IAM.Agent Community: mobile cloud control candidate

Availability and prerequisites

This is an unreleased development candidate in the existing Tauri Community application. The separate open-source Community client based on DeepSeek Harness has a different runtime; this guide does not qualify its native mobile support. No App Store, Google Play or production mobile release is established by this page.

Use a native build supplied by the developer, an administrator-approved Marketplace HTTPS origin, a separate API credential authorized for your installations and an active hosted agent. The new connection uses explicit credential entry; desktop browser-loopback OAuth is not a qualified mobile sign-in path. An ordinary browser preview cannot save native credentials or dispatch a hosted task.

The shared Rust and React path is implemented for mobile targets. Actual iOS simulator and Android build qualification are recorded separately below. An unavailable platform is not a successful build.

Prepare a draft without a network

1. Open Runs, then Local preparation.
2. Type your own text into Offline task draft, up to 8192 UTF-8 bytes. Non-Latin characters may occupy several bytes.
3. Click Save on this device. The current workspace draft is encrypted using the existing native settings store. The returned byte and word counts and the first 32 nonempty checklist lines come from literal text splitting; only leading - or * is removed.
4. Reopen Runs to recover the saved draft. A different workspace has a separate draft. Remove local draft deletes only the current workspace’s saved text.
5. Click Use draft as cloud task when ready. This copies the text into Hosted task. It does not prepare or invoke a remote task.

This local path provides draft storage, counts and a literal checklist. It does not run an on-device language model, OCR, Office generation or an external CLI. iOS settings master-key custody uses the existing Keychain feature. Android’s current settings fallback is an owner-only local key file, not an Android Keystore integration; the separate Android health vault/key-provider and OCR blockers remain unresolved.

Enlarge screenshot

1 2 3

1. Offline task draft
2. Save on this device
3. Runs

Enlarge screenshot

1 2 3

1. Offline task draft
2. Save on this device
3. Literal checklist and counts

Connect an account and dispatch once

1. Under IAM.Market / Hosting, enter Marketplace HTTPS origin and the administrator-supplied Marketplace credential. Click Save native connection. The password field clears; reopening never returns the stored credential.
2. Click List my hosted agents. Choose an active entry under Hosted agent. Listing does not wake an agent or execute a task.
3. Review Hosted task, enter Reason, and click Prepare reviewed task. The app reauthorizes the installation and saves an intent locally. Review its text and agent identifier.
4. Click Invoke reviewed task separately. Before the single async request, the native ledger durably marks the intent as attempted. A pending or queued response remains queued; acceptance is not completion.
5. Select a receipt in Saved hosted task and click Read status and transcript to fetch the exact authorized remote run. Only a server status of completed establishes that terminal status; inspect its returned text as untrusted content.
6. Wake selected agent and Resume selected agent are separate remote changes requiring the selected installation and a reason. Generic pause and cancellation are not provided here.

The connection is encrypted in native settings. Task receipts are private files restricted to the app profile; this is not a claim of hardware encryption for every receipt. Receipts are bound to the canonical workspace, endpoint and exact credential. Replacing/removing the credential or changing workspace invalidates earlier local dispatch authority, conservatively including token rotation. Returning from the background clears displayed remote data and revalidates native binding.

The general run list and Saved hosted task use separate ledgers. The legacy empty-state “Запусков ещё не было” does not invalidate the completed hosted receipt above: verify its exact run ID and separate agent reply through Read status and transcript.

Enlarge screenshot

1 2

1. Locally prepared
2. Invoke reviewed task

Enlarge screenshot

1 2 3

1. Server status completed
2. Read status and transcript without replay
3. Separate agent response with exact synthetic marker

Recover without duplicate execution

• For unknown, a request may already have run. The original intent cannot be dispatched again, including after restart. Inspect IAM.Market history; do not create a replacement merely because a response timed out.
• A receipt with a known remote run ID can be refreshed without resending its task. An unknown attempt without that ID requires account history inspection; there is no automatic reconciliation by guessing a run.
• For authorization errors, correct the credential or ask an administrator to restore access. Changing the origin requires a new credential or explicit removal, so an old token cannot silently move to another server.
• Background suspension stops reliable foreground polling; reopen the application and explicitly refresh. No push notification or background execution guarantee is made.
• Oversized local drafts are refused before save. Reduce the text and save again. Failed cloud requests do not silently switch endpoints or retry POSTs.

Qualification

Native host fixture tests cover replay fences, credential/workspace rotation, bounded transport, redirect refusal, pending status and offline draft persistence. React interaction tests cover separate prepare/invoke actions, unknown outcomes and foreground account changes. These checks are not phone runtime evidence. The actual arm64 iOS Simulator app was built, installed and launched on iPhone 16 Pro / iOS 18.6; QA42 local save, literal checklist and restoration after process restart passed. One exact owned synthetic cloud invocation completed on iOS after about 278 seconds. Authenticated refresh returned completed and a separate agent event with the exact educational marker; the operator prompt was excluded from this check. After terminating/relaunching the app, the same receipt and agent response reopened, its live refresh passed, and no Invoke/replay button was offered. The native ledger contains one receipt and one durable attempted claim. No second invocation, wake or resume was used. The Android arm64 APK was built, its v2 signature verified, installed and launched in a fresh Android 15 / API35 AVD. With Wi-Fi and mobile data disabled, AndroidQA42 save, literal checklist and restoration after force-stop/cold launch passed. No Android cloud credential or task was configured. These are simulator/emulator checks, not physical-phone or store-release qualification. This candidate guide requires its own coordinated staging/production documentation release; it does not announce a mobile store release.