HUE-053 — Implement secure phone notifications, redacted deep links and delivery diagnostics
Canonical source:
docs/roadmap/issues.json·HUE-053Specification status:
TBI· Readiness:agent:blocked
Alert the user on an authorized phone when long work finishes or needs attention without exposing sensitive HUE content or weakening approval policy.
- Implement the phone gateway and mobile attention surface selected by HUE-051
- Register, authorize, test and revoke devices/endpoints using vault-backed credentials
- Render generic/title/redacted-summary payloads under global and Space privacy policy
- Implement authenticated deep links that re-fetch canonical task, approval or recovery state
- Add durable queue, bounded retry, expiry, acknowledgement mapping, fallback and endpoint health
- Add safe reminder/escalation behavior for unread blocking attention
Acceptance criteria
Section titled “Acceptance criteria”- An opt-in phone receives a redacted verified-completion alert and opens the current evidence-backed completion card
- Sensitive/local-only Space policy prevents title, content, paths and artifacts from leaving the host
- Offline queue, restart, duplicate provider responses, token revocation and gateway outage tests pass
- Provider accepted, delivered/displayed when supported, read and acted remain separate states
- Consequential approvals require the authenticated HUE attention surface and cannot be granted blindly from a third-party channel
- Phone delivery is optional; local notification history and desktop/sound behavior work without a HUE-operated account
Dependencies
Section titled “Dependencies”HUE-032HUE-033HUE-041HUE-051HUE-052
Non-goals
Section titled “Non-goals”- Full mobile workspace parity
- Content-rich lock-screen notifications by default
- Mandatory hosted HUE account
Product contract
Section titled “Product contract”docs/10-security-privacy-trust.mddocs/12-deployment-operations.mddocs/16-notifications-attention-delivery.md
Implementation handoff requirements
Section titled “Implementation handoff requirements”- Preserve the documented security, project, memory and event boundaries.
- Add or update automated tests for every observable acceptance criterion.
- Provide real verification output; do not rely on a worker/agent self-report.
- Update only the exact documentation sections whose status changed.
- Include screenshots or a recording for user-interface changes.
- Include migration, rollback and recovery notes for data/state changes.
- Link the pull request to this issue with
Closes #<issue-number>.