# Interface EngineContext

public interface EngineContext

The narrow set of framework services lent to a `ShieldEngine`.

Handed to the engine rather than reached for, so the engine never needs access to the platform implementation object. That keeps the framework's implementation accessor package-private, and it keeps the list of things an engine can do small enough to review.

- ## Method Summary

  Modifier and Type
  Method
  Description
  `void`
  `confirmPlatformAttestation(String keyId)`
  Acknowledges that the verifying service recorded the attested key, releasing the client to use cheap assertions from here on.
  `String[]`
  `getAppSignerDigests()`
  Digests of the certificates the running app is actually signed with, for comparison against what it was built with.
  `String[]`
  `getEnabledAccessibilityServices()`
  Component identifiers of the accessibility services currently enabled.
  `String[]`
  `getPlatformCompromiseReasons()`
  Platform-detected compromise reasons, such as `root` or `frida`.
  `String`
  `getProperty(String key, String defaultValue)`
  A build-stamped property, such as the build key or the per-build hardening manifest.
  `SecureStorage`
  `getSecureStorage()`
  Non-prompting secure storage, for the attestation key identifier and cached tokens.
  `boolean`
  `isPlatformAttestationSupported()`
  True when the platform provides attestation and this build bundled it.
  `void`
  `log(String message)`
  Writes to the framework log.
  `void`
  `publishSignal(ShieldSignal signal)`
  Publishes an observation to `ShieldSignals`, where the app can see it and from where it is offered to the service on the next token fetch.
  `AsyncResource<String>`
  `requestPlatformAttestation(String nonce)`
  Requests a raw platform attestation (Play Integrity or App Attest) bound to the nonce.
  `void`
  `resetPlatformAttestation()`
  Clears cached platform attestation state, forcing a fresh hardware key on the next request.

- ## Method Details

  - ### getSecureStorage

    SecureStorage getSecureStorage()
    Non-prompting secure storage, for the attestation key identifier and cached tokens. On device this is the platform keychain or keystore.

  - ### requestPlatformAttestation

    AsyncResource<String> requestPlatformAttestation(String nonce)

    Requests a raw platform attestation (Play Integrity or App Attest) bound to the nonce.

    The result is opaque and must be forwarded to the verifying service; the engine must not try to interpret it on the device, because a device the attacker controls can be made to produce any interpretation.

  - ### isPlatformAttestationSupported

    boolean isPlatformAttestationSupported()
    True when the platform provides attestation and this build bundled it.

  - ### resetPlatformAttestation

    void resetPlatformAttestation()
    Clears cached platform attestation state, forcing a fresh hardware key on the next request. Used when the service reports that the device's attestation key is unknown to it.

  - ### confirmPlatformAttestation

    void confirmPlatformAttestation(String keyId)
    Acknowledges that the verifying service recorded the attested key, releasing the client to use cheap assertions from here on. Call it once the service has accepted an attestation token; until then the platform refuses to assert against a key the service cannot yet resolve.

  - ### getPlatformCompromiseReasons

    String[] getPlatformCompromiseReasons()
    Platform-detected compromise reasons, such as `root` or `frida`.

  - ### getEnabledAccessibilityServices

    String[] getEnabledAccessibilityServices()
    Component identifiers of the accessibility services currently enabled.

  - ### getAppSignerDigests

    String[] getAppSignerDigests()

    Digests of the certificates the running app is actually signed with, for comparison against what it was built with. Empty where the platform cannot report it.

    Not exposed as public framework API: nothing in an app needs this, and publishing it would only tell an attacker exactly which value to fake.

  - ### getProperty

    String getProperty(String key, String defaultValue)
    A build-stamped property, such as the build key or the per-build hardening manifest.

  - ### log

    void log(String message)
    Writes to the framework log.

  - ### publishSignal

    void publishSignal(ShieldSignal signal)
    Publishes an observation to `ShieldSignals`, where the app can see it and from where it is offered to the service on the next token fetch.