# PAILot App Store Readiness Checklist

Date: 2026-03-25
Source: Security & Code Quality Review

## CRITICAL (Must fix before submission)

- [x] **C1: Remove NSAllowsArbitraryLoads** — ATS bypass, Apple will reject. Use NSAllowsLocalNetworking only *(fixed 2026-03-25)*
- [x] **C2: Add TLS to MQTT** — All conversations and auth token travel in plaintext. Set `client.secure = true`, configure TLS on AIBroker broker *(fixed 2026-03-25 — self-signed cert auto-generated at ~/.aibroker/tls/, onBadCertificate accepts it; TODO: pin cert fingerprint)*
- [x] **C3: Remove debug log files in production** — `mqtt_debug.log` and `_chatLog` write truncated message content to Documents. Wrap in `kDebugMode` or remove entirely *(fixed 2026-03-25)*

## HIGH (Should fix before submission)

- [x] **H1: Unbounded image cache** — `_imageCache` in message_bubble.dart grows without limit. Add LRU eviction (cap at 50) *(fixed 2026-03-25)*
- [x] **H2: Audio temp files never cleaned** — `_base64ToFile` creates .m4a files never deleted. Clean up after playback completes *(fixed 2026-03-25)*
- [x] **H3: TextEditingController leak** — Rename dialog in session_drawer.dart creates controller but never disposes it *(fixed 2026-03-25)*
- [x] **H4: Input validation on settings** — No validation on host IPs, port range, MAC format. Add regex validators *(fixed 2026-03-25)*
- [x] **H5: LifecycleObserver never removed** — AudioService.init() adds observer but dispose() doesn't remove it *(fixed 2026-03-25)*
- [ ] **H6: MQTT token in memory** — Acceptable for personal use, document as known limitation

## MEDIUM (Improve before submission)

- [x] **M1: Subnet scan hammers 254 hosts** — Batched in groups of 20 with early exit *(fixed 2026-03-25)*
- [x] **M2: No loadMore debounce** — Added isLoadingMore guard *(fixed 2026-03-25)*
- [ ] **M3: NavigateNotifier global singleton** — Mutable static, stale reference risk. Move to Riverpod provider
- [ ] **M4: Unbounded _seenSeqs set** — O(n log n) eviction. Use FIFO deque instead
- [ ] **M5: Screenshots bloat iCloud backup** — Store images as files, not base64 in JSON. Or exclude from backup
- [x] **M6: Unused import** — Already removed *(fixed 2026-03-25)*
- [x] **M7: Silent error swallowing** — Added debugPrint on config load failure *(fixed 2026-03-25)*

## LOW (Nice-to-haves)

- [ ] **L1: PrivacyInfo.xcprivacy** — Required since 2024 for UserDefaults and FileTimestamp APIs
- [ ] **L2: Privacy policy URL** — Required for microphone/camera access apps
- [x] **L3: Unused dependencies** — Removed web_socket_channel and wakelock_plus *(fixed 2026-03-25)*
- [x] **L4: Unnecessary _http._tcp** — Removed from NSBonjourServices *(fixed 2026-03-25)*
- [x] **L5: Typing indicator timeout** — Auto-clear after 10s *(fixed 2026-03-25)*
- [ ] **L6: Version number** — Default 1.0.0+1, set correctly before submission
- [ ] **L7: App icon** — Verify meets Apple guidelines (no alpha channel, correct sizes)

## APNs Push Notifications (implemented 2026-04-01)

- [x] **APNs server side** — `src/apns/client.ts` in AIBroker: ApnsClient initialised from APNS_KEY_PATH/APNS_KEY_ID/APNS_TEAM_ID env vars, sandbox by default. Token storage in `~/.aibroker/apns-tokens.json`. `sendPush()` fires when `getMqttClientCount() == 0`.
- [x] **APNs Flutter side** — `lib/services/push_service.dart`: `push` package (3.3.3, no Firebase). Requests permission on app start, publishes token to `pailot/device/token` MQTT topic. Re-registers on reconnect.
- [x] **Entitlements** — `ios/Runner/Runner.entitlements` with `aps-environment=development`. All three build configs have `CODE_SIGN_ENTITLEMENTS` set.
- [x] **UIBackgroundModes** — `remote-notification` added to Info.plist.
- [x] **AppDelegate** — forwards UNUserNotificationCenter delegate methods to push plugin.
- [ ] **Provisioning profile** — APNs requires an explicit provisioning profile from Apple Developer portal that includes Push Notifications capability. Must update in Xcode before deployment. Switch `aps-environment` to `production` in entitlements for App Store builds.

## App Store Requirements

| Requirement | Status | Action |
|------------|--------|--------|
| NSMicrophoneUsageDescription | PASS | - |
| NSCameraUsageDescription | PASS | - |
| NSPhotoLibraryUsageDescription | PASS | - |
| NSLocalNetworkUsageDescription | PASS | - |
| NSBonjourServices | PASS | Fixed - removed _http._tcp |
| NSAppTransportSecurity | PASS | Fixed - removed NSAllowsArbitraryLoads |
| UIBackgroundModes: audio | PASS | - |
| UIBackgroundModes: remote-notification | PASS | Added 2026-04-01 |
| Push Notifications entitlement | PASS | Added Runner.entitlements 2026-04-01 |
| APNs provisioning profile | FAIL | Must update in Xcode / Developer Portal |
| Privacy Policy | FAIL | Fix L2 |
| PrivacyInfo.xcprivacy | FAIL | Fix L1 |
| TLS for network | PASS | Fixed C2 - self-signed cert, onBadCertificate=true |