catchlaw-offline-guaranteelisted

Enforces CatchLaw's zero-network claim as four layers of proof — no http, dio, firebase_core or connectivity_plus in pubspec.yaml so an import is an unresolved-URI compile error, depend_on_referenced_packages promoted to error, android.permission.INTERNET stripped from the main and release AndroidManifest.xml with tools:node="remove", iOS resting on layers 1 and 4 since ATS blocks only cleartext, a no_network_test.dart guard banning HttpClient, Socket, WebSocket and InternetAddress while File, Directory and Platform stay for drift, an allowlist for transitive http edges under printing and flutter_svg, and a tcpdump capture, never an HTTP proxy. Use when adding a dependency to pubspec.yaml, editing AndroidManifest.xml, writing no_network_test.dart, reviewing Image.network, NetworkImage, PdfGoogleFonts or launchUrl in a diff, auditing a transitive package edge, running the release packet capture, or wiring check_no_network.sh into CI.
zakariaf/CatchLaw · ★ 0 · Data & Documents · score 55

Install: claude install-skill zakariaf/CatchLaw

# Catchlaw Offline Guarantee "100% offline" is printed on the store listing and said to a regulator, so it is held up by the compiler and the operating system, never by discipline. This skill owns the four layers that make the claim VERIFIABLE — the undeclared dependency, the stripped Android permission, the honest iOS gap, and the `dart:io` guard test — plus the banned-package list and the packet-capture ritual. It does not own durability, migrations or failure typing. Read the reference for the task at hand: - `references/four-layers.md` — layer strength ladder, banned package table, manifest snippets and merger rules, the iOS gap, the `dart:io` split, transitive allowlist, API grep list. - `references/verification-ritual.md` — why proxies lie, PCAPdroid, adb tcpdump, rvictl plus Wireshark, pass criteria, release checklist, evidence retention, failure triage. Run `scripts/check_no_network.sh` before a PR. Durability, DAOs and transactions belong to `persistence-drift`; forward-only schema changes to `run-migration`; `Result` and failure types to `error-handling-typed-results`. This skill only ever asserts that no code path can reach a socket, and that the asset databases are the whole world. ## Non-negotiable rules 1. **The networking package is never declared, at any depth.** `pubspec.yaml` carries no `http`, `dio`, `web_socket_channel`, `grpc`, `firebase_core`, `connectivity_plus`, `url_launcher`, `googleapis` or `google_fonts` — not in `dependencies`, not