Developer Preview 0.3.0.dev2: This page documents the unchanged SDK 0.2.0 base contract. For the unified adapter, optional simulated motion and current installation commands, use the current quickstart and bundled docs. No real hardware or production integration is enabled.

Security, consent, retention and recipients

Trust boundary

The kit supplies only bounded public data contracts and reviewed synthetic examples. It never authenticates a real manufacturer, creates credentials, registers a device in production or supplies the private application/Core. The authenticated host, outside this kit, owns user/session identity, exact operation authority, consent, revocation, connection freshness, policy, recipient selection and result release. Never pass those objects, private memory, history, grants or tokens to an adapter.

Use strict request and response validation at both ends. Recheck capability, route, recipient, session validity and consent before dispatch and before releasing a result. A syntactically valid manifest, a synthetic_only flag and a local pass are never authority. Treat device and manufacturer responses as untrusted. Reject unknown fields, routing changes, wrong invocation/version, raw errors and unexpected media lengths. Host authority may deny any valid request.

Capture and disclosure

Microphone, camera, sensors and recording need explicit capability-specific consent and native OS permission in any future real integration. State purpose, data, recipient, duration and revocation behavior before capture. Speaker output needs selected-device authority and responder arbitration. Controls/status/connectivity need their exact capability/recipient permission too. An app permission is not cloud permission. Route recipient labels must be mapped to a reviewed actual recipient by the host before real use; labels in the kit do not contact anyone.

No route contacts a manufacturer cloud in this release. manufacturer_cloud exists only as a synthetic route label. Do not add implicit cloud fallback. A future cloud path requires disclosed destination/operator, region, purpose, data categories, retention, legal terms, transport authentication and separate authorization. No such integration is approved here.

Retention

All media is generated in memory, synthetic and unretained; Recording acknowledgements have retained_bytes=0. Reports contain test IDs, status, public manifest fingerprints and synthetic observations, never raw captures. A host recording flag is not evidence of deleting real media. Future storage needs a bounded approved lifetime, access controls, recipient list, deletion/expiry evidence and revocation tests. The external host must keep recording/capture consent off until explicitly granted. Do not paste actual voices, faces, tokens, personal profiles or private history into evidence.

Process isolation limits

These tools execute Python code locally and do not provide an OS security sandbox. They cannot contain malicious code or restrict its filesystem and network access. Isolated Python mode is not a security boundary. Use only reviewed synthetic code. Do not execute malicious, unreviewed or proprietary vendor binaries with this harness. Real code needs separate independent sandbox/security design and review. This phase adds no OS sandbox infrastructure.

Negative cases

Exercise duplicate JSON keys, over-limit input/output, unknown fields/operations, raw errors, altered route/recipient, stale invocation/version, revoked/expired authority, missing capture consent, denied cloud path, driver failure, busy media resource, lost link, timeouts, late callbacks, duplicate submit, close/reopen and changed firmware/manifest. Report ambiguous execution as unknown/no replay. Do not retry physical actions merely because a response was lost. Physical/security cases require observed evidence; a mock result cannot satisfy them.