spike/cfe-app

SG-1→SG-2 dependency assumes static analysis reliably detects runtime cert pinning

.branch/scope.md

jadx/apktool can miss OkHttp CertificatePinner and server-side Play Integrity. A false negative from SG-1 causes the researcher to skip Frida unpin, resulting in a failed MITM with no clear diagnosis. SG-2 should always prepare the unpin script regardless of SG-1's verdict — treat pinning detection as advisory, not a gate.

Attestation blocker confirmed in SG-2 has no partial-verdict path — SG-3/SG-4 would stall

.branch/scope.md

If Play Integrity is a hard server-side gate, the scope provides no guidance. Add a conditional: attestation confirmed → document partial auth contract, proceed directly to SG-4 with 'reject' verdict. Don't let SG-2 be a dead end.

Verification-challenge success criterion requires negative testing (field omission), not just happy-path capture

.branch/scope.md

CFE's backend may return opaque 400 errors leaving required fields underdetermined from happy-path alone. SG-3 should explicitly require at least one 'field omitted' experiment per candidate required field.

Imperva description outdated — browser-mode Lambda is primary path, not proxy pool

.branch/scope.md

scope.md frames proxy pool as active path; cfe-pipeline.md documents browser-mode (stealth Chromium on Lambda's own AWS IP) as primary. SG-4 feasibility comparison should benchmark against browser-mode Lambda clearance.

Rounding variant count '≥6' inconsistent with internal documentation

.branch/scope.md

The actual scraper produces 6 format variants × 2 bills (último + penúltimo) = up to 12 candidates. cfe-pipeline.md says '8 format variants'. Minor inaccuracy but should not propagate into findings.html.

SG-5 PoC depends on SG-3 but should also require a SG-4 adopt verdict

.branch/scope.md

If SG-4 concludes 'reject', the PoC is wasted work. Change dependency to 'SG-3 + SG-4 (adopt/partial)'.

Legal exposure — decompiling app and bypassing TLS pinning without prior legal sign-off

.branch/scope.md

Circumventing TLS cert pinning with Frida is a TPM bypass under DMCA §1201 and Mexico's LFDA Art. 112. Require explicit legal sign-off BEFORE any decompilation or traffic interception — not as a post-hoc finding in the feasibility report.

CFE Contigo ToS likely prohibits automated API access — civil liability risk not flagged

.branch/scope.md

Using a captured mobile API contract for programmatic access almost certainly violates CFE's ToS, creating civil liability and account-suspension risk. Currently described only as 'fragility risk'. Require explicit business sign-off before the SG-5 PoC executes.

Captured credentials / session tokens in SG-2 flow dump — no commit prohibition specified

.branch/scope.md

The user hands back a raw login+add-service dump containing session tokens and CFE credentials. No prohibition on committing the dump, no .gitignore entries, no secrets-scanning gate. A committed token is permanently in git history. Add as first output of SG-1.

PoC script credential handling unspecified — risk of hardcoded or logged secrets

.branch/scope.md

poc-add-service.ts has no mandate for env-var-only credentials, no token-logging prohibition, no .gitignore for local credential files. Throwaway scripts frequently survive into production or are committed with embedded secrets.

Frida cert-unpinning script in repo is a reusable offensive tool

.branch/scope.md

frida-unpin.js targeting CFE Contigo works against any app sharing the same pinning implementation. Must be .gitignored or marked spike-only — must not appear on main.

Discovered hardcoded APK keys — no commit-redaction or responsible-disclosure policy

.branch/scope.md

SG-1 extracts 'hardcoded keys' but no policy: (a) no committing key material in plaintext; (b) responsible disclosure to CFE if a live credential is found; (c) prohibition on using a discovered key to authenticate outside the app (Mexico's Código Penal Federal Art. 211bis).

Opportunistic bill/payment endpoint capture broadens PII footprint beyond add-service scope

.branch/scope.md

MITM session captures all app traffic. 'Opportunistic' means capturing account balance, payment history, personal billing data. Tighten: only add-service-flow endpoints documented; others discarded before storage.

mitmproxy addon intercepts PII with no data-minimization or retention policy (LFPDPPP)

.branch/scope.md

Mexico's LFPDPPP requires data not retained beyond its purpose. Specify: addon writes minimum fields only (not raw credential values); capture files not committed; deleted after contract extraction.

No .gitignore or pre-commit secrets scan planned for spike artifacts

.branch/scope.md

.gitignore for capture artifacts (*.har, *.pcap, *.env) and a secrets-scanning pre-commit hook (trufflehog / gitleaks) should be SG-1's first output.

[[feedback_deliverables_as_html]] and [[feedback_ask_before_new_branch]] are session-local memory links

.branch/scope.md

These double-bracket references appear nowhere else in the codebase and will not resolve when scope.md is read by another agent or reviewer. Replace with prose descriptions or direct quotations.

Extra 'Background' section not in scope.md template

.branch/scope.md

The canonical template does not include a Background section between Goal and Success Criteria. Minor deviation — useful context but breaks prescribed section order.

Provisioning commit co-author tag uses non-existent model 'Claude Opus 4.8'

Commit e4824e95 uses 'Co-Authored-By: Claude Opus 4.8 (1M context)'. Claude Opus 4.8 does not exist as a published model. Minor cosmetic inconsistency.

Feasibility verdict criteria are qualitative — no measurable thresholds

.branch/scope.md

Add a rubric: e.g. 'adopt if add-service requires ≤1 caller-supplied field vs the current 2'. Would make the verdict independently verifiable and reduce reviewer variance.

PoC script has no defined acceptance check

.branch/scope.md

SG-5 'proving the contract holds' specifies no assertion (e.g. HTTP 200 + RPU appears in account). A minimal check would make the stretch PoC conclusive rather than anecdotal.

No SG-0 desk-research pass before committing to APK acquisition and on-device capture

.branch/scope.md

Before touching a device: (1) crt.sh query for %.cfe.mx subdomains; (2) Wayback CDX on known CFE hosts; (3) GitHub/VirusTotal for existing mitmproxy captures; (4) confirm current CFE app package ID. If an existing capture exists, SG-2 collapses to a verification step. Add SG-0 (≤2h cap) gating SG-1.

SG-2 user handoff underdocumented for Android-device-unavailable case

.branch/scope.md

The runbook Claude promises to ship should specify: required Android API level + root access method (rooted AVD + Magisk); recommended emulator; explicit decision branch if Play Integrity blocks the emulator. 'An emulator or the user's device' is insufficient.

iOS fallback has no concrete plan or stopping condition

.branch/scope.md

'iOS to confirm' has no capture plan, no trigger condition, and no failure mode (App Attest is at least as strong as Play Integrity). Define: iOS is optional confirmation only; if Android fully blocked, close with 'reject' — no iOS step.

api-contract.md as prose markdown is less reproducible than HAR + OpenAPI YAML

.branch/scope.md

mitmproxy has a built-in HAR exporter. Recommend: addon writes HAR file directly; api-contract.md generated from/alongside the HAR rather than hand-typed prose. Machine-readable contract is directly importable into Insomnia/Postman for SG-5.

SG-4 adopt/reject criteria need measurable thresholds

.branch/scope.md

Add decision matrix: 'adopt if ≤2 verification fields and no unbypassable attestation'; 'partial-adopt if login cleaner but add-service still needs serviceName'; 'reject if attestation required OR rate limit <20 req/hr OR explicit ToS prohibition'. Without thresholds, two reviewers reading the same captures could reach opposite verdicts.

SG-N reject path needs structured template — reason + evidence + revisit-condition

.branch/scope.md

If verdict is 'reject', 'record why' is too vague. Add structured rejection template so negative result doesn't get re-litigated. E.g., 'reject: Play Integrity required; revisit if CFE removes attestation requirement.'

Spike has no time-box — could expand unboundedly on a moving target

.branch/scope.md

Recommend per-SG limits: SG-0 ≤2h, SG-1 ≤4h, SG-2 ≤1 day (Claude side), SG-3 ≤2h, SG-4 ≤2h, SG-5 ≤4h. Total ~2-3 working days. Makes progress visible and provides a natural kill condition.

decompile-notes.md should live in docs/spikes/ not scripts/

.branch/scope.md

decompile-notes.md is research output, not executable tooling. Move to docs/spikes/cfe-mobile-app/decompile-notes.md alongside findings.html and api-contract.md. scripts/ should contain only runnable artifacts.