CIOport

A trading terminal with an event-intelligence overlay.

Live at cioport.app

Next CIOport update gates on CIOport becoming a product. It gets scheduled only after I understand what users need, not before. 0.1.2/M8 is the furthest I can take CIOport without solid product judgment and user understanding. M9 and beyond will be developed but not deployed until product decision.

CIOport is a cockpit that binds macro/geopolitical events to your own holdings — “this event just touched these positions you hold” — and surfaces it as explainable, advisory hints inside an actionable trading terminal. At its center is the event→asset linkage engine: a join across events × your portfolio × market data × news, rendered as hints on the assets you actually hold, alongside an event-on-map monitor, a positions/P&L dashboard, holdings-bound alerts, and (paper-first) order entry.

Architecture

CIOport is built as three zones over one hexagonal core, with a single shared linkage kernel that runs on two hosts:

• Edge — object storage + CDN serving per-layer, content-addressed, immutable snapshots under a signed manifest that pins a co-valid epoch, regenerated on a schedule; open layers are public and private layers (e.g. quotes-driven P&L, news) sit behind a lightweight auth gate.
• Client — a TypeScript SPA that joins the broadcast snapshot to your local holdings and renders the advisory faces: event→asset hints, estimated P&L, the event monitor.
• Server — a Go modular monolith holding the core that stays server-side: alerts, execution, authoritative persistence, ingestion, and licensed data.

One shared Rust→WASM linkage kernel runs in the browser (Web Worker), in the producer (via wazero, in-process), and in the local MCP connector (Node) — one scoring logic, three hosts, byte-identical output at equal snapshot + kernel version. Tenancy (org_id) and the ApprovalPort are parameters: single-user is the degenerate org_id = self + pass-through case; a team config is the same structure with maker-checker populated. The action space stays advisory — notify / highlight, never auto-trade; a human initiates every order, and broker secrets never leave the backend.

Zone	Responsibility
Edge (object storage + CDN)	Per-layer immutable snapshot artifacts + signed manifest (the atomic consistency point)
Client (TS SPA + Web Worker)	UI cockpit + client-side compute: hint join, estimated P&L, snapshot cache
Server (Go modular monolith)	Read-model domain modules · Intelligence (alerts + snapshot publisher) · Execution write plane · Postgres + ingestion
Shared kernel (Rust→WASM)	One linkage/scoring logic hosted on both the browser and the server
Ports & adapters	EventProvider (GDELT) · MarketDataProvider (Polygon/Twelve Data) · NewsProvider (Marketaux/Tiingo) · BrokerPort (paper default · IBKR/Saxo/Alpaca/crypto)

Current architecture (M0–M4)

The table above is the full target shape; the always-on server (eager alerts, execution / broker, Postgres, O(feeds) ingestion) is not built yet. What runs today is a strict subset — a scheduled producer publishes immutable snapshots to a CDN, and a browser computes over them. There is no always-on origin:

                free, no-key public sources
   GDELT · Yahoo · USGS/EONET/GDACS · CoinGecko · FRED · Finnhub
        · UCDP / GPR / V-Dem · wire & Google News
                              │  capture
                              ▼
┌─ PRODUCER — scheduled job (serverless cron · scale-to-zero) ─────────────────┐
│  capture sources → score (anomaly · trend · composite risk, weights-as-data) │
│  → assemble per-layer immutable snapshot → SIGN a co-valid manifest          │
└───────────────────────────────────┬──────────────────────────────────────────┘
                                    │  publish (~15 min)
                                    ▼
┌─ EDGE — object storage + CDN  (+ the static SPA) ────────────────────────────┐
│  PUBLIC :  events · composite · baseline · trend · reference · rules         │
│            · SIGNED MANIFEST (pins a co-valid epoch) · basemap               │
│  PRIVATE:  quotes · news    →   served only through the auth gate            │
└──────────────┬─────────────────────────────────────┬─────────────────────────┘
    fetch      │  SPA + public layers + manifest     │  private layers
               ▼                                     ▼  (Bearer JWT)
┌─ CLIENT — TypeScript SPA + Web Worker (your browser) ────────────────────────┐
│  cockpit: event map · composite scores · news/signal feed · indicators ·     │
│           portfolio overlay · est. P&L                                       │
│  Web Worker — Rust→WASM kernel:  verify signed manifest → hint join          │
│    (events × your local holdings) · est. P&L · indicators · scenario what-if │
│    · in-app alert when a fresh event touches a holding                       │
└──────────────────────────────────────────────────────────────────────────────┘

  auth: the edge gate is also the token issuer — sign-in delegates to an external
  identity provider (OIDC), and the edge mints the short-lived session JWT it then
  checks before serving the private layers — the public plane needs no sign-in.
  the SAME Rust→WASM kernel runs in the browser AND in the producer (one logic).

Tech stack

• Server: Go (modular monolith)
• Shared kernel: Rust → WebAssembly (browser Web Worker + server via wazero)
• Client: TypeScript SPA (Vite) + Web Worker
• Data: Postgres
• Schema pipeline: Rust serde structs → JSON Schema → generated Go + TypeScript (single source of truth)

Current state

Build underway — M0–M8 complete and live: the monitor is live, holdings-bound, refreshed on a cadence, given an interface & brand pass, built out into a full analysis terminal, hardened for integrity with its snapshot verified before compute, deepened with more sources and correlation, and extended into new product surfaces — replayable history, portability, shareable views, an AI connector, and a rule builder. Beyond the deployed line, M9 (server-side sync) and M10 (push alerts + the mobile app) are built on branch but not yet deployed (per the note at the top) — the first always-on server, cross-device holdings, server-eager push that fires with the tab closed, the native Android/iOS app, and extra alert channels. The architecture is settled (docs/CIOPORT_ARCHITECTURE.md); the build is sequenced UI/intelligence-first and QC-gated milestone by milestone (docs/CIOPORT_DEVELOPMENT.md, executable steps in docs/CIOPORT_M0_STEPS.md … docs/CIOPORT_M10_STEPS.md).

M0 — Boot contracts laid the foundation: the schema contract (Rust→Go+TS with a drift gate), the Rust→WASM kernel with its host ABI and a browser round-trip, and a Vite SPA + Web Worker shell.

M1 — Intelligence monitor is the monitor itself: open the app and see a macro/geopolitical intelligence picture (no holdings yet), computed right in your browser over a real data snapshot.

• Real data, from free public sources — a capture step pulls a historical slice from free, no-key sources (GDELT, Yahoo Finance, wire & Google News, World Bank, USGS/EONET/GDACS, CoinGecko) and turns it into the monitor’s signals — anomaly baselines, trends, and two composite risk scores (per-country geo-risk · per-instrument market-regime), published as a verifiable, versioned snapshot.
• Computed in-browser — a shared Rust→WebAssembly engine runs the technical indicators (moving averages, RSI, MACD, Bollinger) and the anomaly/trend scoring in the page, checked against the data producer so the numbers always agree.
• The cockpit — a fast, framework-free UI: a 2D event map with quake/disaster layers, composite-score panels with their breakdown, a news/signal feed, indicator and anomaly/trend panels, an honest “what’s missing or stale” source tracker, and a ⌘/Ctrl-K command palette with one-key layout presets.

M2 — Portfolio bind adds your holdings on top of the monitor — “this event touched what you hold” — still computed in your browser over the same snapshot (docs/CIOPORT_M2_STEPS.md):

• Your holdings, your way — add positions by hand (saved in your browser), with room for a server account or a broker sync to plug in later without a redesign. Holdings are advisory only — the app will notify and highlight, never auto-trade.
• The bind — the in-browser Rust→WebAssembly engine links events to the assets you actually hold: explainable, time-stamped hints, a portfolio risk-exposure view broken down by holding / country / sector / issuer, and an estimated P&L — each checked against a hand-labeled reference, so the bind is correct rather than hand-wavy.
• The lens — per-holding hints, the exposure breakdown, touched events ringed on the map, estimated P&L (honest when a cost basis is missing), what-if scenarios (inject a hypothetical event or nudge a country’s risk and watch your exposure move), and simple custom rules — all reachable from the command palette and a portfolio preset.

M3 — Live intelligence turns the monitor from a one-time snapshot into a living dashboard (docs/CIOPORT_M3_STEPS.md):

• Always current — the monitor refreshes itself on a schedule and updates in place, with no reload. Fresh events, prices, and scores flow in, and your portfolio view moves on its own.
• Signals you can trust — an event is flagged against your holdings only once several independent, credible sources agree on it, with noisier sources counting for less — fewer false alarms. The source mix widens, too (UCDP conflict data, a geopolitical-risk country index, V-Dem, FRED, Finnhub) on top of the originals.
• It tells you when the world moves your portfolio — the moment a fresh, corroborated event touches something you hold, you get an in-app alert (and, if you allow it, a desktop notification).
• Public map, private portfolio — the intelligence layer (events on the map, risk scores, anomalies) is open to everyone; a quick sign-in unlocks your private view — live estimated P&L and the news feed.

It stays automatically verified end-to-end and runs without an always-on server, so it keeps refreshing on its own at minimal cost. Through M3 the focus was being correct and genuinely useful; M4 is the first pass at how it looks and feels.

M4 — Interface & brand is a design pass over the live monitor — same intelligence, presented like an instrument:

• A real map — the event map now draws land, water, and borders over a self-hosted vector basemap, instead of plotting markers on an empty field.
• A one-screen cockpit — the dashboard fits the viewport with no long page scroll: each panel scrolls on its own, and the ⌘/Ctrl-K presets swap focused views — the way professional terminals are laid out.
• A considered look — a restrained graphite-and-silver palette where the only colour on screen is the data itself (gains and losses, risk, staleness), so the numbers draw the eye, not the chrome.
• Sources, two-plane — per-item source reliability stays public in the feed; the full named provider roster moves behind sign-in.

M5 — The Terminal turns the monitor into a full, symbol-focused analysis terminal — still $0/serverless, still computed in your browser (docs/CIOPORT_M5_STEPS.md):

• Interactive charts with your intelligence on them — candlestick charts with the in-browser engine’s indicator overlays (moving averages, RSI, MACD, Bollinger) and event/hint markers on the price time-axis — the events that touched your holdings, plotted against price. That fusion is the thing a generic charting product structurally can’t do.
• Live prices with no server, no account — crypto price history streams straight from a keyless public source into your browser (no key, no backend); equity price, charts and P&L arrive the same way once you connect a free market-data key of your own (kept in your browser, never sent to us), with a broker sync available later.
• More instruments on the cockpit — an economic calendar (macro releases with the reported figures) and macro indicator series, a signals panel (market sentiment/flow gauges like Fear & Greed), and a sector risk heatmap rendered from the composite risk scores — all reachable from the command palette and a dedicated Terminal preset.
• Honest about data rights — market-data sources are routed by their license: openly-redistributable data is served from the CDN, display-only data sits behind sign-in, and personal-use-only data is fetched by your browser directly from the source (never re-hosted) — so the app maximizes free data without redistributing anyone’s feed.

M6 — Integrity & trust hardens the foundation and adds three fixes you can see (docs/CIOPORT_M6_STEPS.md):

• Verified before it’s shown — each snapshot is checked against a cryptographic signature before anything is computed over it, and the status bar shows a verified cue when it passes; a snapshot that fails is refused, not displayed.
• Your data is legible when a vendor is quiet — a connected market-data vendor now shows its own status (last successful fetch, or its quota/error note), so an empty equity chart explains why instead of going blank.
• The hint lens is populated at rest — the “this touched what you hold” view shows relevant hints without needing a what-if scenario.
• Trustworthy by construction — under the hood, the producer and the in-browser engine are cross-checked to agree on every publish, and the public/private data routing derives from a single source of truth so it can’t drift.

M7 — Depth at $0 deepens the intelligence itself — more sources, more correlation, fuller coverage — still $0/serverless and still computed in your browser (docs/CIOPORT_M7_STEPS.md):

• More of the world, corroborated — the event stream gains dedicated conflict/unrest depth (UCDP armed-conflict data, a geopolitical-risk index, V-Dem) plus news-derived corroboration: headlines are mined for conflict/security signals that can only reinforce an event several independent sources already report, never raise an alarm on their own.
• Where independent streams agree — a cross-stream correlation lens surfaces the places where separate feeds (conflict, hazards, anomalies) cluster in the same place and window — as a geo-density layer on the map and as a dimension inside the risk scores, so agreement between streams actually moves the numbers.
• Hints that cover the whole map — the event→holdings rule pack grows from a demo handful into a full matrix over a stable set of event classes — armed conflict, civil unrest, and natural hazards (earthquake, storm, flood, wildfire, volcano, drought). Every raw source category is normalized onto that one vocabulary, with a build-time check that no class ships uncovered and no upstream category slips through unmapped.
• A richer market-regime read — the per-instrument market-regime score now folds in real regime inputs — market sentiment (Fear & Greed), the rates backdrop (Treasury yields), and crypto momentum — routed by asset class, so the risk heatmap tells crypto and equity regimes apart.
• Deeper macro — the economic calendar and macro panels broaden well past a starter set: many more US series (growth, inflation, employment, rates, industrial production, sentiment, money supply, oil) and World Bank development indicators fetched across multiple regions, not just the world aggregate.

M8 — Reach at $0 extends the terminal into new product surfaces — still $0/serverless (docs/CIOPORT_M8_STEPS.md):

• Rewind the world — snapshots are retained as they publish, and a time scrubber replays how risk evolved across the day: map, scores and charts move together. Any moment is a shareable link (the view’s preset, symbol, layers and scrubbed moment live in the URL — never your holdings or rules).
• Your data is yours — export holdings, watchlist and rules to one JSON file (plus CSV) and import it anywhere the app runs, merge-confirmed. Exports carry user-authored data only.
• Point your AI at it — a local, read-only MCP connector (mcp/) lets an agent query world events, risk scores, macro, signals and the calendar — and, aimed at your exported portfolio file, which events touched what you hold. It hosts the same Rust→WASM kernel as the app (a third host of one logic), reads only the public data plane, and returns context, never trade recommendations.
• Rules you compose — watch rules become a condition builder (field · operator · value, with severity floors over a new normalized event-severity axis: quake magnitude, disaster alert level, conflict intensity on one scale), with a test-fire preview that runs the real kernel join before you save.
• Graceful offline — a service worker caches the public snapshot, so warm loads are faster and a dropped connection shows the last snapshot with an honest offline cue. (Installability is deliberately deferred to the mobile milestone, where it ships together with push.)

The milestones below are built on branch but not yet deployed — the deployed line stays at 0.1.2/M8 until the product decision at the top of this README.

M9 — Server-side sync stands up the first always-on server, so your portfolio stops living in a single browser (docs/CIOPORT_M9_STEPS.md):

• Your holdings follow you — sign in and your holdings, watchlist and rules sync across devices, stored server-side and scoped to your account; your M8 export is the migration payload. Signed out, everything still runs locally, exactly as before.
• First-party sign-in — authentication is first-party: the edge issues your session and the server is a pure verifier of its own tokens (no third-party auth broker in the path).
• A hosted connector — the local MCP connector gains a hosted, holdings-bound upgrade: an agent can ask about your exposure over an authenticated link — org-scoped, read-only, returning context, never trade recommendations.

M10 — Push alerts + the mobile app makes “the world moved your portfolio” reach you when the app is closed, and puts the cockpit in your pocket (docs/CIOPORT_M10_STEPS.md):

• Alerts that fire with the tab closed — the server recomputes, each epoch, which fresh corroborated events touched your holdings and pushes you a pointer — symbol, headline, and a link to the hint — never any licensed data in the notification. Standard Web Push covers desktop and Android browsers with no install.
• The CIOport mobile app — the same cockpit wrapped as a native app for Android and iOS, with native push (FCM/APNs), a biometric app lock, a share sheet, and alert haptics. The app is the install path for mobile — there is no web “add to home screen”.
• Alerts where you already are — route the same alerts to Slack, Discord, Telegram or a webhook, with quiet hours that hold and release across the window.
• An open tab reacts instantly — an optional live-refresh stream updates an open tab the moment an epoch turns; polling stays the fallback.
• Lighter on a small screen — the event map has a low-end mode (clustered markers, no heavy density raster), chosen automatically on modest devices and toggleable by hand — the intelligence is unchanged, only the map’s weight.

Roadmap

QC-gated milestones, UI/intelligence-first and dependency-ordered — each is loadable and reviewable before the next begins. M0–M3 reach a live, holdings-bound intelligence monitor, M5 builds it into a $0/serverless analysis terminal (including equity charts/P&L via your own free market-data key), M6 hardens it for integrity (snapshot verified before compute) with three visible fixes, M7 deepens the intelligence itself (more sources, cross-stream correlation, full hint coverage, a richer market-regime read, deeper macro), and M8 turns the $0 tier into product reach (time-scrub history, portability, shareable links, a local MCP connector, a rule builder). M9 (server-side sync) and M10 (push alerts + the mobile app) are built next — the first always-on server and the native app — followed by a broker connection, paid data tiers, commercial and team features, live execution, and an evidence-gated native-UI mobile app, sequenced as M11–M16 in docs/CIOPORT_DEVELOPMENT.md (each with its own step doc).

Milestone	Capability	Status
M0 — Boot contracts	Schema contract (Rust→Go+TS) · shared kernel WASM ABI · web shell. The app loads and the worker round-trips the WASM kernel	✅ Done
M1 — Intelligence monitor	Open the app and see a comprehensive macro-level news & intelligence monitor — events on a map, composite-score panels, news/signal feed, technical-indicator & anomaly/trend panels, a per-source freshness/gap surface, and a Cmd/Ctrl-K command palette with layer presets — computed client-side over a captured snapshot (no holdings yet)	✅ Done
M2 — Portfolio bind	Add holdings and see binding inside the monitor — “this event touched what you hold”: hint join + portfolio geo-risk exposure with decomposition + estimated P&L, as an overlay, with what-if scenarios and your own watch rules	✅ Done
M3 — Live intelligence	The monitor goes live — data refreshed on a cadence with deeper signals (cross-source corroboration, source-credibility, anomaly/trend), in-app notifications when something new touches your holdings, and a public + signed-in two-plane delivery	✅ Done
M4 — Interface & brand	A design pass over the live monitor: a real land/water/borders basemap, a one-screen cockpit (viewport-fit, per-panel scroll, preset-driven views), a restrained graphite-and-silver palette that reserves colour for the data, and a two-plane source surface (public reliability, signed-in provider roster)	✅ Done
M5 — The Terminal	A full analysis terminal over the same foundation: candlestick charts with in-browser indicator overlays and event/hint markers on the price axis, keyless crypto price history, equity price/charts/P&L via your own free market-data key (kept in your browser), an economic calendar + macro series, a market sentiment/flow signals panel, a sector risk heatmap, and a dedicated Terminal preset — all $0/serverless	✅ Done
M6 — Integrity & trust	Hardening + three visible fixes: the snapshot’s signature is checked before anything is computed and the status bar shows a verified cue when it is; connected market-data vendors show a per-vendor status line (last fetch / quota note) so an empty equity chart explains itself; and the event→holdings hint lens is populated at rest	✅ Done
M7 — Depth at $0	Deeper intelligence over the same foundation: more conflict/unrest sources (UCDP · geopolitical-risk index · V-Dem) plus news-derived corroboration, a cross-stream correlation / geo-density lens that also moves the risk scores, a full event→holdings rule matrix over a normalized event-class vocabulary (conflict · unrest · natural hazards) with a coverage gate, a market-regime read enriched by sentiment/rates/momentum routed by asset class, and deeper macro (many more FRED series · multi-region World Bank) — all $0/serverless	✅ Done
M8 — Reach at $0	New product surfaces over the same foundation: retained snapshot history with a time scrubber, shareable permalinks (view coordinates in the URL), holdings/rules import/export, a local read-only MCP connector (the same kernel, hosted in Node — ask your AI about your exposure), a rule condition-builder with a normalized event-severity axis and test-fire preview, and a graceful-offline service-worker cache — all $0/serverless	✅ Done
M9 — Server-side sync	The first always-on server: holdings/watchlist/rules follow you across devices (sign-in, org-scoped, import your M8 export as the migration payload), first-party session issuance, and a hosted, holdings-bound MCP upgrade	🔧 Built · not deployed
M10 — Push alerts + the mobile app	”The world moved your portfolio” fires with the tab closed: server-side eager alerts behind a notification port, Web Push (desktop + Android browsers, no install), and the CIOport mobile app for Android & iOS — the same cockpit in a native package with native push (FCM/APNs), a biometric app lock, share-sheet and alert haptics — plus extra notify channels (Slack/Discord/Telegram/webhook) with quiet hours, an optional live-refresh stream, and a low-end lighter-map mode. A notification is a pointer, never licensed data.	🔧 Built · not deployed
M11 — Broker (paper-first)	Link a brokerage (sandbox OAuth) for holdings sync and paper order entry — every order carries the snapshot epoch it was decided against; a human initiates every order, never auto-trade	Planned
M12 — Paid & licensed data	The entitled tier: licensed real-time quotes, tagged news wires, GICS/credit reference, fundamentals/disclosures depth, and social news & sentiment (X/Twitter and others) — every source routed by its license, server-side where redistribution is off-limits	Planned
M13 — Commercial	Billing, plans and quotas, multi-user organizations, and the scale-seam flips (cache/pub-sub/instances) as load demands	Planned
M14 — Desk	Team workflows: maker-checker order approval, roles, an immutable compliance audit view, row-level tenant isolation	Planned
M15 — Live execution	Real-broker order routing as an explicit, gated flip from paper — with hard limits, confirmations, and the same human-initiates invariant, last and most carefully	Planned
M16 — Native-UI mobile app	The mobile app’s core surfaces (monitor, hints/alerts, portfolio glance) rebuilt in native UI (SwiftUI / Jetpack Compose) over the same Rust kernel via native bindings — evidence-gated: built when the shell app’s measured UX ceiling demands it	Planned

---

Keywords

• Languages: Go · Rust · WebAssembly · TypeScript
• Architecture: Hexagonal (Ports & Adapters) · Modular Monolith · Three-Zone Compute Split (edge × client × server) · Shared Rust→WASM Kernel · Tenancy & Approval as Parameters
• Schema & Kernel: Rust → JSON Schema → Go + TypeScript Codegen · Signed Manifest / Content-Addressed Snapshots · WASM Kernel ABI · Web Worker Host · Verify-Before-Compute
• Intelligence & compute: Technical Indicators (MA/RSI/MACD/Bollinger) · Welford Anomaly Baselines · Linear-Regression Trend · Composite Risk Scoring (weights-as-data) · Deterministic Offline Produce · Two-Phase Capture (free public sources)
• Portfolio bind: Event→Asset Hint Join · Portfolio Geo-Risk Exposure Bind · Four-Axis Exposure Decomposition · Estimated P&L · Scenario What-If · User-Authored Rules (merged pack) · Source-Aware Holdings Repo · Interactive Request/Response Web Worker
• Live & delivery: Scheduled Regeneration (serverless cron) · Epoch-Refresh (content-addressed layer diff) · Cross-Source Convergence Gating (K-of-N) · Source-Credibility Weighting · Productionized Anomaly/Trend · Client Notifications · Two-Plane Delivery (public CDN + auth-gated) · Delegated Authentication
• Terminal (M5): Candlestick Charts (KLineChart) · Kernel-Fed Indicator Overlays · Event/Hint Markers on Price Axis · Economic Calendar + Macro Series · Sentiment/Flow Signals · Sector Risk Heatmap (inline SVG) · License-Tiered Market-Data Routing (broadcast / gated / direct / blocked) · C-Direct Client-Fetch (keyless crypto OHLC) · Terminal Preset
• Depth at $0 (M7): Cross-Stream Correlation / Geo-Density (stdlib lat-lon binning) · News-Derived Event Corroboration · Canonical Event-Class Vocabulary (normalization + drift gate) · Full Rules Coverage Matrix (soundness-#9 merge gate) · Market-Regime Signals by Asset Class · Multi-Region Macro Depth (FRED · World Bank)
• Reach at $0 (M8): Epoch History Retention (content-addressed, count-pruned) · Time-Scrub Replay · Shareable Permalinks (view-state-only URLs) · Holdings/Rules Import-Export (versioned round-trip) · Local MCP Connector (stdio · third kernel host in Node · origin-guarded) · Rule Condition-Builder · Normalized Event Severity (mag/alert/intensity → one axis) · Service-Worker Offline Cache (license-boundary)
• Server sync (M9): First-Party OAuth 2.1 Issuer (edge Worker) · Org-Scoped Holdings Persistence (Postgres) · Optimistic-Concurrency Bundle PUT (ETag) · Pure-Verifier Go API (own JWKS) · Hosted MCP (holdings-bound · read-only · org-scoped) · Fourth Kernel Host (hosted connector)
• Push & mobile (M10): Server-Eager Inverted-Join Alerts (per-epoch gated-hint diff over wazero) · Web Push (VAPID · RFC 8291) · FCM / APNs (Capacitor shell) · First-Party Native OAuth Client (PKCE · system browser · keystore refresh) · Pointer-Not-Payload Notification Allowlist · Notify Channels (Slack/Discord/Telegram/webhook) + Hold-&-Release Quiet Hours · Config-Gated SSE Refresh Hub (LISTEN/NOTIFY) · Low-End Map Budget (device heuristic · clustered markers) · Biometric App Lock