ios-advanced-parental-controls/docs/ACCEPTANCE.md

Acceptance and verification

Executed in the implementation environment

• Python API tests: 21 passing, including strict validation, inheritance, optimistic revisions, authorization boundaries, cookie-origin checks, session rotation, persistence, code expiry, reward caps, idempotency and concurrent submission.
• Swift PolicyCore tests: 10 passing under Swift 6.2.1 on Linux, including day/DST boundaries, bedtime, zero allowances, monotonic usage observations, cap truncation and exhaustive reachable-bonus threshold coverage.
• JavaScript syntax check; Swift source syntax parsing; YAML/plist/source-path validation.
• Swift networking source type-check against Linux Foundation with a platform import and local error stub. This is not an Apple SDK build.
• Chromium DOM + real backend smoke via an in-process ASGI bridge: login, two children, shared policy, individual override, pairing, graded credit, refreshed dashboard and logout. It does not test deployed browser cookies, TLS or a physical iPhone. Parent session/origin behavior is separately covered by API tests.

Not executed here: XcodeGen project generation, Xcode compile/link/archive/sign/install, Docker build/run, Screen Time authorization, shield appearance/action on hardware, or real DeviceActivity scheduling/counting. Do not mark these as passed based on pure Swift tests.

First build-server pass

• make bootstrap && make test succeeds on the build server.
• make ios-project generates the four-target project.
• Xcode builds with the selected SDK; check all target bundle IDs and App Group entitlements.
• Archive/sign/install using owner-supplied profiles. Verify all extensions are embedded.
• Docker starts with a generated secret and persistent volume; restart retains profiles and awards.
• HTTPS and exact APC_ORIGIN work from parent browser and child phone; no plaintext fallback.

Physical iPhone matrix

Use a dedicated test entertainment app. Start with a small base quota and the minimum five-minute reward, not essential communication apps. Record target OS version and observed callback times; the implementation intentionally does not fake sub-minute accuracy.

• Child Family Sharing account: approve .child authorization, then cancel and retry authorization.
• Pair once; code reuse/expired code fails. Reopening the app does not expose unrestricted selection editing.
• Parent-selected app is actually shielded outside allowed hours. Close on the shield exits correctly.
• Base cumulative usage reaches its threshold and shields the app with Family Quests backgrounded.
• Five correct answers record one credit and unlock further usage time. Wrong answers earn none.
• Putting the phone down does not consume a wall-clock reward; reaching the next usage threshold re-shields.
• Repeated Sync, foreground transitions, retrying submission, duplicate/late callbacks, and relaunches do not refund usage.
• Earning the last partial reward hits the exact cap. Another challenge cannot earn more that day.
• Earn a bonus before base time is exhausted; cumulative accounting remains correct.
• Bedtime shields despite unused/earned allowance. Bonus expires at the family-day boundary.
• Keep the main app closed overnight: the next allowed window restores base only, not yesterday's bonus. Repeat over two offline days.
• Force quit, reboot, lock/unlock and first unlock after reboot: no unexpected clearing or permanent accidental unlock.
• Change policy mid-day (raise/lower base, reward size, cap and allowed hours); prior usage is not incorrectly refunded and obsolete callbacks do not win.
• Change selected apps with a fresh parent code. Verify removed/new apps and cumulative historical usage; selection changes are a known accounting risk.
• Fail monitoring registration / corrupt or make shared state unavailable in a test build: error is visible, no unconditional clearAllSettings recovery.
• Offline backend, connection timeout, low-power mode and stale snapshots: cached limits remain; no unverified credit is minted.
• Change device timezone and clock; verify configured family timezone and check the five-minute foreground skew guard. Offline clock tampering remains a known limitation.
• Two children inherit a shared edit; only the child with an override retains its different value. Pending/error/last-reported status is truthful.
• Parent code expires and loses validity on leaving the setup session. A child cannot point an already-paired app at a replacement server to authorize selection changes.
• Revoke a device: API access stops, cached restrictions remain. Test same-server re-pairing with a new parent-issued code.
• A stricter native Apple App Limit still wins. Do not interpret that as a successful override of Apple's native limit.

Stop conditions

Treat early/late/missing threshold callbacks, double-counted usage, unexpected unlocks, deadlocks during monitor replacement, storage races, inaccessible essential apps or a guardian recovery failure as blockers to real use. Capture diagnostic logs with test profiles rather than real family data. Do not hide these failures behind a green applied label.