# Business rules — ear_android_app Evidence date: 2026-10-16. Source: `git@bitbucket.org:overdrive/ear_android_app.git`, `master` at `5c15b03` (2023-03-10, "eAr app POC"). No business-rules document exists in the source repository or in Silicon Ark. The application has no domain model, no local validation, and no role checks. Rules below are only behaviours that the code actually enforces or hardcodes. Each one is marked **Inferred** when the code does not say it is a business policy. Do not treat template Gradle flags (minify off, SDK levels, unused `constraintlayout`) as business rules. Those are in `technical-documentation.md`. ## BR-001 — The app opens one fixed page **Inferred** from implementation. **Requires Confirmation** that this is an approved rule rather than a POC shortcut. The only URL in application code is `https://www.ear-academy.com/home/login`. - Who: `MainActivity`, on every create. - Trigger: `onCreate`. - Input: a string literal. The user cannot choose another start URL in the app. No settings screen exists. - Behaviour: `WebView.loadUrl` is called with that string. - The path is specifically `/home/login`, not the site root. - Evidence: `app/src/main/java/com/example/ear/MainActivity.java`. - Confidence: High that the code does this. Low that a written policy chose this path, because no policy text exists. The website's own login rules (password policy, trial length, subscriptions) are not in this repository. `silicon_ark/ear_lambdas/` names other paths on the same host (`/admin/run_cron_daily/...`). This app does not call them. Those rules are not rules of `ear_android_app`. ## BR-002 — There is no local account **Inferred** from absence. The app does not collect, store, or validate an email, password, token, or role. - No login form in `activity_main.xml`. - No `SharedPreferences`, database, or `AccountManager` usage. - No authentication library in `app/build.gradle`. - Evidence: `MainActivity.java`, `activity_main.xml`, `app/build.gradle`. - Consequence: any session belongs to the website inside the WebView, if the page creates one. Whether that is intended is **Unknown / Requires Confirmation**. ## BR-003 — Web content may run JavaScript and use DOM storage **Implemented** as two settings calls. **Inferred** as a product rule. **Requires Confirmation.** After the URL load is started, the activity enables JavaScript and DOM storage. It does not expose a Java object to JavaScript. - Evidence: `MainActivity.java`. `proguard-rules.pro` keeps the JavaScript-interface sample commented out. - The code does not explain why these two flags are on and every other `WebSettings` flag is left default. - Timing: both calls happen after `loadUrl`. See PRD WF-1. ## BR-004 — Navigations are not limited to the Ear Academy host **Inferred** from absence of a check. Nothing in `MainActivity` compares a URL with `www.ear-academy.com` before allowing it. The installed client is `new WebViewClient()` with no `shouldOverrideUrlLoading`. - Evidence: `MainActivity.java`. - **Requires Confirmation** whether leaving the host, or opening a non-https link, should be blocked. ## BR-005 — The app does not keep its own place in the site **Inferred.** `onCreate` always loads the login URL. It does not restore WebView back-forward state. It does not implement back as `goBack`. - Evidence: `MainActivity.java` (only `onCreate`); manifest activity has no `configChanges` and no custom launch mode. - **Requires Confirmation** whether returning users should land on `/home/login` even when they already moved elsewhere in the site. ## BR-006 — Identity shown to the user is "eAr" **Implemented** string. **Inferred** that the trading or product name is eAr. - Launcher label: `eAr` (`strings.xml`). - Gradle project name: `eAr` (`settings.gradle`). - Theme style name: `Theme.EAr`. - Package and `applicationId`: `com.example.ear`. The package uses the Android Studio `com.example` prefix. Provenance: **Inferred** that this id is a sample id, not a published brand id. **Requires Confirmation** before anyone treats `com.example.ear` as the production application id. ## BR-007 — No role-based access in the app **Inferred** from absence. The manifest has one activity and no `android:permission` on it. There is no admin entry, no feature flag, and no build flavor that hides behaviour. Every launcher user gets the same URL. ## BR-008 — Backup of app data is allowed, with no custom include list **Implemented** manifest flags. Whether backup should include WebView cookies or site data is **Unknown / Requires Confirmation**. - `android:allowBackup="true"`. - `fullBackupContent` and `dataExtractionRules` point at sample XML files whose include/exclude entries are comments. - Evidence: `AndroidManifest.xml`, `xml/backup_rules.xml`, `xml/data_extraction_rules.xml`. - The sample comment in `data_extraction_rules.xml` is not an approved rule. ## Rules that were not found | Looked for | Result | |---|---| | Password, email, or form validation | Not in this repo. Would be on the website, if anywhere | | Subscription, trial, or payment rules | Not in this repo. Cron path names exist only in `ear_lambdas`, not here | | Age gate, terms acceptance, or consent | Not in this repo | | Offline use or sync conflict rules | Not in this repo | | Rate limits | Not in this repo | | Entitlements by user role | Not in this repo | | A written rule that the missing `INTERNET` permission is intentional | Not found. The omission is recorded in the PRD as implementation, not as policy | ## Conflicts No earlier business-rules file exists to conflict with the code. The commit message "eAr app POC" and `versionName` `1.0` do not state different business rules. They do leave the release intent unclear. See the PRD discrepancy list.