public interface EngineContext

The narrow set of framework services lent to a ShieldEngine.

Handed to the engine rather than reached for, so the engine never needs access to the platform implementation object. That keeps the framework’s implementation accessor package-private, and it keeps the list of things an engine can do small enough to review.

Methods

`public abstract` `SecureStorage getSecureStorage()`	Non-prompting secure storage, for the attestation key identifier and cached tokens.
`public abstract` `AsyncResource<String> requestPlatformAttestation(String nonce)`	Requests a raw platform attestation (Play Integrity or App Attest) bound to the nonce.
`public abstract boolean isPlatformAttestationSupported()`	True when the platform provides attestation and this build bundled it.
`public abstract void resetPlatformAttestation()`	Clears cached platform attestation state, forcing a fresh hardware key on the next request.
`public abstract void confirmPlatformAttestation(String keyId)`	Acknowledges that the verifying service recorded the attested key, releasing the client to use cheap assertions from here on.
`public abstract` `String[] getPlatformCompromiseReasons()`	Platform-detected compromise reasons, such as `root` or `frida`.
`public abstract` `String[] getEnabledAccessibilityServices()`	Component identifiers of the accessibility services currently enabled.
`public abstract` `String[] getAppSignerDigests()`	Digests of the certificates the running app is actually signed with, for comparison against what it was built with.
`public abstract` `String getProperty(String key, String defaultValue)`	A build-stamped property, such as the build key or the per-build hardening manifest.
`public abstract void log(String message)`	Writes to the framework log.
`public abstract void publishSignal(ShieldSignal signal)`	Publishes an observation to `ShieldSignals`, where the app can see it and from where it is offered to the service on the next token fetch.

Method details

getSecureStorage

public abstract SecureStorage getSecureStorage()

Non-prompting secure storage, for the attestation key identifier and cached tokens. On device this is the platform keychain or keystore.

requestPlatformAttestation

public abstract AsyncResource<String> requestPlatformAttestation(String nonce)

Requests a raw platform attestation (Play Integrity or App Attest) bound to the nonce.

The result is opaque and must be forwarded to the verifying service; the engine must not try to interpret it on the device, because a device the attacker controls can be made to produce any interpretation.

isPlatformAttestationSupported

public abstract boolean isPlatformAttestationSupported()

True when the platform provides attestation and this build bundled it.

resetPlatformAttestation

public abstract void resetPlatformAttestation()

Clears cached platform attestation state, forcing a fresh hardware key on the next request. Used when the service reports that the device’s attestation key is unknown to it.

confirmPlatformAttestation

public abstract void confirmPlatformAttestation(String keyId)

Acknowledges that the verifying service recorded the attested key, releasing the client to use cheap assertions from here on. Call it once the service has accepted an attestation token; until then the platform refuses to assert against a key the service cannot yet resolve.

getPlatformCompromiseReasons

public abstract String[] getPlatformCompromiseReasons()

Platform-detected compromise reasons, such as root or frida.

getEnabledAccessibilityServices

public abstract String[] getEnabledAccessibilityServices()

Component identifiers of the accessibility services currently enabled.

getAppSignerDigests

public abstract String[] getAppSignerDigests()

Digests of the certificates the running app is actually signed with, for comparison against what it was built with. Empty where the platform cannot report it.

Not exposed as public framework API: nothing in an app needs this, and publishing it would only tell an attacker exactly which value to fake.

getProperty

public abstract String getProperty(String key, String defaultValue)

A build-stamped property, such as the build key or the per-build hardening manifest.

log

public abstract void log(String message)

Writes to the framework log.

publishSignal

public abstract void publishSignal(ShieldSignal signal)

Publishes an observation to ShieldSignals, where the app can see it and from where it is offered to the service on the next token fetch.