Event evidence
Operator guide

Team evidence · noindex

Release notes & requirement changes

What changed in this version, and why?

Release notes & requirement changes

Versioned record of why the Access Control app changed and what shipped. Use this for PM reviews, store release write-ups, and “why did we change that?” debates.

Do not paste JWT secrets, passwords, tokens, or full personal data here.

How we maintain this

  1. When a requirement is accepted, add a row under the next (or current) version section: Requirement → Why → What → Status.
  2. When you bump versionName / versionCode (Android app/build.gradle, iOS marketing version), freeze that section as Released and start a new Unreleased block.
  3. Link related specs under docs/superpowers/specs/ when useful; keep this page short enough to read on the floor.

Current Android baseline: versionName 1.0, versionCode 9.

Unreleased — Client picker (Xporience / Terrapinn) + Home UX

Working title: Multi-client (ADNEC / DMG / Xporience / Terrapinn) and Home declutter
Target: next store / internal build after versionCode 9
Branch context: feat/client-environment-picker (+ follow-up Home UX)

Requirement changes

IDRequirementWhy it changedWhat we didStatus
REQ-015Publish one private Play app for all clientsStop uninstall/reinstall of client-specific apps per eventStore listing com.hindavi.accesscontrolapp; runtime client picker; install docs + temporary old-app uninstall guidance; handoff docs/operator-single-app-setup.md (setup call by 23 Sep 2026)Done (published)
REQ-001Support a third client: XporienceOne app must hit three registration backendsClient picker lists Xporience; host https://reg.xporience.com/v2/scan/api; distinct JWT secretDone (login verified)
REQ-011Support a fourth client: TerrapinnSame multi-backend app for Terrapinn eventsCatalog + picker: terrapinn → https://terrapinn.xporience.com/v2/scan/api; shared JWT secret with ADNEC/DMG; scans tagged client_idDone
REQ-012Always-on / kiosk mode on ZebraScreen must stay on; Home/Back must not leave the app on the floorFLAG_KEEP_SCREEN_ON + Android Lock Task after login only if MDM-allowlisted (avoids Android “swipe up & hold” toast); side menu Pin app / Unpin app (security password + QR). Long-press Online/Offline also unpins. MDM must allowlist package for Lock TaskDone (app); MDM allowlist required for silent pin
REQ-013Dynamic silent mode from loginFloor devices must stay audible unless backend allows silentLogin data.silent_mode; default enforce normal ringer + volumes on open/resume; volume keys restored while app open; silent_mode: true disables enforcement. No MDMDone
REQ-002Per-client JWT signing secretXporience secret differs from ADNEC/DMG/Terrapinn shared secretsecretKey on each client in clients.ts; getSecretKeyFromClientId / getActiveSecretKey() for login, scan, sync, spaceDone
REQ-003Diagnose Xporience login failuresStaff saw HTML 403 then JSON 401Safe client/URL debug helpers; distinguish WAF HTML 403 vs API JSON errorsDone (temporary debug logs should stay gated)
REQ-004Identify mobile traffic to APIsWAF blocked default OkHttp UA on reg.xporience.comUser-Agent: AccessControlApp/1.0 (ReactNative) on shared API() (all clients)Done
REQ-005Declutter Home headerExcel / Send Report / Logout competed with SyncHamburger → slide-over menu with Export Excel, Send Report, Logout; Sync stays on headerDone
REQ-006Clear way to close menuBackdrop-only close was not obviousClose (X) control + tap dimmed areaDone
REQ-007Hamburger matches Sync themingVisual consistency with event themeSame theme background + contrast icon color as SyncDone
REQ-008Stats labels left-alignedLabels looked centeredtextAlign: left on stat titlesDone
REQ-009Card content not top-heavyLarge empty white space under statsDate / space / stats vertically centered in cardDone
REQ-010Sync affordance obviousIcon alone unclear to new staff“Sync” label under sync buttonDone
REQ-014About page from side menuStaff/support need version + client without digging settingsHome sidebar About → screen with version, build, package, platform, device, client, event, spaceDone

Resolved — Xporience login path

WasHTML 403 from host WAF when using default OkHttp User-Agent; later JSON 401 Invalid Data for wrong credentials/env
FixFixed User-Agent: AccessControlApp/1.0 (ReactNative); Xporience baseUrl + distinct secretKey in clients.ts
StatusLogin verified on Xporience. Treat new HTML 403 as infra/WAF (RISK-020). Treat JSON 401 as credentials/payload (backend).

Operator-visible UX (this release)

  • Client select: ADNEC · DMG · Xporience · Terrapinn
  • Home: hamburger menu, Sync + label, centered stats card
  • Menu: Export Excel · Send Report · Pin/Unpin · Enable/Disable Sound Lock (password / QR) · About · Logout
  • Sound: by default device returns to normal ringer/volume when app opens or resumes; login silent_mode: true disables that enforcement; operators can override via side menu with security password

Related internal specs

  • docs/superpowers/specs/2026-08-19-client-environment-picker-design.md
  • docs/superpowers/specs/2026-09-08-terrapinn-client-design.md
  • docs/superpowers/specs/2026-09-08-kiosk-always-on-design.md
  • docs/superpowers/specs/2026-09-04-home-hamburger-sidebar-design.md
  • docs/superpowers/specs/2026-09-04-app-changes-tracker.md (dev tracker; this page is the docs-site source of truth for releases)

Template — next version

Copy when starting a new release:

## Unreleased — <short title>

**Target:** versionName X.Y · versionCode N  
**Date opened:** YYYY-MM-DD

### Requirement changes

| ID | Requirement | Why it changed | What we did | Status |
| --- | --- | --- | --- | --- |
| REQ-0xx | | | | |

### Operator-visible UX

-

### Known issues

-

When shipping, rename the heading to:

## versionName X.Y (versionCode N) — YYYY-MM-DD

and move bullets that did not ship into the new Unreleased section.

Older releases

No prior entries on this page yet. Seed from Play Console / TestFlight notes when useful.