[moni11811]

Summary

Draft integration for secure Pebble notification forwarding through the iOS 26.5 AccessoryNotifications and AccessoryTransportExtension APIs. The bridge is off by default. Existing phone-hosted Bluetooth connections and Android behavior remain on their current paths.

This ports the protocol, three ExtensionKit roles, app-side enrollment/authorization flow, and watch transport coordination from a locally tested Pebble integration into current master. It includes signed session framing, owner/watch identity checks, explicit enrollment consent, receipt/queue handling, removal/reply/clear paths, and focused host regressions.

Scope and compatibility

• PebbleNotificationsEnabled defaults to false in the app and extensions. ASK Bluetooth radio ownership is selected only for an explicit compatible build.
• The app keeps its iOS 15.6 deployment target; extension targets require iOS 26.5. Shared PebbleProtocol supports 15.6.
• Bundle namespace, App Group, Keychain Sharing group, and extension bundle IDs derive from project settings. Signing entitlement templates and setup steps are in docs/ios-secure-notification-forwarding.md.
• Requires matching watch-hosted GATT/firmware support. As noted in [Feature Request] Reply messages from IOS - Notification Forwarding Integration IOS 26.5 #221, current Pebble CBPeripheralManager and recovery firmware block an app-only rollout. The default branch must not turn this on until a compatible firmware path and legacy-watch behavior are agreed.
• Apple's customer availability restriction for this API is EU device plus EU Apple Account; development testing can occur elsewhere.

Verification performed

• python3 tests/notification_forwarding_host.py — passed.
• python3 tests/transport_message_queue.py — passed.
• python3 tests/watch_accessory_link_timeout.py — passed.
• iOS simulator builds of PebbleProtocol, PebbleForwarding, and all three ExtensionKit targets — passed with Xcode 27, signing disabled.
• :libpebble3:compileKotlinIosSimulatorArm64, :composeApp:compileKotlinIosSimulatorArm64, and :composeApp:linkDebugFrameworkIosSimulatorArm64 — passed with local JDK 17. The local Xcode 27 CocoaPods targets needed a temporary iOS 15.6 deployment override for generated Pods; that override is not in this PR.
• Complete iosApp simulator arm64 build — passed with signing disabled, generated Pods, and a synthetic ignored Firebase plist. The synthetic file was removed after the build.
• git diff --check, plist validation, and a source scan for local identifiers, absolute machine paths, private-key markers, and credentials — passed for the changed payload.

Before merge or rollout

• Review the 26.5 entitlement/provisioning setup, configure the app and extension App Group/Keychain access, and prove signed installation. The template entitlements are deliberately not selected by the default signing configuration.
• Qualify the matching watch/recovery firmware and demonstrate physical notification forwarding, authenticated receipt, reply, removal, and reconnect behavior. No physical-watch proof is claimed here.
• Shared host/extension Swift sources are consolidated into one set compiled by both targets. The draft still spans 91 files across the protocol, three extensions, app integration, host tests, and documentation; review whether to split that scope before merge.
• Contributor CLA may be required by CONTRIBUTING.md.

Provenance and disclosure

Portions of notification handling are adapted from shinvou/NotifBridge revision 0753ba7168d03c6f4363b6a369422fec25be7538 under MIT; the full notice is in NOTIFBRIDGE-NOTICE.md. This contribution used AI assistance for code adaptation, integration, and review. I reviewed the resulting source and ran the checks above.

[CLAassistant]

All committers have signed the CLA.