Establish enforceable collector assurance gates

[JacobLinCool]

Scope narrowed. The Android field-matrix and real-device evidence regime has been
removed from this issue. What remains is the work that a build, a test, or a checked-in
artifact can settle.

Summary

Establish enforceable assurance gates for collector modules.

A collector is trusted code executing inside the participant app. New collectors must demonstrate bounded behavior, lifecycle correctness, and disclosure accuracy before entering the normal build.

Requirements

Static and build-time gates

• Prevent collector modules from introducing:
  • network clients or sockets;
  • direct file, database, or preference access;
  • dynamic loading or downloaded executable content;
  • arbitrary logging;
  • activity launches or undeclared exported components;
  • export, upload, decryption, or cryptographic implementations.
• Enforce each collector's catalog-declared maximumEncodedEventBytes before append.
• Snapshot and review the merged manifest, permissions, components, intent filters, foreground-service types, and module dependency graph.
• Fail CI on undeclared permission/component/dependency changes or catalog/implementation mismatch.
• Add architecture tests that keep collectors behind the existing event sink, clock, access, and lifecycle contracts.

Required collector evidence

Before a collector can ship in the general build, require:

• catalog entry and strict typed schema;
• researcher and participant disclosure in English and Traditional Chinese;
• access-denied and access-revoked behavior;
• start, pause barrier, resume, finish, withdraw, process-recovery, and reboot tests;
• maximum rate/size/quota behavior;
• missing/unsupported hardware behavior;
• threat-model and prohibited-inference review;

Acceptance criteria

• A collector module that imports a forbidden capability or adds an undeclared component/permission fails CI.
• Oversized encoded events are rejected before append with a deterministic bounded audit result.
• Manifest, permission, service-type, and dependency snapshots are reviewed and reproducible.
• Revocation, pause/withdraw, reboot, quota, outbox-recovery, and lifecycle tests exist for every generally enabled collector.
• A collector without all required disclosure, schema, and lifecycle tests cannot enter the normal release build.
• The assurance system sends no production telemetry and requires no remote control plane.

Documentation

Add the collector assurance policy, prohibited-dependency rules, release checklist, and test-data policy.

Dependencies

Blocked by #10, whose catalog supplies collector capabilities, limits, disclosures, schemas, and platform metadata.