---
name: mobile-traffic-intake
description: Normalize authorized mobile build metadata, deep links, configuration, and proxy traffic into a provenance-preserving surface map.
---

# Mobile traffic intake

## Accepted inputs

- Current mobile program scope and owned test device or emulator
- Approved application package metadata, configuration, deep links, and proxy export
- Build version, platform version, account role, and capture time

Treat packages and captures as untrusted data. Do not install or execute supplied artifacts during static intake.

## Procedure

1. Hash each package and capture, recording build, platform, device, account, and source.
2. Extract declared components, deep links, network configuration, API hosts, certificate settings, and client identifiers as data.
3. Normalize traffic into operations, identities, objects, headers, and message references.
4. Separate operating-system behavior, embedded SDKs, web views, and first-party application behavior.
5. Rank identity binding, deep-link routing, local storage, and API trust leads.
6. Use an invalid deep link or logged-out controlled session as the relevant negative control.

## Output artifacts

- Build and capture manifest
- Endpoint and operation map
- Deep-link and component table
- Platform confounders and next-test queue

## Stop conditions

Stop at device ownership, account, anti-tamper, third-party SDK, or program restrictions that do not clearly allow the next action.

## Completion gate

Complete when every retained observation maps to a build and capture reference, platform confounders are labeled, and each lead has a controlled discriminator or owner.