Mount host SSH key into deploy containers

.woodpecker.yml

@@ -32,10 +32,12 @@ steps:
 
   deploy-backend:
     image: alpine:3.21
+    volumes:
+      - /home/runner/.ssh:/root/ssh-keys:ro
     commands:
       - apk add --no-cache openssh-client
       - mkdir -p ~/.ssh
-      - cp /etc/woodpecker/ssh/rebreak-deploy ~/.ssh/id_ed25519
+      - cp /root/ssh-keys/rebreak-deploy ~/.ssh/id_ed25519
       - chmod 600 ~/.ssh/id_ed25519
       - ssh-keyscan -H staging.rebreak.org > ~/.ssh/known_hosts 2>/dev/null
       - tar czf backend-output.tar.gz -C backend/.output .
@@ -48,10 +50,12 @@ steps:
 
   deploy-admin:
     image: alpine:3.21
+    volumes:
+      - /home/runner/.ssh:/root/ssh-keys:ro
     commands:
       - apk add --no-cache openssh-client
       - mkdir -p ~/.ssh
-      - cp /etc/woodpecker/ssh/rebreak-deploy ~/.ssh/id_ed25519
+      - cp /root/ssh-keys/rebreak-deploy ~/.ssh/id_ed25519
       - chmod 600 ~/.ssh/id_ed25519
       - ssh-keyscan -H admin.staging.rebreak.org > ~/.ssh/known_hosts 2>/dev/null
       - tar czf admin-output.tar.gz -C apps/admin/.output .

apps/rebreak-magic/app/components/IosDeviceCard.vue

@@ -1,15 +1,10 @@
 <template>
   <div
-    class="relative overflow-hidden rounded-2xl bg-white dark:bg-gray-900 shadow-sm ring-1 ring-gray-100 dark:ring-gray-800 p-5"
-  >
+    class="relative overflow-hidden rounded-2xl bg-white dark:bg-gray-900 shadow-sm ring-1 ring-gray-100 dark:ring-gray-800 p-5">
     <div class="flex items-start gap-4">
       <div
-        class="shrink-0 w-12 h-12 rounded-xl bg-gradient-to-br from-blue-50 to-indigo-50 dark:from-gray-800 dark:to-gray-700 flex items-center justify-center"
-      >
-        <UIcon
-          name="i-heroicons-device-phone-mobile"
-          class="w-6 h-6 text-[var(--rebreak-primary)]"
-        />
+        class="shrink-0 w-12 h-12 rounded-xl bg-gradient-to-br from-blue-50 to-indigo-50 dark:from-gray-800 dark:to-gray-700 flex items-center justify-center">
+        <UIcon name="i-heroicons-device-phone-mobile" class="w-6 h-6 text-[var(--rebreak-primary)]" />
       </div>
 
       <div class="flex-1 min-w-0">
@@ -24,25 +19,16 @@
             </p>
           </div>
 
-          <UBadge
-            :color="topBadge.color"
-            :variant="topBadge.variant"
-            size="sm"
-            class="font-bold shrink-0"
-          >
+          <UBadge :color="topBadge.color" :variant="topBadge.variant" size="sm" class="font-bold shrink-0">
             {{ topBadge.label }}
           </UBadge>
         </div>
 
         <!-- Incomplete-protection hint -->
-        <div
-          v-if="showIncompleteHint"
-          class="mt-3 rounded-xl bg-amber-50 dark:bg-amber-900/20 border border-amber-100 dark:border-amber-800 p-3 flex items-start gap-2.5"
-        >
-          <UIcon
-            name="i-heroicons-exclamation-triangle"
-            class="w-5 h-5 text-amber-600 dark:text-amber-400 shrink-0 mt-0.5"
-          />
+        <div v-if="showIncompleteHint"
+          class="mt-3 rounded-xl bg-amber-50 dark:bg-amber-900/20 border border-amber-100 dark:border-amber-800 p-3 flex items-start gap-2.5">
+          <UIcon name="i-heroicons-exclamation-triangle"
+            class="w-5 h-5 text-amber-600 dark:text-amber-400 shrink-0 mt-0.5" />
           <div>
             <p class="text-sm font-bold text-amber-800 dark:text-amber-300">
               Schutz unvollständig
@@ -54,31 +40,18 @@
         </div>
 
         <!-- USB connection hint -->
-        <div
-          v-if="!isConnected"
-          class="mt-3 text-sm text-gray-600 dark:text-gray-300 flex items-start gap-2"
-        >
-          <UIcon
-            :name="isSearching ? 'i-heroicons-arrow-path' : 'i-heroicons-information-circle'"
-            :class="isSearching ? 'animate-spin' : ''"
-            class="w-5 h-5 text-[var(--rebreak-primary)] shrink-0 mt-0.5"
-          />
+        <div v-if="!isConnected" class="mt-3 text-sm text-gray-600 dark:text-gray-300 flex items-start gap-2">
+          <UIcon :name="isSearching ? 'i-heroicons-arrow-path' : 'i-heroicons-information-circle'"
+            :class="isSearching ? 'animate-spin' : ''" class="w-5 h-5 text-[var(--rebreak-primary)] shrink-0 mt-0.5" />
           <span>{{ isSearching ? "Suche nach verbundenem iPhone…" : "Verbinde dein iPhone mit USB, um den Schutz zu vervollständigen." }}</span>
         </div>
 
         <!-- Backend-MDM always visible; local USB only when connected -->
-        <div
-          class="mt-4 grid grid-cols-1 md:grid-cols-2 gap-4 relative"
-        >
+        <div class="mt-4 grid grid-cols-1 md:grid-cols-2 gap-4 relative">
           <!-- Animated sync overlay -->
-          <div
-            v-if="autoSyncing"
-            class="absolute inset-0 z-10 rounded-2xl bg-white/80 dark:bg-gray-900/80 backdrop-blur-sm flex flex-col items-center justify-center"
-          >
-            <UIcon
-              name="i-heroicons-arrow-path"
-              class="w-8 h-8 animate-spin text-[var(--rebreak-primary)]"
-            />
+          <div v-if="autoSyncing"
+            class="absolute inset-0 z-10 rounded-2xl bg-white/80 dark:bg-gray-900/80 backdrop-blur-sm flex flex-col items-center justify-center">
+            <UIcon name="i-heroicons-arrow-path" class="w-8 h-8 animate-spin text-[var(--rebreak-primary)]" />
             <p class="mt-2 text-sm font-bold text-gray-900 dark:text-white">
               Schutz wird geprüft…
             </p>
@@ -93,38 +66,19 @@
               <span class="text-xs font-bold uppercase tracking-wide text-gray-500 dark:text-gray-400">
                 Backend-MDM
               </span>
-              <UBadge
-                v-if="mdmState.loading"
-                color="neutral"
-                variant="subtle"
-                size="xs"
-              >
+              <UBadge v-if="mdmState.loading" color="neutral" variant="subtle" size="xs">
                 Lädt…
               </UBadge>
-              <UBadge
-                v-else-if="mdmState.data?.enrolled"
-                color="success"
-                variant="subtle"
-                size="xs"
-              >
+              <UBadge v-else-if="mdmState.data?.enrolled" color="success" variant="subtle" size="xs">
                 Enrolled
               </UBadge>
-              <UBadge
-                v-else
-                color="warning"
-                variant="subtle"
-                size="xs"
-              >
+              <UBadge v-else color="warning" variant="subtle" size="xs">
                 Nicht enrolled
               </UBadge>
             </div>
 
             <ul class="space-y-2 text-sm text-gray-700 dark:text-gray-200">
-              <li
-                v-for="row in backendRows"
-                :key="row.label"
-                class="flex items-center justify-between"
-              >
+              <li v-for="row in backendRows" :key="row.label" class="flex items-center justify-between">
                 <span class="text-gray-500 dark:text-gray-400">{{ row.label }}</span>
                 <span :class="row.valueClass">{{ row.value }}</span>
               </li>
@@ -132,29 +86,18 @@
           </div>
 
           <!-- Local USB device card -->
-          <div
-            v-if="isConnected"
-            class="rounded-xl bg-gray-50 dark:bg-gray-800/50 p-4"
-          >
+          <div v-if="isConnected" class="rounded-xl bg-gray-50 dark:bg-gray-800/50 p-4">
             <div class="flex items-center justify-between mb-3">
               <span class="text-xs font-bold uppercase tracking-wide text-gray-500 dark:text-gray-400">
                 Lokales USB-Gerät
               </span>
-              <UBadge
-                color="success"
-                variant="subtle"
-                size="xs"
-              >
+              <UBadge color="success" variant="subtle" size="xs">
                 Verbunden
               </UBadge>
             </div>
 
             <ul class="space-y-2 text-sm text-gray-700 dark:text-gray-200">
-              <li
-                v-for="row in localRows"
-                :key="row.label"
-                class="flex items-center justify-between"
-              >
+              <li v-for="row in localRows" :key="row.label" class="flex items-center justify-between">
                 <span class="text-gray-500 dark:text-gray-400">{{ row.label }}</span>
                 <span :class="row.valueClass">{{ row.value }}</span>
               </li>
@@ -163,10 +106,8 @@
         </div>
 
         <!-- Mismatch summary after sync -->
-        <div
-          v-if="isConnected && autoSyncComplete && mismatches.length > 0"
-          class="mt-4 rounded-xl bg-red-50 dark:bg-red-900/20 border border-red-100 dark:border-red-800 p-3"
-        >
+        <div v-if="isConnected && autoSyncComplete && mismatches.length > 0"
+          class="mt-4 rounded-xl bg-red-50 dark:bg-red-900/20 border border-red-100 dark:border-red-800 p-3">
           <p class="text-sm font-bold text-red-800 dark:text-red-300">
             {{ mismatches.length }} Unterschied(e) erkannt
           </p>
@@ -178,16 +119,11 @@
         </div>
 
         <!-- Inline enrollment panel -->
-        <div
-          v-if="enrollmentPhase !== 'idle'"
-          class="mt-4 rounded-xl bg-indigo-50 dark:bg-indigo-900/20 border border-indigo-100 dark:border-indigo-800 p-4"
-        >
+        <div v-if="enrollmentPhase !== 'idle'"
+          class="mt-4 rounded-xl bg-indigo-50 dark:bg-indigo-900/20 border border-indigo-100 dark:border-indigo-800 p-4">
           <div class="flex items-center gap-2 mb-3">
-            <UIcon
-              name="i-heroicons-arrow-path"
-              class="w-5 h-5 text-indigo-600 dark:text-indigo-400"
-              :class="{ 'animate-spin': enrollmentPhase === 'loading' || enrollmentPhase === 'checking' }"
-            />
+            <UIcon name="i-heroicons-arrow-path" class="w-5 h-5 text-indigo-600 dark:text-indigo-400"
+              :class="{ 'animate-spin': enrollmentPhase === 'loading' || enrollmentPhase === 'checking' }" />
             <p class="text-sm font-bold text-indigo-900 dark:text-indigo-200">
               MDM-Enrollment
             </p>
@@ -195,24 +131,18 @@
 
           <!-- Progress steps -->
           <div class="flex items-center gap-2 text-xs mb-4">
-            <span
-              class="px-2 py-1 rounded-full"
-              :class="enrollmentPhase === 'loading' ? 'bg-indigo-200 text-indigo-800 dark:bg-indigo-700 dark:text-indigo-100' : 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300'"
-            >
+            <span class="px-2 py-1 rounded-full"
+              :class="enrollmentPhase === 'loading' ? 'bg-indigo-200 text-indigo-800 dark:bg-indigo-700 dark:text-indigo-100' : 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300'">
               1. Profil laden
             </span>
             <span class="text-gray-400">→</span>
-            <span
-              class="px-2 py-1 rounded-full"
-              :class="enrollmentPhase === 'waiting' ? 'bg-indigo-200 text-indigo-800 dark:bg-indigo-700 dark:text-indigo-100' : (enrollmentPhase === 'checking' || enrollmentPhase === 'success' || enrollmentPhase === 'error') ? 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300' : 'bg-gray-100 text-gray-500 dark:bg-gray-800 dark:text-gray-400'"
-            >
+            <span class="px-2 py-1 rounded-full"
+              :class="enrollmentPhase === 'waiting' ? 'bg-indigo-200 text-indigo-800 dark:bg-indigo-700 dark:text-indigo-100' : (enrollmentPhase === 'checking' || enrollmentPhase === 'success' || enrollmentPhase === 'error') ? 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300' : 'bg-gray-100 text-gray-500 dark:bg-gray-800 dark:text-gray-400'">
               2. QR-Code scannen
             </span>
             <span class="text-gray-400">→</span>
-            <span
-              class="px-2 py-1 rounded-full"
-              :class="enrollmentPhase === 'checking' ? 'bg-indigo-200 text-indigo-800 dark:bg-indigo-700 dark:text-indigo-100' : enrollmentPhase === 'success' ? 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300' : 'bg-gray-100 text-gray-500 dark:bg-gray-800 dark:text-gray-400'"
-            >
+            <span class="px-2 py-1 rounded-full"
+              :class="enrollmentPhase === 'checking' ? 'bg-indigo-200 text-indigo-800 dark:bg-indigo-700 dark:text-indigo-100' : enrollmentPhase === 'success' ? 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300' : 'bg-gray-100 text-gray-500 dark:bg-gray-800 dark:text-gray-400'">
               3. Prüfen
             </span>
           </div>
@@ -225,12 +155,7 @@
             <p class="text-xs text-indigo-700 dark:text-indigo-300">
               Scanne den Code mit der iPhone-Kamera und installiere das Profil.
             </p>
-            <UButton
-              size="sm"
-              color="primary"
-              :loading="enrollmentPhase === 'checking'"
-              @click="checkInlineEnrollment"
-            >
+            <UButton size="sm" color="primary" :loading="enrollmentPhase === 'checking'" @click="checkInlineEnrollment">
               Installation prüfen
             </UButton>
           </div>
@@ -240,13 +165,8 @@
             <div class="text-sm text-green-700 dark:text-green-300">
               ✓ Enrollment abgeschlossen. Das Gerät synchronisiert sich jetzt mit dem Backend.
             </div>
-            <UButton
-              size="sm"
-              color="primary"
-              icon="i-heroicons-lock-closed"
-              @click="router.push('/sideload')"
-            >
-              Weiter zum Lock-Profil
+            <UButton size="sm" color="primary" icon="i-heroicons-lock-closed" @click="startInlineLockProfile">
+              Lock-Profil installieren
             </UButton>
           </div>
           <div v-if="enrollmentPhase === 'error'" class="text-sm text-red-700 dark:text-red-300">
@@ -254,53 +174,68 @@
           </div>
 
           <!-- Logs -->
-          <div v-if="enrollmentLogs.length > 0" class="mt-3 text-xs bg-white/60 dark:bg-black/20 p-2 rounded overflow-auto max-h-32">
+          <div v-if="enrollmentLogs.length > 0"
+            class="mt-3 text-xs bg-white/60 dark:bg-black/20 p-2 rounded overflow-auto max-h-32">
             <pre class="whitespace-pre-wrap">{{ enrollmentLogs.join('\n') }}</pre>
           </div>
 
           <div class="mt-3 flex justify-end">
-            <UButton
-              size="xs"
-              color="neutral"
-              variant="ghost"
-              @click="closeInlineEnrollment"
+            <UButton size="xs" color="neutral" variant="ghost" @click="closeInlineEnrollment">
+              Schließen
+            </UButton>
+          </div>
+        </div>
+
+        <!-- Inline lock profile panel -->
+        <div
+          v-if="lockPhase !== 'idle'"
+          class="mt-4 rounded-xl bg-purple-50 dark:bg-purple-900/20 border border-purple-100 dark:border-purple-800 p-4"
         >
+          <div class="flex items-center gap-2 mb-3">
+            <UIcon
+              name="i-heroicons-lock-closed"
+              class="w-5 h-5 text-purple-600 dark:text-purple-400"
+              :class="{ 'animate-spin': lockPhase === 'loading' }"
+            />
+            <p class="text-sm font-bold text-purple-900 dark:text-purple-200">
+              Lock-Profil
+            </p>
+          </div>
+
+          <div v-if="lockPhase === 'loading'" class="text-sm text-purple-700 dark:text-purple-300">
+            Lock-Profil wird per MDM auf das iPhone gepusht …
+          </div>
+          <div v-if="lockPhase === 'success'" class="text-sm text-green-700 dark:text-green-300">
+            ✓ Lock-Profil-Installation initiiert. Das Gerät aktualisiert den Schutz in Kürze.
+          </div>
+          <div v-if="lockPhase === 'error'" class="text-sm text-red-700 dark:text-red-300">
+            ✗ {{ lockError || "Lock-Profil-Installation fehlgeschlagen" }}
+          </div>
+
+          <div v-if="lockLogs.length > 0" class="mt-3 text-xs bg-white/60 dark:bg-black/20 p-2 rounded overflow-auto max-h-32">
+            <pre class="whitespace-pre-wrap">{{ lockLogs.join('\n') }}</pre>
+          </div>
+
+          <div class="mt-3 flex justify-end">
+            <UButton size="xs" color="neutral" variant="ghost" @click="closeInlineLockProfile">
               Schließen
             </UButton>
           </div>
         </div>
 
         <div class="mt-4 flex items-center gap-3">
-          <UButton
-            v-if="action.to"
-            :color="action.color"
-            :variant="action.variant"
-            size="sm"
-            :icon="action.icon"
-            :to="action.to"
-          >
+          <UButton v-if="action.to" :color="action.color" :variant="action.variant" size="sm" :icon="action.icon"
+            :to="action.to">
             {{ action.label }}
           </UButton>
-          <UButton
-            v-else
-            :color="action.color"
-            :variant="action.variant"
-            size="sm"
-            :icon="action.icon"
-            :loading="manualSyncing || autoSyncing || isSearching"
-            :disabled="autoSyncing || isSearching"
-            @click="onActionClick"
-          >
+          <UButton v-else :color="action.color" :variant="action.variant" size="sm" :icon="action.icon"
+            :loading="manualSyncing || autoSyncing || isSearching" :disabled="autoSyncing || isSearching"
+            @click="onActionClick">
             {{ action.label }}
           </UButton>
 
-          <UButton
-            color="neutral"
-            variant="ghost"
-            size="sm"
-            trailing-icon="i-heroicons-chevron-right"
-            @click="emit('open', device)"
-          >
+          <UButton color="neutral" variant="ghost" size="sm" trailing-icon="i-heroicons-chevron-right"
+            @click="emit('open', device)">
             Details
           </UButton>
         </div>
@@ -311,7 +246,6 @@
 
 <script setup lang="ts">
 import { computed, onMounted, ref, watch } from "vue";
-import { useRouter } from "vue-router";
 import QRCode from "qrcode";
 import type { ComputedDevice, DeviceStatus } from "~/composables/useDeviceStatus";
 import { useMdmStatus } from "~/composables/useMdmStatus";
@@ -327,7 +261,6 @@ const props = defineProps<{
 
 const deviceIdRef = computed(() => props.device.deviceId);
 const { state: mdmState, refresh: refreshMdmStatus } = useMdmStatus(deviceIdRef);
-const router = useRouter();
 
 const emit = defineEmits<{
   (e: "sync", device: ComputedDevice): void;
@@ -350,6 +283,7 @@ const {
   stopLocalProfileServer,
   getInstalledProfiles,
   mdmPush,
+  mdmInstallLockProfile,
 } = useTauri();
 
 const enrollmentPhase = ref<"idle" | "loading" | "waiting" | "checking" | "success" | "error">("idle");
@@ -358,6 +292,12 @@ const enrollmentQrUrl = ref<string>("");
 const enrollmentError = ref<string | null>(null);
 const enrollmentLogs = ref<string[]>([]);
 
+const lockPhase = ref<"idle" | "loading" | "success" | "error">("idle");
+const lockError = ref<string | null>(null);
+const lockLogs = ref<string[]>([]);
+
+const LOCK_PROFILE_PATH = "/Users/chahinebrini/mono/rebreak-monorepo/ops/mdm/profiles/rebreak-content-filter-sideload.mobileconfig";
+
 const localEnrollment = computed(() =>
   props.iphone?.installedProfileIDs?.includes(ENROLLMENT_PROFILE_ID) ?? false,
 );
@@ -373,7 +313,7 @@ const backendRows = computed(() => {
   return [
     {
       label: "Enrollment",
-      value: data?.enrolled ? "Ja ✓" : "Nein",
+      value: data?.enrolled ? "Ja" : "Nein",
       valueClass: data?.enrolled
         ? "text-green-600 dark:text-green-400 font-medium"
         : "text-red-600 dark:text-red-400 font-medium",
@@ -598,6 +538,15 @@ const action = computed<IosAction>(() => {
     };
   }
 
+  if (lockPhase.value !== "idle") {
+    return {
+      label: "Lock-Profil wird installiert…",
+      icon: "i-heroicons-arrow-path",
+      color: "neutral",
+      variant: "soft",
+    };
+  }
+
   if (!props.isConnected || !props.iphone) {
     return {
       label: "iPhone verbinden, um ReBreak Cloud zu synchronisieren",
@@ -654,7 +603,6 @@ const action = computed<IosAction>(() => {
       icon: "i-heroicons-lock-closed",
       color: "warning",
       variant: "solid",
-      to: "/sideload",
     };
   }
 
@@ -760,6 +708,11 @@ function onActionClick() {
     return;
   }
 
+  if (localEnrollment.value && !localLock.value) {
+    startInlineLockProfile();
+    return;
+  }
+
   manualSyncing.value = true;
   emit("sync", props.device);
   setTimeout(() => {
@@ -842,4 +795,31 @@ function closeInlineEnrollment() {
   enrollmentQrUrl.value = "";
   enrollmentError.value = null;
 }
+
+async function startInlineLockProfile() {
+  if (!props.iphone?.udid) return;
+
+  lockPhase.value = "loading";
+  lockError.value = null;
+  lockLogs.value = [];
+
+  try {
+    lockLogs.value.push("→ Installiere Lock-Profil per MDM …");
+    const result = await mdmInstallLockProfile(props.iphone.udid, LOCK_PROFILE_PATH);
+    lockLogs.value.push(`✓ Command UUID: ${result.command_uuid}`);
+
+    await refreshMdmStatus();
+    lockPhase.value = "success";
+  } catch (e: any) {
+    lockError.value = e?.message ?? "Lock-Profil-Installation fehlgeschlagen";
+    lockLogs.value.push(`✗ ${lockError.value}`);
+    lockPhase.value = "error";
+  }
+}
+
+function closeInlineLockProfile() {
+  lockPhase.value = "idle";
+  lockError.value = null;
+  lockLogs.value = [];
+}
 </script>

apps/rebreak-magic/src-tauri/Cargo.lock

@@ -2846,6 +2846,7 @@ dependencies = [
  "dirs 5.0.1",
  "keyring",
  "local-ip-address",
+ "plist",
  "reqwest 0.12.28",
  "serde",
  "serde_json",

apps/rebreak-magic/src-tauri/Cargo.toml

@@ -28,6 +28,7 @@ uuid = { version = "1", features = ["v4"] }
 base64 = "0.22"
 dirs = "5"
 tiny_http = "0.12"
+plist = "1"
 local-ip-address = "0.6"
 # Pin brotli family to avoid alloc-no-stdlib version conflict
 brotli-decompressor = "=5.0.1"

apps/rebreak-magic/src-tauri/src/mdm/client.rs

@@ -113,13 +113,13 @@ impl MdmClient {
             "Command": command,
         });
 
-        // NanoMDM expects plist, but also accepts JSON in newer versions.
-        // For maximum compatibility we send JSON here; if it fails, the caller
-        // will see the error.
+        // NanoMDM expects plist XML, not JSON. Serialize to plist XML.
+        let plist_body = json_to_plist_xml(&envelope)?;
+
         let resp = self
             .request(reqwest::Method::PUT, &format!("/v1/enqueue/{}?push=1", udid))?
-            .header("Content-Type", "application/json")
-            .json(&envelope)
+            .header("Content-Type", "application/xml")
+            .body(plist_body)
             .send()
             .await
             .map_err(|e| AppError::new(format!("MDM enqueue failed: {}", e)))?;
@@ -140,3 +140,44 @@ impl MdmClient {
         })
     }
 }
+
+fn json_to_plist_xml(value: &serde_json::Value) -> AppResult<String> {
+    let plist_value = json_value_to_plist(value)?;
+    let mut buf = Vec::new();
+    plist::Value::from(plist_value)
+        .to_writer_xml(&mut buf)
+        .map_err(|e| AppError::new(format!("plist serialize failed: {}", e)))?;
+    String::from_utf8(buf).map_err(|e| AppError::new(format!("plist utf8 failed: {}", e)))
+}
+
+fn json_value_to_plist(value: &serde_json::Value) -> AppResult<plist::Value> {
+    use plist::Value as Pv;
+    match value {
+        serde_json::Value::Null => Ok(Pv::String(String::new())),
+        serde_json::Value::Bool(b) => Ok(Pv::Boolean(*b)),
+        serde_json::Value::Number(n) => {
+            if let Some(i) = n.as_i64() {
+                Ok(Pv::Integer(i.into()))
+            } else if let Some(f) = n.as_f64() {
+                Ok(Pv::Real(f))
+            } else {
+                Err(AppError::new("unsupported json number".to_string()))
+            }
+        }
+        serde_json::Value::String(s) => Ok(Pv::String(s.clone())),
+        serde_json::Value::Array(arr) => {
+            let mut out = Vec::new();
+            for item in arr {
+                out.push(json_value_to_plist(item)?);
+            }
+            Ok(Pv::Array(out.into()))
+        }
+        serde_json::Value::Object(map) => {
+            let mut out = plist::Dictionary::new();
+            for (k, v) in map {
+                out.insert(k.clone(), json_value_to_plist(v)?);
+            }
+            Ok(Pv::Dictionary(out))
+        }
+    }
+}

graphify-out/GRAPH_REPORT.md

@@ -1,16 +1,16 @@
 # Graph Report - rebreak-monorepo  (2026-06-18)
 
 ## Corpus Check
-- 1524 files · ~1,868,449 words
+- 1494 files · ~1,764,972 words
 - Verdict: corpus is large enough that graph structure adds value.
 
 ## Summary
-- 18223 nodes · 25853 edges · 1317 communities (1252 shown, 65 thin omitted)
+- 18224 nodes · 25854 edges · 1327 communities (1262 shown, 65 thin omitted)
 - Extraction: 99% EXTRACTED · 1% INFERRED · 0% AMBIGUOUS · INFERRED: 200 edges (avg confidence: 0.81)
 - Token cost: 0 input · 0 output
 
 ## Graph Freshness
-- Built from commit: `da4a94da`
+- Built from commit: `681356f0`
 - Run `git rev-parse HEAD` and compare to check if the graph is stale.
 - Run `graphify update .` after code changes (no API cost).
 
@@ -1131,17 +1131,25 @@
 - [[_COMMUNITY_Community 1240|Community 1240]]
 - [[_COMMUNITY_Community 1241|Community 1241]]
 - [[_COMMUNITY_Community 1242|Community 1242]]
+- [[_COMMUNITY_Community 1243|Community 1243]]
 - [[_COMMUNITY_Community 1244|Community 1244]]
 - [[_COMMUNITY_Community 1245|Community 1245]]
+- [[_COMMUNITY_Community 1246|Community 1246]]
 - [[_COMMUNITY_Community 1247|Community 1247]]
 - [[_COMMUNITY_Community 1248|Community 1248]]
 - [[_COMMUNITY_Community 1249|Community 1249]]
 - [[_COMMUNITY_Community 1250|Community 1250]]
 - [[_COMMUNITY_Community 1251|Community 1251]]
+- [[_COMMUNITY_Community 1252|Community 1252]]
 - [[_COMMUNITY_Community 1253|Community 1253]]
 - [[_COMMUNITY_Community 1254|Community 1254]]
 - [[_COMMUNITY_Community 1255|Community 1255]]
+- [[_COMMUNITY_Community 1256|Community 1256]]
+- [[_COMMUNITY_Community 1257|Community 1257]]
+- [[_COMMUNITY_Community 1258|Community 1258]]
+- [[_COMMUNITY_Community 1259|Community 1259]]
 - [[_COMMUNITY_Community 1260|Community 1260]]
+- [[_COMMUNITY_Community 1261|Community 1261]]
 - [[_COMMUNITY_Community 1262|Community 1262]]
 - [[_COMMUNITY_Community 1263|Community 1263]]
 - [[_COMMUNITY_Community 1264|Community 1264]]
@@ -1152,6 +1160,7 @@
 - [[_COMMUNITY_Community 1269|Community 1269]]
 - [[_COMMUNITY_Community 1270|Community 1270]]
 - [[_COMMUNITY_Community 1271|Community 1271]]
+- [[_COMMUNITY_Community 1272|Community 1272]]
 - [[_COMMUNITY_Community 1273|Community 1273]]
 - [[_COMMUNITY_Community 1274|Community 1274]]
 - [[_COMMUNITY_Community 1275|Community 1275]]
@@ -1169,6 +1178,7 @@
 - [[_COMMUNITY_Community 1287|Community 1287]]
 - [[_COMMUNITY_Community 1288|Community 1288]]
 - [[_COMMUNITY_Community 1289|Community 1289]]
+- [[_COMMUNITY_Community 1290|Community 1290]]
 - [[_COMMUNITY_Community 1291|Community 1291]]
 - [[_COMMUNITY_Community 1293|Community 1293]]
 - [[_COMMUNITY_Community 1294|Community 1294]]
@@ -1202,14 +1212,14 @@
 ## Surprising Connections (you probably didn't know these)
 - `Lyra Modi (SOS-Crisis-Mode / Coach-Casual-Mode)` --semantically_similar_to--> `REQ-LYRA Lyra KI-Coach & Krisen-Behandlung (höchste Sicherheitsrelevanz)`  [INFERRED] [semantically similar]
   ops/LYRA_PERSONA.md → docs/specs/diga/03-requirements-v0.md
+- `getCrisisFallback()` --implements--> `SAFETY-REQ-LLM-001 Krisenreferenz-Pflicht (Recall 100%)`  [INFERRED]
+  backend/server/utils/crisis-filter.ts → docs/specs/diga/05c-lyra-eval-v0.md
 - `findActiveDeviceLock()` --implements--> `REQ-MAGIC Selbstbindung (RebreakMagic Lock-Modus, 24h-Cooldown)`  [INFERRED]
   backend/server/db/devices.ts → docs/specs/diga/03-requirements-v0.md
 - `requestDeviceRelease()` --references--> `R-BYP-03 Selbstbindung wird zur Falle (legitimer Ausstieg scheitert)`  [INFERRED]
   backend/server/db/devices.ts → docs/specs/diga/04-risiko-akte-v0.md
 - `addStreakEvent()` --implements--> `protection_state_log (append-only Schutz-Transitions-Log)`  [INFERRED]
   backend/server/db/streak.ts → docs/specs/protection-coverage-streak.md
-- `CoachScreen()` --implements--> `REQ-LYRA Lyra KI-Coach & Krisen-Behandlung (höchste Sicherheitsrelevanz)`  [INFERRED]
-  apps/rebreak-native/app/lyra.tsx → docs/specs/diga/03-requirements-v0.md
 
 ## Import Cycles
 - 1-file cycle: `apps/rebreak-magic/src-tauri/src/backend/api.rs -> apps/rebreak-magic/src-tauri/src/backend/api.rs`
@@ -1236,7 +1246,7 @@
 - **IEC-62304-Traceability (Anforderung→Risikomaßnahme→Test→Lyra-Eval)** — diga_03_req_lyra, diga_04_risk_lyra_01_verpasste_krise, diga_05b_test_verifikation, diga_05c_crisis_detection_recall [EXTRACTED 0.95]
 - **FAGS/NLS Förder- & Partnerschafts-Strategie (Träger, Forschung, Geldgeber)** — entity_fags, entity_nls, entity_nbank, entity_uni_bremen, entity_step_lukaswerk, entity_bfarm [EXTRACTED 0.85]
 
-## Communities (1317 total, 65 thin omitted)
+## Communities (1327 total, 65 thin omitted)
 
 ### Community 0 - "i18n: Blocker/Activation Strings"
 Cohesion: 0.01
@@ -1255,8 +1265,8 @@ Cohesion: 0.01
 Nodes (206): blocker, activate_app_lock_failed_msg, activate_app_lock_failed_title, activate_settings_btn, activate_url_failed_msg, activate_url_failed_title, activation_failed_title, add_domain (+198 more)
 
 ### Community 4 - "Debug & Dev Tools"
-Cohesion: 0.04
-Nodes (56): DmConversation, ALLOWED_EMOJIS, createChatMessage(), DmConversationRow, getChatMessages(), getDmConversations(), getDmHistory(), markDmsAsRead() (+48 more)
+Cohesion: 0.06
+Nodes (32): countPostLikes(), createComment(), createCommentLike(), deleteCommentLike(), deletePostLike(), getCommentLike(), getCommentLikeCount(), getCommentsByPost() (+24 more)
 
 ### Community 5 - "Backend API Routes"
 Cohesion: 0.07
@@ -1264,19 +1274,19 @@ Nodes (27): ScoreProgressBar(), ScoreProgressBarProps, useSnakeSounds(), checkWi
 
 ### Community 6 - "Backend Tests & Auth Routes"
 Cohesion: 0.04
-Nodes (77): getConsentLogsByUser(), getMailConnectionWithConsent(), setMailConnectionConsent(), writeConsentGrant(), writeConsentRevoke(), getBlocklistedDomainsSet(), consumeOauthPendingState(), countMailConnections() (+69 more)
+Nodes (77): getConsentLogsByUser(), getMailConnectionWithConsent(), setMailConnectionConsent(), writeConsentGrant(), getBlocklistedDomainsSet(), getCustomMailDisplayNames(), getMailDisplayNamePatterns(), consumeOauthPendingState() (+69 more)
 
 ### Community 7 - "Consent & Magic API Routes"
-Cohesion: 0.05
-Nodes (58): CooldownTestModeToggle(), DebugScreen(), DebugStub(), LogLine(), LyraEmotionPreviewCard(), ONBOARDING_STEPS, OnboardingStepValue, pad() (+50 more)
+Cohesion: 0.04
+Nodes (86): DevicesScreen(), formatCountdown(), formatLastSeen(), formatSince(), MobileDeviceRow(), mobileIcon(), SectionCard(), SectionLabel() (+78 more)
 
 ### Community 8 - "i18n: Pricing Strings"
-Cohesion: 0.04
-Nodes (84): ChatScreen(), DmItem(), formatTime(), makeStyles(), FilterChip, HomeScreen(), PickerOption, PLAN_ACCENT (+76 more)
+Cohesion: 0.09
+Nodes (41): ChatScreen(), DmItem(), formatTime(), makeStyles(), FilterChip, HomeScreen(), ComposeCard(), Props (+33 more)
 
 ### Community 9 - "Android DNS Filter (Kotlin)"
-Cohesion: 0.12
-Nodes (25): cancelCooldown(), createCooldown(), getActiveCooldown(), resolveCooldown(), appendProtectionEvent(), appendProtectionEventDeduped(), computeProtectionCoverage(), getLastProtectionEvent() (+17 more)
+Cohesion: 0.23
+Nodes (14): appendProtectionEvent(), appendProtectionEventDeduped(), computeProtectionCoverage(), getLastProtectionEvent(), ProtectionCoverage, ProtectionSource, utcDayStart(), Server-time-authoritativer Cooldown (Uhr-Manipulation-Schutz) (+6 more)
 
 ### Community 10 - "i18n: Pricing Strings"
 Cohesion: 0.16
@@ -1299,36 +1309,36 @@ Cohesion: 0.02
 Nodes (88): landing, blocker_badge, blocker_desc, blocker_feat_cooldown, blocker_feat_custom, blocker_feat_platforms, blocker_feat_updated, blocker_title_activated (+80 more)
 
 ### Community 15 - "Mail Protection Screen"
-Cohesion: 0.06
-Nodes (106): core, core:app, default_permission, global_scope_schema, permission_sets, default_permission, default_permission, global_scope_schema (+98 more)
+Cohesion: 0.08
+Nodes (87): allow, deny, core, core:app, default_permission, core:event, global_scope_schema, core:image (+79 more)
 
 ### Community 16 - "Devices Management Screen"
 Cohesion: 0.02
 Nodes (87): landing, blocker_badge, blocker_desc, blocker_feat_cooldown, blocker_feat_custom, blocker_feat_platforms, blocker_feat_updated, blocker_title_activated (+79 more)
 
 ### Community 17 - "App Root Layout & Shell"
-Cohesion: 0.05
-Nodes (52): DmData, DmHistoryResponse, DmScreen(), makeStyles(), MediaLibraryModule, CoachScreen(), LoadingPulse(), MessageWithMeta (+44 more)
+Cohesion: 0.07
+Nodes (42): DmData, DmHistoryResponse, DmScreen(), makeStyles(), MediaLibraryModule, CoachScreen(), formatTimestamp(), LoadingPulse() (+34 more)
 
 ### Community 18 - "Community 18"
 Cohesion: 0.08
-Nodes (50): LayerSwitchCard(), Props, AndroidSetupFlow(), IosUnsupervisedSetupFlow(), Emotion, invalidateMe(), OnboardingStep, apiUrl (+42 more)
+Nodes (49): LayerSwitchCard(), Props, AndroidSetupFlow(), IosUnsupervisedSetupFlow(), invalidateMe(), listeners, Me, OnboardingStep (+41 more)
 
 ### Community 19 - "Community 19"
 Cohesion: 0.02
 Nodes (82): auth, acceptTerms, acceptTermsSuffix, alreadyRegistered, appleSignin, appleSignup, backToLogin, backToLoginPlain (+74 more)
 
 ### Community 20 - "Community 20"
-Cohesion: 0.03
-Nodes (86): CallScreen(), fmtDuration(), EASE_OUT, LandingScreen(), queryClient, RootLayoutInner(), SettingsScreen(), AuthCallback() (+78 more)
+Cohesion: 0.05
+Nodes (62): EASE_OUT, LandingScreen(), queryClient, RootLayoutInner(), SettingsScreen(), ConfirmOtpScreen(), OTP_INPUT_STYLE, OTP_INPUT_STYLE (+54 more)
 
 ### Community 21 - "Community 21"
-Cohesion: 0.05
-Nodes (79): MailScreen(), PLAN_LABEL, SuggestResult, SuggestState, useCuratedSuggest(), ping(), useLastSeenHeartbeat(), useMailDisconnect() (+71 more)
+Cohesion: 0.07
+Nodes (49): MailScreen(), PLAN_LABEL, useMailDisconnect(), UseMailDisconnectReturn, MailBlockedItem, MailResultsResponse, useMailResults(), aggregateToMonths() (+41 more)
 
 ### Community 22 - "Community 22"
-Cohesion: 0.05
-Nodes (75): BlockerScreen(), AddDomainSheet(), detectKind(), mailDomain(), PreviewCard(), Props, CooldownBanner(), Props (+67 more)
+Cohesion: 0.07
+Nodes (61): BlockerScreen(), AddDomainSheet(), detectKind(), mailDomain(), PreviewCard(), Props, CooldownBanner(), Props (+53 more)
 
 ### Community 23 - "Community 23"
 Cohesion: 0.03
@@ -1367,16 +1377,16 @@ Cohesion: 0.18
 Nodes (16): Config: AdGuard DoH Vars (ADGUARD_BASE_URL/USER/PASSWORD), Config: ENCRYPTION_KEY (AES-256 for DB fields incl mdmDnsToken), Config: GROQ_API_KEY LLM Provider Var, Config: Infisical Secret Injection (no .env files), Backend Environment Variables Doc, RebreakMagic Device-Binding API Documentation, AdGuard Integration: /control/clients/add Persistent Client, Endpoint: POST /api/magic/devices/:deviceId/cancel-release (+8 more)
 
 ### Community 32 - "Community 32"
-Cohesion: 0.09
-Nodes (26): autoReleaseInactiveDevices(), bindDeviceToUser(), cancelDeviceRelease(), cleanupStaleDevices(), deleteUserDevice(), DEVICE_SELECT, DeviceRecord, ensureMagicRemovalPassword() (+18 more)
+Cohesion: 0.06
+Nodes (39): autoReleaseInactiveDevices(), bindDeviceToUser(), cancelDeviceRelease(), countActiveMagicBindings(), deleteUserDevice(), DEVICE_SELECT, DeviceRecord, ensureMagicRemovalPassword() (+31 more)
 
 ### Community 33 - "Community 33"
 Cohesion: 0.05
-Nodes (45): prismaMock, requireUserMock, isAdminUser(), touchDevice(), ALLOWED_LYRA_VOICE_IDS, DemographicsFields, DemographicsPatch, dismissDigaBanner() (+37 more)
+Nodes (47): prismaMock, requireUserMock, isAdminUser(), findUserDevice(), registerDevice(), touchDevice(), ALLOWED_LYRA_VOICE_IDS, DemographicsFields (+39 more)
 
 ### Community 34 - "Community 34"
-Cohesion: 0.05
-Nodes (79): arcPath(), HalfDonut(), HalfDonutSegment, polar(), Props, DemographicsResp, DiGaMilestoneModal(), MILESTONES (+71 more)
+Cohesion: 0.06
+Nodes (62): DemographicsResp, DiGaMilestoneModal(), MILESTONES, storageKey(), ApprovedDomainsData, BackendCooldownEntry, CooldownHistoryData, Demographics (+54 more)
 
 ### Community 35 - "Community 35"
 Cohesion: 0.06
@@ -1387,16 +1397,16 @@ Cohesion: 0.08
 Nodes (44): Option, PathBuf, Result, String, Duration, Error, Option, ProtectionState (+36 more)
 
 ### Community 37 - "Community 37"
-Cohesion: 0.08
-Nodes (35): DevicesScreen(), formatCountdown(), formatLastSeen(), formatSince(), MobileDeviceRow(), mobileIcon(), protectedDeviceIcon(), SectionCard() (+27 more)
+Cohesion: 0.05
+Nodes (45): CallScreen(), fmtDuration(), makeModalStyles(), makeStyles(), RoomDetail, RoomScreen(), RoomSettingsModal(), AuthCallback() (+37 more)
 
 ### Community 38 - "Community 38"
 Cohesion: 0.05
 Nodes (46): commands, description, identifier, commands, description, identifier, commands, description (+38 more)
 
 ### Community 39 - "Community 39"
-Cohesion: 0.06
-Nodes (32): prismaMock, ResolveResult, CustomDomainType, countUnreadDms(), addUserCustomDomain(), adminApproveSubmission(), adminRejectSubmission(), castDomainVote() (+24 more)
+Cohesion: 0.08
+Nodes (23): prismaMock, adminApproveSubmission(), adminRejectSubmission(), castDomainVote(), countActiveCustomDomains(), countActiveCustomDomainsSplit(), deleteUserCustomDomain(), getActiveBlocklistCount() (+15 more)
 
 ### Community 40 - "Community 40"
 Cohesion: 0.08
@@ -1416,7 +1426,7 @@ Nodes (26): appHeader, appName, editProfile, signOut, sosLabel, sosSubtitle, sos
 
 ### Community 44 - "Community 44"
 Cohesion: 0.05
-Nodes (46): commands, description, identifier, commands, description, identifier, commands, description (+38 more)
+Nodes (40): commands, description, identifier, commands, description, identifier, commands, description (+32 more)
 
 ### Community 45 - "Community 45"
 Cohesion: 0.08
@@ -1427,8 +1437,8 @@ Cohesion: 0.08
 Nodes (33): Any, Bool, ExpoReactNativeFactoryDelegate, NSUserActivity, RCTBridge, RCTReactNativeFactory, String, UIApplication (+25 more)
 
 ### Community 47 - "Community 47"
-Cohesion: 0.06
-Nodes (34): deleteUserPosts(), listMagicRemovalCredentials(), MagicRemovalCredential, deleteAllUserCustomDomains(), deleteUserMailClassificationSamples(), deleteProfile(), createSosSession(), deleteUserSosSessions() (+26 more)
+Cohesion: 0.04
+Nodes (49): deleteUserPosts(), writeConsentRevoke(), cancelCooldown(), createCooldown(), getActiveCooldown(), resolveCooldown(), redeemDigaCode(), RedeemResult (+41 more)
 
 ### Community 48 - "Community 48"
 Cohesion: 0.27
@@ -1439,8 +1449,8 @@ Cohesion: 0.04
 Nodes (45): commands, description, identifier, commands, description, identifier, commands, description (+37 more)
 
 ### Community 50 - "Community 50"
-Cohesion: 0.07
-Nodes (19): ContentView, Bool, String, String, Binding, Bool, String, DeviceState (+11 more)
+Cohesion: 0.11
+Nodes (13): ContentView, Bool, String, String, Binding, Bool, String, ContentView (+5 more)
 
 ### Community 51 - "Community 51"
 Cohesion: 0.05
@@ -1451,8 +1461,8 @@ Cohesion: 0.07
 Nodes (38): pnpm-workspace.yaml (apps/*, backend), DiGA-Listung (BfArM) Pfad, Landesfachstelle Glücksspielsucht Niedersachsen (LSG-Nds), MHH AG Verhaltenssüchte (Prof. Astrid Müller), NBank LOI förderstrategie, FAGS-Outreach-Paket Rebreak Beta + NBank-LOIs, Fachverband Glücksspielsucht e.V. (FAGS), Bielefeld, MDM-Lock Add-On (3-5€ on top auf Pro/Legend) (+30 more)
 
 ### Community 53 - "Community 53"
-Cohesion: 0.05
-Nodes (66): CoachTabRedirect(), MailOAuthCallback(), formatCount(), Props, ProtectionLockedCard(), Stat(), CreateRoomSheet(), makeStyles() (+58 more)
+Cohesion: 0.04
+Nodes (80): CoachTabRedirect(), CooldownTestModeToggle(), DebugScreen(), DebugStub(), LogLine(), LyraEmotionPreviewCard(), ONBOARDING_STEPS, OnboardingStepValue (+72 more)
 
 ### Community 54 - "Community 54"
 Cohesion: 0.19
@@ -1479,8 +1489,8 @@ Cohesion: 0.29
 Nodes (6): buildFiles, buildTargetsCommandComponents, cFileExtensions, cleanCommandsComponents, cppFileExtensions, toolchains
 
 ### Community 60 - "Community 60"
-Cohesion: 0.13
-Nodes (26): DiGA/MDR Dossier-Plan & Arbeitsteilung, Kostenlose BfArM-Hersteller-Beratung (Klasse I/IIa-Hebel), Zweckbestimmung / Intended Use v0 (Dok 01), Indikation Glücksspielstörung (ICD-10 F63.0 / ICD-11 6C50), Intended-Use-Claim (Begleitung, kein Therapie-/Diagnose-Ersatz), MDR Rule 11 Klassifizierung (I/IIa, größter Kostenhebel), REQ-MAIL Mail-Schutz (deterministische Trigger-Mail-Entfernung), REQ-SOS Werkzeuge (4-7-8-Atemübung, Ablenkungs-Spiele) (+18 more)
+Cohesion: 0.23
+Nodes (12): DiGA/MDR Dossier-Plan & Arbeitsteilung, Kostenlose BfArM-Hersteller-Beratung (Klasse I/IIa-Hebel), Zweckbestimmung / Intended Use v0 (Dok 01), Indikation Glücksspielstörung (ICD-10 F63.0 / ICD-11 6C50), Intended-Use-Claim (Begleitung, kein Therapie-/Diagnose-Ersatz), MDR Rule 11 Klassifizierung (I/IIa, größter Kostenhebel), DSFA-Pflicht (Art. 35, auch BfArM-Antrags-Anhang), BfArM (DiGA-Verzeichnis §139e SGB V) (+4 more)
 
 ### Community 61 - "Community 61"
 Cohesion: 0.29
@@ -1507,16 +1517,16 @@ Cohesion: 0.13
 Nodes (4): RebreakProtectionModule, Module, RebreakProtectionModule, RebreakProtectionModuleWeb
 
 ### Community 67 - "Community 67"
-Cohesion: 0.16
-Nodes (24): Bool, Date, String, URL, Codable, MagicAPIClient.swift (/api/magic/*), Config, MagicAPIClient (+16 more)
+Cohesion: 0.26
+Nodes (9): URL, MagicAPIClient, MagicError, configMissing, decodingError, httpError, limitReached, networkError (+1 more)
 
 ### Community 68 - "Community 68"
-Cohesion: 0.15
-Nodes (31): refreshAndSaveTokens(), assertEnv(), clearConnectionError(), coalescePending, decrypt(), encrypt(), getCredentialsForConnection(), getKey() (+23 more)
+Cohesion: 0.14
+Nodes (30): assertEnv(), clearConnectionError(), coalescePending, decrypt(), encrypt(), getCredentialsForConnection(), getKey(), IMAP_SOCKET_ERROR_CODES (+22 more)
 
 ### Community 69 - "Community 69"
-Cohesion: 0.05
-Nodes (47): Candidate, detectAndSaveFeedback(), PROVIDER_CONFIG, SosCandidate, speakCartesia(), speakElevenLabs(), speakGoogle(), resolveTypeAndValue() (+39 more)
+Cohesion: 0.08
+Nodes (31): speakCartesia(), speakElevenLabs(), speakGoogle(), resolveTypeAndValue(), TestResolveResult, cleanupStaleDevices(), listUserDevices(), consumeVoiceQuota() (+23 more)
 
 ### Community 70 - "Community 70"
 Cohesion: 0.06
@@ -1531,12 +1541,12 @@ Cohesion: 0.09
 Nodes (28): MDM ARCHITECTURE.md (NanoMDM server stack), bootstrap-tool README.md (rebreak-supervise.sh), AdGuard Home (DoH resolver + QueryLog), Apple Push Cert Flow (mdmcert.download signing), Backup-Sandwich (backup→wipe→supervise→restore), DoH ClientID Handshake (/dns-query/<token> → CP field), macOS has no Supervision (UAMDM + RemovalPassword instead), NanoMDM Server (rebreak-mdm, 178.105.101.137) (+20 more)
 
 ### Community 73 - "Community 73"
-Cohesion: 0.11
-Nodes (23): Bool, MagicDevice, String, Timer, Void, Date, MagicDevice, String (+15 more)
+Cohesion: 0.18
+Nodes (12): Bool, MagicDevice, String, Timer, Void, HubDeviceAction, MagicUserProfile, DeviceHubView (+4 more)
 
 ### Community 74 - "Community 74"
-Cohesion: 0.11
-Nodes (29): String, Any, Binding, Bool, Configuration, ErrorDetails, Self, String (+21 more)
+Cohesion: 0.12
+Nodes (26): Any, Binding, Bool, Configuration, ErrorDetails, Self, String, CaseIterable (+18 more)
 
 ### Community 75 - "Community 75"
 Cohesion: 0.14
@@ -1555,12 +1565,12 @@ Cohesion: 0.08
 Nodes (67): AppHandle, AppConfig, AppResult, Option, String, Value, Vec, AppHandle (+59 more)
 
 ### Community 79 - "Community 79"
-Cohesion: 0.10
-Nodes (22): crisisPrompts, EvalPrompt, EXPECTED_CRISIS_MATCHES, harmlessPrompts, PROMPTS_DIR, REQ-LYRA Lyra KI-Coach & Krisen-Behandlung (höchste Sicherheitsrelevanz), Deterministischer Krisen-Keyword-Pre-Filter (crisis-filter.ts), R-LYRA-01 verpasste Krise/Suizidalität (S4, Top-Risiko) (+14 more)
+Cohesion: 0.11
+Nodes (15): crisisPrompts, EvalPrompt, EXPECTED_CRISIS_MATCHES, harmlessPrompts, PROMPTS_DIR, CrisisChip, CrisisDetectionResult, CrisisFallbackPayload (+7 more)
 
 ### Community 80 - "Community 80"
-Cohesion: 0.10
-Nodes (27): ProtectedDeviceRow(), countActiveMagicBindings(), listMagicDevices(), confirmProtectedDeviceInstalled(), countActiveProtectedDevices(), createProtectedDevice(), DEVICE_SELECT, DEVICE_SELECT_WITH_TOKEN (+19 more)
+Cohesion: 0.13
+Nodes (21): protectedDeviceIcon(), ProtectedDeviceRow(), confirmProtectedDeviceInstalled(), countActiveProtectedDevices(), createProtectedDevice(), DEVICE_SELECT, DEVICE_SELECT_WITH_TOKEN, getDeviceBlocklistMode() (+13 more)
 
 ### Community 81 - "Community 81"
 Cohesion: 0.13
@@ -1611,16 +1621,16 @@ Cohesion: 0.32
 Nodes (23): abi, artifactName, output, runtimeFiles, libraries, appmodules::@6890427a1f51a3e7e1df, core::@1b9a7d546b295b7d0867, react_codegen_lottiereactnative::@0fa4dc904d7e359a99fb (+15 more)
 
 ### Community 93 - "Community 93"
-Cohesion: 0.07
-Nodes (34): AppLayout(), DmConvUnreadSlice, iconForType(), NotificationRow(), NotificationsScreen(), EmptyState(), Props, HeroShieldCheck() (+26 more)
+Cohesion: 0.06
+Nodes (52): AppLayout(), DmConvUnreadSlice, iconForType(), NotificationRow(), NotificationsScreen(), AppHeader(), Props, EmptyState() (+44 more)
 
 ### Community 94 - "Community 94"
 Cohesion: 0.10
 Nodes (34): autoIncrement, buildType, serviceAccountKeyPath, track, build, development, preview, production (+26 more)
 
 ### Community 95 - "Community 95"
-Cohesion: 0.13
-Nodes (27): ConnectBody, ConnectResult, detectProvider(), MailProvider, PROVIDER_DOMAIN_MAP, useMailConnect(), UseMailConnectReturn, classifyMailError() (+19 more)
+Cohesion: 0.06
+Nodes (52): BulletRow(), DeactivationExplainerSheet(), Props, CreateRoomSheet(), makeStyles(), Props, FormSheet(), FormSheetProps (+44 more)
 
 ### Community 96 - "Community 96"
 Cohesion: 0.08
@@ -1675,8 +1685,8 @@ Cohesion: 0.09
 Nodes (24): backtraceGraph, commands, files, nodes, installers, paths, build, source (+16 more)
 
 ### Community 109 - "Community 109"
-Cohesion: 0.08
-Nodes (28): Bool, String, Bool, DeviceState, String, Bool, Date, Int (+20 more)
+Cohesion: 0.15
+Nodes (13): Bool, DeviceState, String, DetectorError, cfgutilMissing, deviceLocked, ideviceinfoMissing, noDevice (+5 more)
 
 ### Community 110 - "Community 110"
 Cohesion: 0.21
@@ -1687,7 +1697,7 @@ Cohesion: 0.08
 Nodes (34): bool, int, ansi_ljust(), DesignSystemGenerator, _detect_page_type(), format_ascii_box(), format_markdown(), format_master_md() (+26 more)
 
 ### Community 112 - "Community 112"
-Cohesion: 0.14
+Cohesion: 0.15
 Nodes (10): Long, String, Long, String, DomainHasher, DomainHasherTest, buildHashListBinary(), etagFor() (+2 more)
 
 ### Community 113 - "Community 113"
@@ -1700,7 +1710,7 @@ Nodes (41): commands, description, identifier, commands, description, identifier
 
 ### Community 115 - "Community 115"
 Cohesion: 0.05
-Nodes (37): commands, description, identifier, commands, description, identifier, commands, description (+29 more)
+Nodes (41): commands, description, identifier, commands, description, identifier, commands, description (+33 more)
 
 ### Community 116 - "Community 116"
 Cohesion: 0.05
@@ -1716,7 +1726,7 @@ Nodes (38): commands, description, identifier, commands, description, identifier
 
 ### Community 119 - "Community 119"
 Cohesion: 0.06
-Nodes (36): commands, description, identifier, commands, description, identifier, commands, description (+28 more)
+Nodes (38): commands, description, identifier, commands, description, identifier, commands, description (+30 more)
 
 ### Community 120 - "Community 120"
 Cohesion: 0.06
@@ -1951,14 +1961,14 @@ Cohesion: 0.07
 Nodes (28): 1. Status-Recherche: Microsoft Basic-Auth-Deprecation, 2.1 Azure-App-Registrierung, 2.2 OAuth-Flow: BFF-Pattern (Backend-mediated), 2.3 Token-Storage: Schema-Aenderung (Eskalation an rebreak-backend), 2.4 IMAP-Connect-Logik: XOAUTH2 in ImapFlow, 2.5 Token-Refresh-Flow, 2. Architektur-Plan, 3. ConnectMailSheet UX-Plan (fuer rebreak-native-ui-Agent) (+20 more)
 
 ### Community 178 - "Community 178"
-Cohesion: 0.09
-Nodes (20): autoSyncComplete, autoSyncing, backendRows, deviceIdRef, deviceName, {
+Cohesion: 0.08
+Nodes (21): autoSyncComplete, autoSyncing, backendRows, deviceIdRef, deviceName, {
   downloadAndPatchEnrollmentProfile,
   startLocalProfileServer,
   stopLocalProfileServer,
   getInstalledProfiles,
   mdmPush,
-}, incompleteMessage, isProtectionIncomplete (+12 more)
+}, incompleteMessage, isProtectionIncomplete (+13 more)
 
 ### Community 179 - "Community 179"
 Cohesion: 0.07
@@ -2145,8 +2155,8 @@ Cohesion: 0.09
 Nodes (21): artifacts, backtrace, backtraceGraph, commands, files, nodes, compileGroups, id (+13 more)
 
 ### Community 225 - "Community 225"
-Cohesion: 0.22
-Nodes (9): bundle, active, externalBin, icon, macOS, targets, entitlements, frameworks (+1 more)
+Cohesion: 0.11
+Nodes (15): Candidate, detectAndSaveFeedback(), PROVIDER_CONFIG, SosCandidate, deleteMemoryById(), enforceMaxMemories(), getMemoriesForUser(), LyraMemoryRow (+7 more)
 
 ### Community 226 - "Community 226"
 Cohesion: 0.08
@@ -2262,7 +2272,7 @@ Nodes (21): artifacts, backtrace, backtraceGraph, commands, files, nodes, compil
 
 ### Community 254 - "Community 254"
 Cohesion: 0.16
-Nodes (17): String, Void, Bool, String, Void, Int32, ProcessRunner, LineBuffer (+9 more)
+Nodes (18): String, Void, Bool, String, Void, Int32, LocalizedError, ProcessRunner (+10 more)
 
 ### Community 255 - "Community 255"
 Cohesion: 0.21
@@ -2297,8 +2307,8 @@ Cohesion: 0.16
 Nodes (9): Any, Bool, Int, String, URL, SharedLogStore, ModuleDefinition, NETunnelProviderManager (+1 more)
 
 ### Community 263 - "Community 263"
-Cohesion: 0.13
-Nodes (26): Bool, Data, Double, Int, String, UInt32, Bool, Data (+18 more)
+Cohesion: 0.12
+Nodes (29): Bool, Data, Double, Int, String, UInt32, Bool, Data (+21 more)
 
 ### Community 264 - "Community 264"
 Cohesion: 0.16
@@ -2361,8 +2371,8 @@ Cohesion: 0.18
 Nodes (10): Bool, ConfigurationModel, ErrorDetails, String, TimeInterval, View, ContentViewModel, ActivationButtonAction (+2 more)
 
 ### Community 279 - "Community 279"
-Cohesion: 0.13
-Nodes (17): identifier, productName, $schema, version, app, security, build, beforeBuildCommand (+9 more)
+Cohesion: 0.11
+Nodes (21): app, security, windows, identifier, productName, $schema, csp, version (+13 more)
 
 ### Community 280 - "Community 280"
 Cohesion: 0.11
@@ -2397,8 +2407,8 @@ Cohesion: 0.22
 Nodes (8): Bool, Int, Never, String, Task, Void, EnrollView, TransferAnimationView
 
 ### Community 288 - "Community 288"
-Cohesion: 0.19
-Nodes (10): VALID_COUNTRIES, SUPPORTED_COUNTRIES, SupportedCountry, CuratedDomainStatus, decideCuratedDomain(), getCuratedDomains(), suggestCuratedDomain(), PUBLIC_EMAIL_DOMAINS (+2 more)
+Cohesion: 0.11
+Nodes (15): VALID_COUNTRIES, ResolveResult, CustomDomainType, SUPPORTED_COUNTRIES, SupportedCountry, CuratedDomainStatus, decideCuratedDomain(), getCuratedDomains() (+7 more)
 
 ### Community 289 - "Community 289"
 Cohesion: 0.13
@@ -2809,8 +2819,8 @@ Cohesion: 0.12
 Nodes (16): blocked, back_to_app, clean, day, days, lyra, message, quote_1 (+8 more)
 
 ### Community 391 - "Community 391"
-Cohesion: 0.14
-Nodes (12): MainApplication, Application, Configuration, Bool, String, TimeInterval, URL, Hasher (+4 more)
+Cohesion: 0.22
+Nodes (6): MainApplication, Application, Configuration, ReactApplication, ReactHost, ReactNativeHost
 
 ### Community 392 - "Community 392"
 Cohesion: 0.12
@@ -2829,8 +2839,8 @@ Cohesion: 0.12
 Nodes (16): description, displayName, folderStructure, filename, root, skillPath, frontmatter, description (+8 more)
 
 ### Community 396 - "Community 396"
-Cohesion: 0.13
-Nodes (16): Self, String, Double, String, URL, AsyncParsableCommand, BloomFilterTool, BloomFilterToolDefaults (+8 more)
+Cohesion: 0.29
+Nodes (8): Double, String, URL, AsyncParsableCommand, BloomFilterTool, BloomFilterToolDefaults, RuntimeError, Error
 
 ### Community 397 - "Community 397"
 Cohesion: 0.12
@@ -2921,20 +2931,20 @@ Cohesion: 0.17
 Nodes (12): Apple_SwiftHomomorphicEncryption_Pir_V1_KeywordDatabaseRow, Bool, Data, String, _2, Apple_SwiftHomomorphicEncryption_Pir_V1_KeywordDatabase, _GeneratedWithProtocGenSwiftVersion, D (+4 more)
 
 ### Community 419 - "Community 419"
-Cohesion: 0.20
-Nodes (9): BloomFilter, NEProviderStopReason, NEURLFilterPrefilter, String, NEURLFilterControlProvider, ExtLog, ProviderFilterError, loadError (+1 more)
+Cohesion: 0.22
+Nodes (8): BloomFilter, NEProviderStopReason, NEURLFilterPrefilter, String, ExtLog, ProviderFilterError, loadError, RebreakURLFilterControlProvider
 
 ### Community 420 - "Community 420"
 Cohesion: 0.24
 Nodes (8): Bool, Int, Never, String, Task, UInt64, Void, ConfigureView
 
 ### Community 421 - "Community 421"
-Cohesion: 0.18
-Nodes (10): String, Int, WizardStep, configure, done, enroll, macRegistration, preflight (+2 more)
+Cohesion: 0.13
+Nodes (13): String, String, Identifiable, Int, WizardStep, configure, done, enroll (+5 more)
 
 ### Community 422 - "Community 422"
-Cohesion: 0.13
-Nodes (17): Country-Curated Layer-2 Blocklist (50-cap), Pro=10/Legend=20 Custom-Domain Slots (refillable), Layer1/Layer2 Decoupling (Custom vs Country-Curated), Layer-2 Country-Pivot Plan, Travel-Detection via Cellular-MCC, REQ-MAGIC Selbstbindung (RebreakMagic Lock-Modus, 24h-Cooldown), R-BYP-03 Selbstbindung wird zur Falle (legitimer Ausstieg scheitert), SAFETY-REQ-LLM-002 Sicherheits-Grenzen (Rollen-Integrität, Refusal) (+9 more)
+Cohesion: 0.21
+Nodes (12): Country-Curated Layer-2 Blocklist (50-cap), Pro=10/Legend=20 Custom-Domain Slots (refillable), Layer1/Layer2 Decoupling (Custom vs Country-Curated), Layer-2 Country-Pivot Plan, Travel-Detection via Cellular-MCC, Rive Animator Brief — Lyra Avatar, Lyra Avatar Rive Emotion-State Animation, Timeline-Name Code-Contract (no-rename) (+4 more)
 
 ### Community 423 - "Community 423"
 Cohesion: 0.14
@@ -3002,8 +3012,8 @@ Cohesion: 0.14
 Nodes (17): ChipSpec, detectEmotion(), LyraEmotion, parseLyraResponse(), BREATH_PHASES, BreathPhase, BreathState, Chip (+9 more)
 
 ### Community 438 - "Community 438"
-Cohesion: 0.22
-Nodes (10): Bool, String, LocalizedError, MagicRegistration, InstallerError, downloadFailed, installFailed, noRegistration (+2 more)
+Cohesion: 0.24
+Nodes (9): Bool, String, MagicRegistration, InstallerError, downloadFailed, installFailed, noRegistration, MacProfileInstaller (+1 more)
 
 ### Community 439 - "Community 439"
 Cohesion: 0.17
@@ -3034,8 +3044,8 @@ Cohesion: 0.18
 Nodes (10): extTargetUuid, fs, hasDepToExt, mainTarget, newPhase, path, PBXPROJ, project (+2 more)
 
 ### Community 446 - "Community 446"
-Cohesion: 0.22
-Nodes (11): FilteringTrafficByURL LICENSE (Apple, MIT-style), Filtering Traffic by URL (Apple SimpleURLFilter sample), Setting up a PIR Server for URL Filtering, blocklist.bin SHA-256 prefix hash pipeline (cross-platform), DNS-Sinkhole NXDOMAIN Filter Design (Android parity), iOS VPN/DNS Tunnel Gambling-Filter Research & Proposal, iOS webContent 50-Domain Cap (Apple-documented), Layer-2 not built as Always-On Fallback (too weak) (+3 more)
+Cohesion: 0.32
+Nodes (8): blocklist.bin SHA-256 prefix hash pipeline (cross-platform), DNS-Sinkhole NXDOMAIN Filter Design (Android parity), iOS VPN/DNS Tunnel Gambling-Filter Research & Proposal, iOS webContent 50-Domain Cap (Apple-documented), Layer-2 not built as Always-On Fallback (too weak), NEPacketTunnelProvider chosen over NEDNSProxyProvider/NEAppProxyProvider, WebContent Layer-2 ManagedSettings Filter Research, Spike Domains List (gambling domains)
 
 ### Community 447 - "Community 447"
 Cohesion: 0.24
@@ -3959,7 +3969,7 @@ Nodes (3): info, author, version
 
 ### Community 686 - "Community 686"
 Cohesion: 0.18
-Nodes (13): formatTimestamp(), MessageRow(), Props, st, CardType, GameHeader(), MessageRow(), MessageRowProps (+5 more)
+Nodes (13): MessageRow(), Emotion, Props, st, CardType, GameHeader(), MessageRow(), MessageRowProps (+5 more)
 
 ### Community 687 - "Community 687"
 Cohesion: 0.12
@@ -4006,16 +4016,16 @@ Cohesion: 1.00
 Nodes (3): Deploy Pipeline (deploy.sh, atomic .output-staging swap, pm2), WEBHOOK_MIGRATION_PLAN.md (standalone→Nitro endpoint), GitHub Webhook as Nitro API Endpoint (Trucko pattern)
 
 ### Community 750 - "Community 750"
-Cohesion: 0.15
-Nodes (24): ChatHeaderStatus(), formatLastSeen(), Props, OnlinePresenceProvider(), PresenceContextExtended, PresenceVisibilityContext, Props, usePresenceVisibility() (+16 more)
+Cohesion: 0.07
+Nodes (42): DeviceLimitScreen(), ChatHeaderStatus(), formatLastSeen(), Props, DeviceApprovalIncomingSheet(), platformIcon(), UserDevice, DeviceApprovalPendingSheet() (+34 more)
 
 ### Community 759 - "Community 759"
 Cohesion: 0.13
 Nodes (14): Abhaengigkeiten, Bekannte Provider-Quirks, Datei-Übersicht, Kontext, MAIL_DAEMON_DEPLOYMENT — Backyard Handoff, Rollback-Plan, Schritt 1 — GH-Actions: imap-idle ins Artifact einschließen, Schritt 2 — npm install auf Server (+6 more)
 
 ### Community 863 - "Community 863"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, allow-prepend
+Cohesion: 0.10
+Nodes (21): commands, description, identifier, commands, description, identifier, commands, description (+13 more)
 
 ### Community 864 - "Community 864"
 Cohesion: 0.13
@@ -4046,8 +4056,8 @@ Cohesion: 0.13
 Nodes (14): description, displayName, folderStructure, filename, root, skillPath, frontmatter, installType (+6 more)
 
 ### Community 871 - "Community 871"
-Cohesion: 0.10
-Nodes (22): POST /api/magic/register Endpoint, GET /api/magic/status Endpoint, NanoMDM Server (mdm.rebreak.org), supervise-magic Go-CLI Binary, ReBreak Magic Mac App, AuthService.swift (Supabase + Keychain), ReBreak Magic Mac Phase 2 Summary, MacProfileInstaller.swift (DNS-Filter Profile) (+14 more)
+Cohesion: 0.18
+Nodes (12): POST /api/magic/register Endpoint, GET /api/magic/status Endpoint, MacProfileInstaller.swift (DNS-Filter Profile), 24h-Cooldown Server-Timed Deactivation, ReBreak Magic Windows App (Tauri 2), Eigene DoH-Infra (dns.rebreak.org, AdGuard), ReBreak Magic Windows index.html, ReBreak Magic Windows README (+4 more)
 
 ### Community 872 - "Community 872"
 Cohesion: 0.26
@@ -4066,8 +4076,8 @@ Cohesion: 0.14
 Nodes (14): 3.1 Produkt-Überblick, 3.2 Geräteschutz (Layer 1), 3.3 Mail-Schutz (Layer 2), 3.4 Lyra — KI-Coach (Layer 3), 3.5 Streak, Community, Onboarding, 3.6 Rebreak Magic — Selbstbindungs-Modus (optional), 3.7 Multi-Device, 3.8 Tech-Stack (Kurzfassung) (+6 more)
 
 ### Community 876 - "Community 876"
-Cohesion: 0.21
-Nodes (8): BloomFilter, NEProviderStopReason, NEURLFilterPrefilter, String, NEProviderStopReason, ProviderFilterError, loadError, URLFilterControlProvider
+Cohesion: 0.19
+Nodes (9): BloomFilter, NEProviderStopReason, NEURLFilterPrefilter, String, NEURLFilterControlProvider, NEProviderStopReason, ProviderFilterError, loadError (+1 more)
 
 ### Community 877 - "Community 877"
 Cohesion: 0.18
@@ -4238,8 +4248,8 @@ Cohesion: 0.70
 Nodes (3): WizardStep, Color, StepIndicator
 
 ### Community 928 - "Community 928"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, allow-set-accelerator
+Cohesion: 0.14
+Nodes (25): AnimatedCounter(), DeltaBadge(), FaqItem(), KpiCard(), LegendItem(), Props, ProtectionDetailsSheet(), StatsResponse (+17 more)
 
 ### Community 930 - "Community 930"
 Cohesion: 0.14
@@ -4338,8 +4348,8 @@ Cohesion: 0.17
 Nodes (11): author, description, displayName, homepage, install, keywords, license, name (+3 more)
 
 ### Community 954 - "Community 954"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, allow-set-enabled
+Cohesion: 0.14
+Nodes (12): DmConversation, ALLOWED_EMOJIS, countUnreadDms(), createChatMessage(), DmConversationRow, getChatMessages(), getDmConversations(), getDmHistory() (+4 more)
 
 ### Community 955 - "Community 955"
 Cohesion: 0.47
@@ -4450,8 +4460,8 @@ Cohesion: 0.22
 Nodes (8): Architektur, Backend-Änderungen (in diesem Repo, additiv), Bekannte Limitationen (v1), Bewusste Abweichungen vom ursprünglichen Prompt-Dokument, Build (Windows-Maschine), Entwicklung (macOS), Flow, ReBreak Magic für Windows
 
 ### Community 982 - "Community 982"
-Cohesion: 0.20
-Nodes (10): bundle, active, externalBin, icon, targets, windows, windows, installMode (+2 more)
+Cohesion: 0.11
+Nodes (19): bundle, active, externalBin, icon, targets, windows, bundle, active (+11 more)
 
 ### Community 983 - "Community 983"
 Cohesion: 0.22
@@ -4486,8 +4496,8 @@ Cohesion: 0.22
 Nodes (9): artifactName, react_codegen_rngesturehandler_codegen::@39f233abcd2c728bc6ec, react_codegen_RNMenuViewSpec::@8c49e93dd4e1930e04c8, abi, artifactName, runtimeFiles, abi, artifactName (+1 more)
 
 ### Community 991 - "Community 991"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, allow-supports-multiple-windows
+Cohesion: 0.17
+Nodes (15): Bool, String, Bool, Date, Int, String, EnrollmentStatus, Equatable (+7 more)
 
 ### Community 992 - "Community 992"
 Cohesion: 0.22
@@ -4518,8 +4528,8 @@ Cohesion: 0.22
 Nodes (9): abi, react_codegen_lottiereactnative::@0fa4dc904d7e359a99fb, react_codegen_RNCTabView::@54948b52a0aeebf4e5a8, abi, artifactName, toolchain, abi, artifactName (+1 more)
 
 ### Community 999 - "Community 999"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, deny-identifier
+Cohesion: 0.15
+Nodes (19): core, core:app, default_permission, global_scope_schema, permission_sets, default_permission, core:event, default_permission (+11 more)
 
 ### Community 1000 - "Community 1000"
 Cohesion: 0.22
@@ -4650,8 +4660,8 @@ Cohesion: 0.29
 Nodes (6): default, description, identifier, local, permissions, windows
 
 ### Community 1032 - "Community 1032"
-Cohesion: 0.25
-Nodes (8): Anonymitäts-Invariante (kein PII in API/Realtime/Push/Log), R-DATA-07 Anonymitätsbruch (Klarname-Leak), Art. 9 DSGVO besondere Kategorien (höchste Schutzstufe), Keine OASIS-Datenbank-Kopplung (Art. 9 DSGVO Vermeidung), CallKit + VoIP Setup für ReBreak, includesCallsInRecents:false (DiGA-Privacy, kein iCloud-Sync), Voice-Calls coturn TURN-Server Runbook, coturn force-relay (kein IP-Austausch, Anonymität)
+Cohesion: 0.12
+Nodes (26): Anonymitäts-Invariante (kein PII in API/Realtime/Push/Log), REQ-LYRA Lyra KI-Coach & Krisen-Behandlung (höchste Sicherheitsrelevanz), REQ-MAGIC Selbstbindung (RebreakMagic Lock-Modus, 24h-Cooldown), REQ-MAIL Mail-Schutz (deterministische Trigger-Mail-Entfernung), REQ-SOS Werkzeuge (4-7-8-Atemübung, Ablenkungs-Spiele), Anforderungen / Requirements v0 (Dok 03, 57 REQ-IDs), Deterministischer Krisen-Keyword-Pre-Filter (crisis-filter.ts), Risikomanagement-Akte v0 (Dok 04, ISO 14971) (+18 more)
 
 ### Community 1033 - "Community 1033"
 Cohesion: 0.29
@@ -4998,8 +5008,8 @@ Cohesion: 0.50
 Nodes (3): canContinue, checkEnrollment(), refreshProfileList()
 
 ### Community 1119 - "Community 1119"
-Cohesion: 0.50
-Nodes (4): app, security, windows, csp
+Cohesion: 0.30
+Nodes (15): Bool, Date, String, Codable, MagicAPIClient.swift (/api/magic/*), Config, MagicDevice, MagicDeviceSource (+7 more)
 
 ### Community 1120 - "Community 1120"
 Cohesion: 0.40
@@ -5418,32 +5428,32 @@ Cohesion: 0.50
 Nodes (4): default, description, type, local
 
 ### Community 1225 - "Community 1225"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, deny-is-checked
+Cohesion: 0.23
+Nodes (11): Date, MagicDevice, String, Timer, Void, DeviceAction, DeviceAction, cancelRelease (+3 more)
 
 ### Community 1226 - "Community 1226"
 Cohesion: 0.50
 Nodes (4): commands, description, identifier, deny-items
 
 ### Community 1227 - "Community 1227"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, allow-default-window-icon
+Cohesion: 0.21
+Nodes (8): Self, String, Display, Formatter, From, Into, Result, AppError
 
 ### Community 1228 - "Community 1228"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, allow-fetch-data-store-identifiers
+Cohesion: 0.22
+Nodes (6): DeviceState, Never, String, Task, Void, WelcomeView
 
 ### Community 1229 - "Community 1229"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, allow-get
+Cohesion: 0.24
+Nodes (10): NanoMDM Server (mdm.rebreak.org), supervise-magic Go-CLI Binary, ReBreak Magic Mac App, AuthService.swift (Supabase + Keychain), ReBreak Magic Mac Phase 2 Summary, rebreak-magic-mac XcodeGen project.yml, ReBreak Magic Mac README, Rebreak Magic Mac (Self-Bind Wizard) (+2 more)
 
 ### Community 1230 - "Community 1230"
 Cohesion: 0.50
 Nodes (4): commands, description, identifier, allow-identifier
 
 ### Community 1231 - "Community 1231"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, deny-name
+Cohesion: 0.33
+Nodes (6): Bool, String, TimeInterval, URL, Hasher, Configuration
 
 ### Community 1232 - "Community 1232"
 Cohesion: 0.50
@@ -5454,12 +5464,12 @@ Cohesion: 0.50
 Nodes (4): commands, description, identifier, allow-is-enabled
 
 ### Community 1234 - "Community 1234"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, deny-register-listener
+Cohesion: 0.25
+Nodes (8): Maestro E2E Test-Schicht (Mobile App, ~20 Flows), Software-Verifikation Test-Nachweis v0 (Dok 05b, IEC 62304), Fehlende Traceability-Matrix (Tests↔Anforderungen↔Risiken), Vitest Unit-/Integrationstests (Backend, 21 Dateien), Crisis-Detection-Recall (Haupt-Metrik, Ziel 100%, DiGA-Blocker), Lyra LLM-Evaluierungssuite v0 (Dok 05c), SAFETY-REQ-LLM-002 Sicherheits-Grenzen (Rollen-Integrität, Refusal), Verbotenes Pathologisierungs-Vokabular (Sucht/süchtig/Therapie)
 
 ### Community 1235 - "Community 1235"
-Cohesion: 0.12
-Nodes (17): commands, description, identifier, commands, description, identifier, deny, commands (+9 more)
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, allow-popup
 
 ### Community 1236 - "Community 1236"
 Cohesion: 0.50
@@ -5470,8 +5480,8 @@ Cohesion: 0.50
 Nodes (4): commands, description, identifier, deny-version
 
 ### Community 1238 - "Community 1238"
-Cohesion: 0.50
-Nodes (4): commands, description, identifier, allow-remove
+Cohesion: 0.40
+Nodes (6): ReBreak Magic RE-Hardening Assessment & Plan, Admin-User kann alles aufheben (echter Schutz = Cooldown+Psychologie), Server-seitige Token-Revocation (Kern-Sicherheit im Backend), DNS-Token DPAPI-Verschlüsselung (Windows), Windows protection.json ACL-Härtung (DNS-Token-Schutz), Windows Service-Name-Bypass (sc.exe stop RebreakProtection)
 
 ### Community 1239 - "Community 1239"
 Cohesion: 0.50
@@ -5485,6 +5495,10 @@ Nodes (4): commands, description, identifier, allow-set-app-theme
 Cohesion: 0.50
 Nodes (4): commands, description, identifier, allow-set-as-windows-menu-for-nsapp
 
+### Community 1243 - "Community 1243"
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, allow-append
+
 ### Community 1244 - "Community 1244"
 Cohesion: 0.50
 Nodes (4): commands, description, identifier, allow-set-icon
@@ -5493,6 +5507,10 @@ Nodes (4): commands, description, identifier, allow-set-icon
 Cohesion: 0.50
 Nodes (4): commands, description, identifier, allow-set-text
 
+### Community 1246 - "Community 1246"
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, allow-create-default
+
 ### Community 1247 - "Community 1247"
 Cohesion: 0.50
 Nodes (4): commands, description, identifier, allow-text
@@ -5511,7 +5529,11 @@ Nodes (4): commands, description, identifier, deny-bundle-type
 
 ### Community 1251 - "Community 1251"
 Cohesion: 0.50
-Nodes (4): commands, description, identifier, deny-fetch-data-store-identifiers
+Nodes (4): commands, description, identifier, allow-items
+
+### Community 1252 - "Community 1252"
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, allow-new
 
 ### Community 1253 - "Community 1253"
 Cohesion: 0.50
@@ -5523,11 +5545,31 @@ Nodes (4): react_codegen_RNMenuViewSpec::@8c49e93dd4e1930e04c8, abi, artifactNam
 
 ### Community 1255 - "Community 1255"
 Cohesion: 0.50
-Nodes (4): commands, description, identifier, deny-is-enabled
+Nodes (4): commands, description, identifier, allow-remove-data-store
+
+### Community 1256 - "Community 1256"
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, allow-remove-listener
+
+### Community 1257 - "Community 1257"
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, allow-set-as-window-menu
+
+### Community 1258 - "Community 1258"
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, deny-app-hide
+
+### Community 1259 - "Community 1259"
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, deny-create-default
 
 ### Community 1260 - "Community 1260"
 Cohesion: 0.50
-Nodes (4): commands, description, identifier, deny-supports-multiple-windows
+Nodes (4): commands, description, identifier, deny-default-window-icon
+
+### Community 1261 - "Community 1261"
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, deny-remove-data-store
 
 ### Community 1262 - "Community 1262"
 Cohesion: 0.50
@@ -5569,6 +5611,10 @@ Nodes (4): react_codegen_rnworklets::@68f58d84d4754f193387, abi, artifactName, r
 Cohesion: 0.50
 Nodes (4): react_codegen_RNCTabView::@54948b52a0aeebf4e5a8, abi, artifactName, toolchain
 
+### Community 1272 - "Community 1272"
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, deny-set-dock-visibility
+
 ### Community 1273 - "Community 1273"
 Cohesion: 0.50
 Nodes (4): react_codegen_rngesturehandler_codegen::@39f233abcd2c728bc6ec, abi, artifactName, runtimeFiles
@@ -5637,6 +5683,10 @@ Nodes (4): react_codegen_RNCTabView::@54948b52a0aeebf4e5a8, abi, artifactName, r
 Cohesion: 0.50
 Nodes (4): react_codegen_RNMenuViewSpec::@8c49e93dd4e1930e04c8, abi, artifactName, runtimeFiles
 
+### Community 1290 - "Community 1290"
+Cohesion: 0.50
+Nodes (4): commands, description, identifier, deny-tauri-version
+
 ### Community 1291 - "Community 1291"
 Cohesion: 0.50
 Nodes (4): react_codegen_rnreanimated::@8afabad14bfffa3f8b9a, abi, artifactName, runtimeFiles
@@ -5674,23 +5724,23 @@ Cohesion: 0.67
 Nodes (3): ShellScopeEntryAllowedArgs, anyOf, description
 
 ## Knowledge Gaps
-- **10530 isolated node(s):** `deviceIdRef`, `{ state: mdmState, refresh: refreshMdmStatus }`, `manualSyncing`, `autoSyncing`, `autoSyncComplete` (+10525 more)
+- **10531 isolated node(s):** `deviceIdRef`, `{ state: mdmState, refresh: refreshMdmStatus }`, `router`, `manualSyncing`, `autoSyncing` (+10526 more)
   These have ≤1 connection - possible missing edges or undocumented components.
 - **65 thin communities (<3 nodes) omitted from report** — run `graphify query` to explore isolated nodes.
 
 ## Suggested Questions
 _Questions this graph is uniquely positioned to answer:_
 
-- **Why does `Notification` connect `Community 39` to `Community 53`, `Debug & Dev Tools`, `Community 93`, `Community 181`?**
+- **Why does `useColors()` connect `Community 53` to `Backend API Routes`, `Community 1030`, `Consent & Magic API Routes`, `i18n: Pricing Strings`, `App Root Layout & Shell`, `Community 18`, `Community 20`, `Community 21`, `Community 22`, `Community 27`, `Community 413`, `Community 928`, `Community 34`, `Community 37`, `Community 39`, `Community 426`, `Community 686`, `Community 437`, `Community 449`, `Community 80`, `Community 93`, `Community 95`, `Community 865`, `Community 872`, `Community 750`?**
+  _High betweenness centrality (0.035) - this node is a cross-community bridge._
+- **Why does `Notification` connect `Community 39` to `Debug & Dev Tools`, `Community 47`, `Community 53`, `Community 181`, `Community 954`, `Community 93`?**
   _High betweenness centrality (0.034) - this node is a cross-community bridge._
-- **Why does `useColors()` connect `Community 53` to `Backend API Routes`, `Community 1030`, `Consent & Magic API Routes`, `i18n: Pricing Strings`, `App Root Layout & Shell`, `Community 18`, `Community 20`, `Community 21`, `Community 22`, `Community 27`, `Community 413`, `Community 34`, `Community 37`, `Community 39`, `Community 426`, `Community 686`, `Community 437`, `Community 449`, `Community 80`, `Community 93`, `Community 95`, `Community 865`, `Community 872`?**
-  _High betweenness centrality (0.033) - this node is a cross-community bridge._
-- **Why does `Error` connect `Community 396` to `Community 290`, `Community 355`, `Community 419`, `Community 67`, `Community 263`, `Community 74`, `Community 876`, `Community 109`, `Community 81`, `Community 883`, `Community 212`, `Community 213`, `Community 117`, `Community 438`, `Community 122`, `Community 254`, `Community 607`?**
-  _High betweenness centrality (0.031) - this node is a cross-community bridge._
+- **Why does `Error` connect `Community 396` to `Community 263`, `Community 290`, `Community 419`, `Community 438`, `Community 67`, `Community 74`, `Community 1227`, `Community 81`, `Community 212`, `Community 213`, `Community 991`, `Community 607`, `Community 355`, `Community 876`, `Community 109`, `Community 883`, `Community 117`, `Community 122`, `Community 254`?**
+  _High betweenness centrality (0.027) - this node is a cross-community bridge._
 - **Are the 2 inferred relationships involving `usePrisma()` (e.g. with `runRevoke()` and `requireUser()`) actually correct?**
   _`usePrisma()` has 2 INFERRED edges - model-reasoned connections that need verification._
-- **What connects `deviceIdRef`, `{ state: mdmState, refresh: refreshMdmStatus }`, `manualSyncing` to the rest of the system?**
-  _10632 weakly-connected nodes found - possible documentation gaps or missing edges._
+- **What connects `deviceIdRef`, `{ state: mdmState, refresh: refreshMdmStatus }`, `router` to the rest of the system?**
+  _10633 weakly-connected nodes found - possible documentation gaps or missing edges._
 - **Should `i18n: Blocker/Activation Strings` be split into smaller, more focused modules?**
   _Cohesion score 0.006644518272425249 - nodes in this community are weakly interconnected._
 - **Should `i18n: Blocker/Activation Strings` be split into smaller, more focused modules?**

graphify-out/manifest.json

@@ -8470,8 +8470,8 @@
     "semantic_hash": ""
   },
   "/Users/chahinebrini/mono/rebreak-monorepo/apps/rebreak-magic/app/components/IosDeviceCard.vue": {
-    "mtime": 1781761966.7144916,
-    "ast_hash": "9d496e8bd4ab158d208bd99b502d72e1",
+    "mtime": 1781762800.771557,
+    "ast_hash": "df6d74de8613c2691b24b9364e3b1aec",
     "semantic_hash": ""
   },
   "/Users/chahinebrini/mono/rebreak-monorepo/apps/rebreak-magic/app/components/IosDeviceSection.vue": {
@@ -9330,8 +9330,8 @@
     "semantic_hash": ""
   },
   "/Users/chahinebrini/mono/rebreak-monorepo/.woodpecker.yml": {
-    "mtime": 1781761963.5429966,
-    "ast_hash": "98b12c1882f695586f627d67619c14a9",
+    "mtime": 1781762915.404928,
+    "ast_hash": "db4af617a79ef4824d4b2e061088b0ec",
     "semantic_hash": ""
   }
 }