legal review (hard gate), Android
            Keystore DEK, iOS voiceChat evidence, and candidate evidence
            attachment.

P1 / Beta:  ~50% done. Audio processing backend, diagnostics export,
            loopback tests, per-user volume UI, adaptive layout are in.
            Per-user volume persistence/mixer wiring, event replay, network
            diagnostics export, packaging pipelines, and several UI hardening
            items remain.

P2 / Prod:  ~5% done. Blocked on P0 legal gate. Documentation artifacts
            (C4 views, ADRs, glossary) and production signing pipelines
            not started.

SOP:        Docs reorganized and in working tree. Traceability chain intact.
```