Provisioning Target

Golden Phone Reference Specification

Canonical read-only fingerprint of the fully operational PagePoint reference handset.

Capture Rules

The Golden Phone is a reference artifact, not a test target. This capture was read-only. No settings were changed, no packages were installed or removed, no permissions were altered, and no repairs were attempted.

Capture Date	2026-07-12
Capture Bundle	`ppsm/data/provisioning/golden-phone/golden-phone-20260712T220714Z-3112SH2010130064`
ADB Serial	`3112SH2010130064`
PPSM Health Result	PASS
PPOE App Socket	Connected at `192.168.50.109`, role `Manager`, battery `76`

Hardware Identity

Manufacturer	Ulefone
Model	Armor X12
Product/Device	`Armor_X12`
SoC	Mediatek MT8766B / MT6761 platform
Android	Android 13, SDK 33
Security Patch	2025-11-05
Build Display	`P1TFS23A7.GQU.Ulefone.HB.HJ.ABAMYBS8S2VH.20251124.V3.06`
Build Fingerprint	`Ulefone/Armor_X12/Armor_X12:13/TP1A.220624.014/1763983462:user/release-keys`
Kernel	`Linux 4.19.191 #1 SMP PREEMPT Mon Nov 24 19:25:36 CST 2025 armv7l`
Verified Boot	Bootloader locked, verified boot green, verity enforcing
Device Name	Armor X12
Bluetooth MAC	`DA:32:46:81:72:E1`
Wi-Fi MAC	Android reports randomized network MAC `c6:dd:08:81:49:6d`. Hardware MAC was not readable through normal shell access.
Battery	76% observed, USB powered, Android battery health code 2, nominal capacity property 4860 mAh
Storage	23 GB reported, 8.4 GB used, 15 GB available
Display	720 x 1440, 60 Hz, 320 dpi

Device Policy And Kiosk

Device Owner is configured: com.example.pagepointaudiotest/.PagePointDeviceAdminReceiver.
DevicePolicyManager reports the phone as organization owned, user 0, setup complete.
Lock task mode is active: mLockTaskModeState=LOCKED.
Allowed lock task package is com.example.pagepointaudiotest.
Foreground activity is com.example.pagepointaudiotest/.MainActivity.
System UI is controlled by immersive sticky flags: hide navigation, fullscreen, layout hide navigation, layout fullscreen.
Status bar and navigation bar services exist, but the active PagePoint window controls their visibility.
cmd lock_settings get-disabled reports true. The raw secure setting still reports lockscreen.disabled=0, so health checks should prefer the command result.
HOME launcher remains com.android.launcher3/.Launcher3QuickStepGo; the PagePoint app is not the Android HOME activity.
No accessibility services are enabled.

PagePoint Applications

Package	State	Role	Observed Details
`com.example.pagepointaudiotest`	Enabled, active, Device Owner	Operational Golden Phone app	Version 1.0, versionCode 1, signature token `88ba290f`, RECORD_AUDIO granted, BootReceiver and DeviceAdminReceiver present, WebView sandbox service active.
`com.pagepoint.controller`	Installed but disabled	Newer controller package candidate	Version 1.0, versionCode 1, signature token `8679db1b`, RECORD_AUDIO granted, no active services at capture time.

Important: PPSM was corrected on 2026-07-12 to stage the Golden Phone APK as pagepoint.apk and target com.example.pagepointaudiotest. The disabled com.pagepoint.controller package is no longer the canonical provisioning target.

Network

Wi-Fi is connected to SSID PagePoint.
IP address is 192.168.50.109/24.
Android reports DNS server 192.168.50.2 and gateway 192.168.50.1.
Supplicant state is COMPLETED.
Network selection is NETWORK_SELECTION_ENABLED.
Autojoin is allowed and no no-internet disable condition is present.
PPSM validation spoofing is working: Android reports validatedInternetAccess for the PagePoint network.
Global captive portal detection and mode are disabled: captive_portal_detection_enabled=0, captive_portal_mode=0.

Power Management

Phone was awake during capture: mWakefulness=Awake.
stay_on_while_plugged_in=0; the Golden Phone is not relying on global Android stay-awake.
Screen timeout is 600000 ms.
A SCREEN_BRIGHT_WAKE_LOCK is held through WindowManager for the active PagePoint app UID.
Neither PagePoint package appears in the device idle whitelist.
Device idle and light idle modes were false at capture time.

Relevant Settings

Setting	Value	Use
`adb_enabled`	1	Required for PPSM read/write provisioning after user authorization.
`development_settings_enabled`	1	Required for USB debugging access.
`device_provisioned`	1	Confirms Android setup wizard completed.
`user_setup_complete`	1	Confirms user 0 setup completed.
`wifi_on`	1	Required for PagePoint operations.
`wifi_sleep_policy`	2	Keep Wi-Fi active during sleep policy.
`location_mode`	3	Observed Golden Phone state; future policy decision needed.
`screen_off_timeout`	600000	Display behavior input; app wake lock is also required.

Packages And Services

Total packages: 202.
Third-party packages: 2, both PagePoint-related.
Disabled packages: 3, including com.pagepoint.controller.
Active PagePoint service at capture time: Chromium/WebView sandbox process under com.example.pagepointaudiotest.
Accessibility services: none enabled.

Capability Matrix

Capability	Readable	Writable/Repair Path	Notes
Device identity	ADB `getprop`, `adb devices -l`	Not writable	Required health check.
ADB authorization	`adb devices -l`	User must approve RSA prompt	PPSM can guide but cannot bypass.
Android setup complete	global/secure settings	User completes setup wizard	Required before ADB provisioning.
Wi-Fi state	`dumpsys wifi`, connectivity dumpsys	ADB mutation or user workflow	Can verify SSID, IP, selection status, validation.
Captive portal behavior	global settings, connectivity dumpsys	ADB settings mutation	Required to prevent no-internet disable.
APK install/version	`pm` and package dumpsys	`adb install`	Write path must not touch Golden Phone.
Runtime permissions	package dumpsys/appops	ADB grant or user prompt	RECORD_AUDIO is required.
Device Owner	`dpm list-owners`, device_policy dumpsys	Fresh-device provisioning only	Cannot be safely retrofitted onto an already provisioned phone.
Lock task/kiosk	activity/window/statusbar dumpsys	Device Owner app and allowlist	Required for inescapable operator mode.
Home-screen layout	Partially visible through launcher dumpsys/history	User/launcher-specific or root-only	Do not make this a hard provisioning dependency yet.
Screen awake behavior	power/window/settings dumpsys	App wake lock, settings, or Device Owner policy	Golden state uses app/window wake lock.

Operational PagePoint Phone

Approved model: Ulefone Armor X12.
Android setup complete and user 0 provisioned.
Developer Options and USB debugging enabled.
ADB authorized to the PPSM host when service work is required.
Connected to PagePoint Wi-Fi with network selection enabled, autojoin allowed, and no no-internet disable state.
Visible to PPOE as an active PagePoint phone client with expected role and battery status.
PagePoint operational app in foreground, fullscreen, immersive sticky, and lock task mode.
Device Owner configured for the operational package.
RECORD_AUDIO granted to the operational app.
Boot receiver present so operations recover after restart.
Screen remains awake during operations through app/window wake behavior.

Health Check Targets

Check	Class	Verification
Approved hardware/model/build	Required	ADB identity and build fingerprint.
ADB authorization state	Required for service mode	`adb devices -l`.
Wi-Fi SSID/IP/selection/validation	Required	Wi-Fi and connectivity dumpsys.
PPOE socket presence and role	Required	PPSM status from PPOE health.
Operational app package identity	Required	Package dumpsys and enabled/disabled state.
Device Owner package	Required if kiosk remains Device Owner based	`dpm list-owners`.
Lock task active	Required	ActivityManager lock task state.
RECORD_AUDIO permission	Required	Package dumpsys/appops.
Screen awake behavior	Recommended	Power and window dumpsys.
Package signatures	Recommended	Package dumpsys signature token.
Battery level/health/storage	Recommended	Battery and storage inspection.
Home-screen icon layout	Informational	Launcher state is OEM-specific and partially visible.

State Persistence

Survives reboot: Device Owner, lock task allowlist, enabled/disabled package state, permissions, Wi-Fi saved network, captive portal settings, and app data, assuming the boot receiver/app relaunches correctly.
Does not survive factory reset: ADB authorization, installed PagePoint apps, Device Owner, Wi-Fi configuration, runtime permissions, launcher layout, and app data.
Survives app reinstall only if package name/signature and Device Owner constraints are preserved. Reinstalling the active Device Owner package is risky and should be treated as a repair workflow, not a casual update.
APK upgrade requires stable package identity and signing. The current Golden Phone shows a package-identity split that must be resolved before automated upgrades.

Unexpected Findings

The Golden Phone is operational through com.example.pagepointaudiotest, not the newer com.pagepoint.controller package.
com.pagepoint.controller is installed but disabled on the Golden Phone.
Device Owner is already configured and is central to kiosk behavior.
Screen-on behavior is coming from the foreground PagePoint window/wake lock, not the global stay-awake setting.
The isolated PagePoint network is reported as validated by Android, confirming the validation responder/spoofing strategy works on this phone.
Some properties show Android 12 boot/vendor partitions while the product build is Android 13; health checks should use product build identity and fingerprint.

Next Engineering Work

Define Device Owner provisioning strategy for factory-reset Armor X12 phones.
Update the PPSM provisioning wizard to establish the com.example.pagepointaudiotest Device Owner and lock task state.
Add Golden Phone comparison checks to PPSM health reporting without mutating phones.
Keep this reference current whenever the designated Golden Phone intentionally changes.