Initial Baron Safe app scaffold

docs/api-contract.md

@@ -0,0 +1,19 @@
+# API Contract Draft
+
+## Initial APIs
+
+- `POST /api/v1/baron-safe/devices/register`
+- `POST /api/v1/baron-safe/devices/push-token`
+- `DELETE /api/v1/baron-safe/devices/{deviceId}`
+- `GET /api/v1/baron-safe/sessions`
+- `GET /api/v1/baron-safe/sessions/{sessionId}`
+- `POST /api/v1/baron-safe/sessions/{sessionId}/block`
+- `GET /api/v1/baron-safe/linked-apps`
+- `POST /api/v1/baron-safe/linked-apps/{clientId}/block`
+
+## Future High-Risk Approval APIs
+
+- `POST /api/v1/auth/baron-safe/login/init`
+- `GET /api/v1/auth/baron-safe/requests/{authReqId}`
+- `POST /api/v1/auth/baron-safe/requests/{authReqId}/decision`
+- `POST /api/v1/auth/baron-safe/login/poll`

docs/architecture.md

@@ -0,0 +1,19 @@
+# Architecture
+
+## Principle
+
+Baron Safe is developed as a hybrid app. The WebView layer presents session, linked app, QR, and portal-style screens. Native or Flutter plugin layers handle sensitive capabilities.
+
+## Layers
+
+| Layer | Responsibility |
+| --- | --- |
+| WebView | Display session history, linked apps, details, and user actions |
+| Native/Plugin | Push, biometric prompt, secure storage, future key signing |
+| Backend | Device registration, push trigger, session query, session blocking, audit logs |
+
+## Default UX
+
+The initial model is post-login confirmation and blocking:
+
+`phone number login -> login allowed -> Baron Safe notification -> user confirmation -> block if suspicious`

docs/bridge-policy.md

@@ -0,0 +1,19 @@
+# WebView-Native Bridge Policy
+
+## Allowed Commands
+
+| Command | Description |
+| --- | --- |
+| `getDeviceInfo` | Return device id, platform, app version |
+| `registerPushToken` | Register current push token |
+| `openBiometricPrompt` | Run biometric or device PIN prompt |
+| `blockSession` | Block a session after native verification |
+| `blockLinkedApp` | Block a linked RP after native verification |
+| `openSettings` | Open native app settings |
+
+## Rules
+
+- Do not pass private keys to WebView.
+- Do not store long-lived refresh tokens in WebView storage.
+- Validate origin and session before processing bridge commands.
+- Native layer must verify sensitive commands before calling backend APIs.

docs/release-policy.md

@@ -0,0 +1,23 @@
+# Release Policy Draft
+
+## Channels
+
+| Channel | Purpose |
+| --- | --- |
+| local | Developer verification |
+| staging | Internal QA and SSO integration testing |
+| production | Internal/partner release |
+
+## Targets
+
+- Android: APK/AAB, internal distribution or managed store
+- iOS: TestFlight, Apple Business Manager, or MDM
+
+## Required Checks
+
+- Static analysis
+- Unit/widget tests
+- Push registration test
+- WebView session test
+- Biometric blocking test
+- Audit log verification