[WAL-1348] feat(mdoc): implement Wi-Fi Aware retrieval

[szijpeter]

Summary

Implements the mandatory ISO mdoc Wi-Fi Aware holder baseline for WAL-1348 on top of the WAL-1347 demo stack.

The implementation follows the proximity architecture contract: shared code owns protocol semantics and lifecycle, Android owns the platform integration, and unsupported platforms report precise capability/remediation information. Exact-build physical evidence and the public ISO holder-test plan are tracked in WAL-1349 architecture PR #61.

What Changed

Protocol and transport

• Adds the transaction-derived service name and NCS-SK-128 passphrase derivation, strict ISO HTTP exchange, bounded framing, transport ownership, cancellation, timeout, and deterministic cleanup.
• Extends NFC carrier encoding/selection for application/vnd.wfa.nan, including exact cipher-suite, passphrase, band, and selected-carrier rules.
• Shares one prepared Wi-Fi Aware transport across QR and NFC engagement paths so the selected bearer owns a single platform session.

Platform capability

• Adds an Android API 33+ publisher/NDP responder over WifiAwareManager, an IPv6 link-local TCP listener, explicit NCS-SK-128 security, platform/feature/permission/resource checks, and truthful 2.4 GHz band advertising.
• Reports Wi-Fi Aware as unsupported on iOS because Apple's public paired-device/static-service API cannot express the ISO transaction-derived service and security setup.
• Keeps NCS-PK-2WDH-128 unadvertised rather than silently weakening or substituting the mandatory shared-key mode.

SDK, demos, and documentation

• Extends the Kotlin and Swift proximity configuration, capability, remediation, factory-injection, and lifecycle surfaces without changing existing defaults.
• Wires capability and recovery status into the Compose Android, Compose iOS, and native SwiftUI demos.
• Extends demo preflight to execute SDK-reported Nearby Wi-Fi and local-network permission actions, rechecking the selected configuration before any presentation session is created. Android permissions that the OS will no longer prompt for become an explicit Open app settings action and are rechecked when the holder returns.
• Documents the protocol boundary, platform requirements, security choice, unsupported-platform behavior, source comparison, and remaining qualification gates.

Architecture Notes

• The implementation is independently authored from the ISO contract and platform APIs. Pinned Multipaz behavior is used only as a differential interoperability reference; no source or runtime dependency is copied.
• Optional NCS-PK-2WDH-128 remains follow-up work gated on a canonical Wi-Fi NAN 3.1 source and independent physical reader evidence. It is not required for the mandatory NCS-SK-128 holder baseline delivered here.
• Android advertises only capabilities it can determine precisely; generic platform 5 GHz support is not treated as proof of Wi-Fi Aware 5 GHz support.

Caveats and Follow-Ups

• This PR remains draft until Android Wi-Fi Aware retrieval is exercised on supported physical hardware against an independent reader, including unavailable/resource-exhausted and cleanup behavior.
• The official ISO/IEC TS 18013-6:2025 Appendix 2 holder catalogue maps the delivered baseline to mDL_Tech_DR_WiFi_01 through _04, _06, _07, and the harness-conditional _08. Optional _05 is explicitly not applicable because NCS-PK is not advertised. The current engineering ledger accounts for all 460 holder cases as 288 automated rows, 24 physical rows, and 148 explicit gaps, with the physical rows consolidated into five reusable scenarios. The positive Wi-Fi Aware scenario remains blocked on a second capable independent reader, and the normative TS main text remains required before any conformance claim.
• Existing broad Multipaz BLE/NFC smoke results remain historical evidence. On frozen pre-final-restack head ae4efeb2dfaf60fa7daaab80db4415c4a63c57b0, the Android API 35 denial/settings/return permission recovery, Compose Android/Compose iOS/native SwiftUI QR-to-BLE GATT canaries, and Android QR-to-NFC hybrid canary against Multipaz passed. The hybrid proves NFC/HCE engagement and handover followed by BLE GATT retrieval, not direct-NFC retrieval. This completes the bounded dependency-renderer smoke for that frozen build only; none of these cases is cross-credited to the current head or replaces the still-pending Wi-Fi Aware physical matrix.
• The stack was refreshed parent first from Identity main 4d151a1bf43c45072d931f00f8418d50de20813c: [WAL-1344] feat(mdoc): add shared proximity protocol engine #2155 targets main and each child targets its immediate predecessor. This PR is c8226699039ec51b0eb4caf36cadccfd0c18b26b on parent [WAL-1347] feat(wallet): integrate NFC proximity in demos #2166 571c0b9d8f308a8fa86a35b3d909be668020753a. Closed WAL-1376 PR [WAL-1376] feat(wallet): add full-screen image viewing and render QR claims #2176 is not a dependency; [WAL-1346] feat(wallet): add proximity presentation to wallet demos #2160 owns the minimum proximity-only ZXing renderer delta.
• The lower-stack Android NFCv2 direct/hybrid and 42,507-byte response evidence is recorded in WAL-1349 architecture PR #61; it does not substitute for positive Wi-Fi Aware evidence on this overlay.
• NCS-PK-2WDH-128 and optional 5 GHz advertising remain outside this draft's claimed scope.
• iOS remains intentionally unadvertised unless Apple exposes a dynamic, unpaired service/security surface capable of the ISO flow. Apple's separate HCE approval affects NFC card emulation, not this Wi-Fi Aware limitation.

Breaking

None for published APIs. The new configuration and capability fields extend the unreleased stacked proximity API, and existing callers retain their current behavior unless Wi-Fi Aware is enabled.

[linear-code]

WAL-1348

WAL-1376

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 83b04011-0617-4601-ad81-30bdf5adba47

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud