# Mobile companion — Expo notes (stub)

Extreme Cyber Security Test may ship a **light** Expo / React Native companion for enroll + heartbeat + coarse inventory. This is **not** a spyware app and **not** a full MDM.

## Scope

| Allowed | Not allowed |
|---------|-------------|
| Paste / deep-link activation token | Accessibility keyloggers |
| Enroll + heartbeat + hashed install id | Silent screen / mic / camera capture |
| Show last sync status in-app | Remote shell / arbitrary code push |
| MDM AppConfig injection of token | Covert location tracking |

## Suggested Expo app shape

```
apps/extreme-agent-mobile/
  app.json          # name: Extreme Agent, icon from public/brand/extreme-logo-circle.jpg
  app/(enroll)/     # token paste + cloud URL
  app/(status)/     # last heartbeat
  src/api/          # vendor agents/mobile client
```

Bootstrap (when productizing):

```bash
npx create-expo-app@latest extreme-agent-mobile -t blank-typescript
# copy agents/mobile/src client; set EXTREME_CLOUD_URL
# app icon: media/brand/extreme-logo-circle.jpg
```

## Store review posture

App Store / Play listings must describe **organization device enrollment** only. Do not claim silent monitoring. Prefer **MDM / managed distribution** for enterprise fleets (see `mdm-companion.md`).

## Protocol

Same as desktop: `POST /api/v1/agents/{enroll,heartbeat,fingerprint}` with header `x-extreme-agent-protocol: 1.0.0`.