fix(screening): let a carrier-verified call override only stale database rows

STIR_SHAKEN_TRUSTED (5300) sits above GITHUB_DATABASE (5200), so any number
on the spam database that arrived with a PASSED verification rang through.
PASSED proves the caller owns the line, not that the call is wanted: 44% to
51% of robocalls in 2024 carried A-level attestation. The ranking exists to
protect the real owners of numbers spoofed in old complaint data, which
argues for an age condition rather than trusting every pass.

The trust checker now looks up the matching row and only allows when that
row's evidence is stale: its newest date is more than 365 days old, it isn't
on the hot list (three distinct reporters), and it carries no corroborated
community evidence. Otherwise it passes and DatabaseChecker blocks as it
would for any other call. User blocks and allows keep their ranks.

Community provenance never reached the device: shard rows carry it in a
"sources" field that SpamNumberJson ignored. The field is now parsed, and a
row published without its own evidence list gets a community_reports record
next to the synthesized database one, with the same corroborated/unverified
rule. Rows already on a device pick it up when their shard next changes.
Every community row today is from 2026, inside the 365-day window, so none
depends on it yet.

Tests (new only; no existing assertion changed):
- StirShakenTrustCheckerTest pins the decision table: current row, the
  365-day boundary, a newer evidence record, corroborated versus single
  community reports, hot-list rows, and undated rows.
- StirShakenDatabaseEvidencePipelineTest runs the whole call pipeline under
  Robolectric: a verified call from a current row blocks, from a stale row
  rings through, an unverified call from the stale row still blocks, and a
  user block still wins.
- SpamRepositorySyncTest parses a real shard body and checks the community
  record survives into the stored evidence.
- SpamPipelineIntegrationTest gains the same two pipeline cases on device.
  They compile; they have not run on a device in this change.
Making the allow unconditional again fails five of these tests.

Author: SysAdminDoc

CHANGELOG.md

@@ -25,6 +25,13 @@ All notable changes to CallShield will be documented in this file.
   landlines were being blocked. International numbers now skip the model.
 - A short but valid international number (the Faroes, Greenland, Andorra, some
   German landlines) is no longer counted as a malformed one by the heuristics.
+- A call your carrier verified no longer rings through automatically when its
+  number is on the spam database. Verification proves the caller owns the line,
+  not that the call is wanted, and about half of all robocalls carry it. It now
+  overrides a database match only when that entry's newest evidence is more
+  than a year old, the number isn't trending, and community reports haven't
+  confirmed it. That still protects people whose numbers were spoofed in old
+  complaint data. Your own blocks and allows are unaffected.
 
 - External blocklist subscriptions now stay current. A list used to be
   fetched only when you added it or switched it back on, so one that changes

README.md

@@ -403,7 +403,7 @@ All detection layers implement a shared `IChecker` interface and run in priority
 |  5400 | **Range Patterns** (A5) | Block | Length-locked `#` patterns like `+33162######`, with schedule + coverage safety rail |
 |  5350 | **Temporary Allow** | Allow | One-off false-positive recovery from the Blocked Log. Beats all downloaded data, never your own rules |
 |  5320 | **Prefix Rules** | Block | Downloaded wangiri country codes, US premium rate (+1900), international premium |
-|  5300 | **STIR/SHAKEN Authenticated** | Allow | Carrier-authenticated caller ID can allow through lower-confidence heuristic/ML suspicion while explicit blocks still win first |
+|  5300 | **STIR/SHAKEN Authenticated** | Allow | Carrier-authenticated caller ID allows through heuristic/ML suspicion, and through a database match only when that row's newest evidence is over a year old, it isn't trending, and it has no corroborated community reports. Explicit blocks still win first |
 |  5200 | **Spam Database** | Block | 51,634 imported spam numbers plus scheduled hot-list data |
 |  5150 | **Database Prefix Expansion** | Block | Auto-blocks last-two-digit siblings of confirmed database entries |
 |  5000 | **Recently Dialed** | Allow | Numbers you called in the last 24h. They're probably calling back |

app/src/androidTest/java/com/sysadmindoc/callshield/data/SpamPipelineIntegrationTest.kt

@@ -21,6 +21,8 @@ import org.junit.Assert.assertTrue
 import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
+import java.time.LocalDate
+import java.time.ZoneOffset
 
 @RunWith(AndroidJUnit4::class)
 class SpamPipelineIntegrationTest {
@@ -129,6 +131,44 @@ class SpamPipelineIntegrationTest {
             assertEquals("user_blocklist", result.matchSource)
         }
 
+    @Test
+    fun trustedStirSignalYieldsToACurrentDatabaseRow() =
+        runBlocking {
+            val number = "+12125550104"
+            dao.insertNumber(
+                SpamNumber(
+                    number = number,
+                    type = "robocall",
+                    lastSeen = LocalDate.now(ZoneOffset.UTC).minusDays(30).toString(),
+                    source = "github",
+                ),
+            )
+
+            val result = repo.isSpam(number = number, callerIdentity = CallerIdentity(verificationStatus = 1))
+
+            assertTrue(result.isSpam)
+            assertEquals("database", result.matchSource)
+        }
+
+    @Test
+    fun trustedStirSignalOverridesAStaleDatabaseRow() =
+        runBlocking {
+            val number = "+12125550105"
+            dao.insertNumber(
+                SpamNumber(
+                    number = number,
+                    type = "robocall",
+                    lastSeen = LocalDate.now(ZoneOffset.UTC).minusDays(900).toString(),
+                    source = "github",
+                ),
+            )
+
+            val result = repo.isSpam(number = number, callerIdentity = CallerIdentity(verificationStatus = 1))
+
+            assertFalse(result.isSpam)
+            assertEquals("stir_shaken_trusted", result.matchSource)
+        }
+
     @Test
     fun nationalAndE164FormsShareOneInjectedRegionalIdentity() =
         runBlocking {

app/src/main/java/com/sysadmindoc/callshield/data/SpamRepository.kt

@@ -1070,21 +1070,7 @@ internal fun sanitizeDatabaseNumbers(
         if (normalizedNumber.isBlank()) {
             null
         } else {
-            val evidence =
-                json.evidence.ifEmpty {
-                    listOf(
-                        SourceEvidenceJson(
-                            sourceId = "github_database",
-                            evidenceType = "aggregate_database",
-                            license = "CallShield database terms",
-                            attribution = "CallShield maintained spam database",
-                            firstSeen = json.firstSeen,
-                            lastSeen = json.lastSeen,
-                            confidenceTier = if (json.reports >= 2) "corroborated" else "unverified",
-                            parserVersion = "legacy-v1",
-                        ),
-                    )
-                }
+            val evidence = json.evidence.ifEmpty { synthesizedDatabaseEvidence(json) }
             SpamNumber(
                 number = normalizedNumber,
                 type = json.type.trim().ifBlank { "unknown" },
@@ -1101,6 +1087,41 @@ internal fun sanitizeDatabaseNumbers(
         }
     }
 
+/**
+ * Evidence for a row the pipeline published without an evidence list of its
+ * own. A row that came from community reports says so, because the
+ * STIR/SHAKEN trust allow treats corroborated community evidence as current
+ * however old the row's date is.
+ */
+private fun synthesizedDatabaseEvidence(json: SpamNumberJson): List<SourceEvidenceJson> {
+    val tier = if (json.reports >= 2) "corroborated" else "unverified"
+    val database =
+        SourceEvidenceJson(
+            sourceId = "github_database",
+            evidenceType = "aggregate_database",
+            license = "CallShield database terms",
+            attribution = "CallShield maintained spam database",
+            firstSeen = json.firstSeen,
+            lastSeen = json.lastSeen,
+            confidenceTier = tier,
+            parserVersion = "legacy-v1",
+        )
+    if (json.sources.none { it == "community" || it == "community_reports" }) return listOf(database)
+    return listOf(
+        database,
+        SourceEvidenceJson(
+            sourceId = "community_reports",
+            evidenceType = "user_report",
+            license = "CallShield community report policy",
+            attribution = "CallShield users",
+            firstSeen = json.firstSeen,
+            lastSeen = json.lastSeen,
+            confidenceTier = tier,
+            parserVersion = "community-v2",
+        ),
+    )
+}
+
 internal fun mergeHotListNumbers(
     hotNumbers: Collection<SpamNumber>,
     existingByNumber: Map<String, SpamNumber>,

app/src/main/java/com/sysadmindoc/callshield/data/checker/Checkers.kt

@@ -11,14 +11,19 @@ import com.sysadmindoc.callshield.data.HashWildcardMatcher
 import com.sysadmindoc.callshield.data.RegionRules
 import com.sysadmindoc.callshield.data.SmsContentAnalyzer
 import com.sysadmindoc.callshield.data.SmsContextChecker
+import com.sysadmindoc.callshield.data.SourceEvidenceCodec
 import com.sysadmindoc.callshield.data.SpamHeuristics
 import com.sysadmindoc.callshield.data.SpamMLScorer
 import com.sysadmindoc.callshield.data.SpamRepository
 import com.sysadmindoc.callshield.data.SystemBlockList
+import com.sysadmindoc.callshield.data.model.SpamNumber
 import com.sysadmindoc.callshield.data.repository.SpamRepositoryImpl
 import com.sysadmindoc.callshield.domain.model.CallerIdentitySignals
 import com.sysadmindoc.callshield.service.CallerIdOverlayService
 import kotlinx.coroutines.withTimeoutOrNull
+import java.time.LocalDate
+import java.time.ZoneOffset
+import java.time.format.DateTimeParseException
 import java.util.Calendar
 
 /** Absolute safety floor for recognized emergency and public-safety codes. */
@@ -157,10 +162,19 @@ internal class ContactsOnlyChecker(
  * do NOT treat C as a sole block signal. We only fire the allow on a
  * positive PASSED signal, never on the absence of one.
  *
+ * A PASSED attestation proves the caller owns the line, not that the call
+ * is wanted: 44% to 51% of robocalls in 2024 carried A-level attestation.
+ * The allow sits above the downloaded database to protect the real owners
+ * of numbers that were spoofed in old complaint data, so it only overrides
+ * a database row whose evidence is stale (see [hasCurrentEvidence]). A row
+ * with current evidence falls through to [DatabaseChecker] and blocks.
+ *
  * Gated on the user setting and the runtime ability to read a
  * verification status (non-null); skipped for historical scans and SMS.
  */
-internal class StirShakenTrustChecker : IChecker {
+internal class StirShakenTrustChecker(
+    private val repo: SpamRepositoryImpl,
+) : IChecker {
     override val priority = CheckerPriority.STIR_SHAKEN_TRUSTED
     override val name = "stir_shaken_trusted"
 
@@ -170,7 +184,10 @@ internal class StirShakenTrustChecker : IChecker {
             verificationStatus = ctx.verificationStatus,
         )
 
-    override suspend fun check(ctx: CheckContext): BlockResult? = decidePure(ctx.verificationStatus)
+    override suspend fun check(ctx: CheckContext): BlockResult? {
+        if (ctx.verificationStatus != VERIFICATION_STATUS_PASSED) return null
+        return decidePure(ctx.verificationStatus, repo.findByNumberInternal(ctx.number))
+    }
 
     companion object {
         // android.telecom.Connection.VERIFICATION_STATUS_PASSED == 1 (AOSP).
@@ -187,12 +204,57 @@ internal class StirShakenTrustChecker : IChecker {
             verificationStatus: Int?,
         ): Boolean = settingEnabled && verificationStatus != null
 
-        /** Pure-logic helper — returns the allow result iff the carrier signed PASSED. */
-        internal fun decidePure(verificationStatus: Int?): BlockResult? =
-            if (verificationStatus == VERIFICATION_STATUS_PASSED) {
-                BlockResult.allow("stir_shaken_trusted")
-            } else {
-                null
+        /** Database evidence at most this old outranks a PASSED attestation. */
+        internal const val CURRENT_EVIDENCE_DAYS = 365L
+
+        private const val COMMUNITY_SOURCE_ID = "community_reports"
+        private const val CORROBORATED_TIER = "corroborated"
+        private const val HOT_LIST_SOURCE = "hot_list"
+        private const val ISO_DATE_LENGTH = 10
+
+        /**
+         * Pure-logic helper. Allows iff the carrier signed PASSED and the
+         * matching database row, if any, has no current evidence against it.
+         */
+        internal fun decidePure(
+            verificationStatus: Int?,
+            row: SpamNumber? = null,
+            today: LocalDate = LocalDate.now(ZoneOffset.UTC),
+        ): BlockResult? =
+            when {
+                verificationStatus != VERIFICATION_STATUS_PASSED -> null
+                row != null && hasCurrentEvidence(row, today) -> null
+                else -> BlockResult.allow("stir_shaken_trusted")
+            }
+
+        /**
+         * Whether a row is recent or corroborated enough to block a caller
+         * the carrier verified: seen within [CURRENT_EVIDENCE_DAYS], trending
+         * on the hot list (which requires three distinct reporters), or
+         * backed by corroborated community reports. A row with none of those
+         * is old complaint data, where the real owners of spoofed numbers sit.
+         */
+        internal fun hasCurrentEvidence(
+            row: SpamNumber,
+            today: LocalDate,
+        ): Boolean {
+            if (row.source == HOT_LIST_SOURCE) return true
+            val cutoff = today.minusDays(CURRENT_EVIDENCE_DAYS)
+            if (seenSince(row.lastSeen, cutoff)) return true
+            val evidence = SourceEvidenceCodec.decode(row.evidenceJson)
+            return evidence.any { seenSince(it.lastSeen, cutoff) } ||
+                evidence.any { it.sourceId == COMMUNITY_SOURCE_ID && it.confidenceTier == CORROBORATED_TIER }
+        }
+
+        /** An undated or unreadable stamp is no evidence of recency. */
+        private fun seenSince(
+            date: String,
+            cutoff: LocalDate,
+        ): Boolean =
+            try {
+                !LocalDate.parse(date.take(ISO_DATE_LENGTH)).isBefore(cutoff)
+            } catch (_: DateTimeParseException) {
+                false
             }
     }
 }

app/src/main/java/com/sysadmindoc/callshield/data/checker/IChecker.kt

@@ -239,8 +239,10 @@ object CheckerPriority {
     // STIR_SHAKEN_TRUSTED: a carrier-signed PASSED attestation is a strong
     // trust signal, but the user's explicit blocklist / wildcard rules AND
     // the categorical prefix feed are authoritative and MUST win against it
-    // (SIM-box fraud can carry A-attestation). It still
-    // beats exact downloaded rows and every statistical layer below.
+    // (SIM-box fraud can carry A-attestation). It beats every statistical
+    // layer below, but an exact downloaded row only when that row's evidence
+    // is stale: older than a year, not trending, and without corroborated
+    // community reports (StirShakenTrustChecker.hasCurrentEvidence).
     // Paired with STIR_SHAKEN (block side) above.
     const val TEMPORARY_ALLOW = 5_350 // one-off false-positive recovery
     const val PREFIX_MATCH = 5_320 // downloaded prefix reputation rows (country/NPA ranges)
@@ -442,7 +444,7 @@ object SpamCheckers {
             add(WhitelistChecker(repo))
             add(ContactWhitelistChecker(appContext, dependencies.spamHeuristics))
             add(ContactsOnlyChecker(appContext, dependencies.spamHeuristics))
-            add(StirShakenTrustChecker())
+            add(StirShakenTrustChecker(repo))
             add(StirShakenChecker())
             add(UserBlocklistChecker(repo))
             add(TemporaryAllowChecker(repo))

app/src/main/java/com/sysadmindoc/callshield/data/model/SpamNumber.kt

@@ -156,6 +156,8 @@ data class SpamNumberJson(
     @param:Json(name = "last_seen") val lastSeen: String = "",
     val description: String = "",
     val evidence: List<SourceEvidenceJson> = emptyList(),
+    /** Where the pipeline got the row, such as `legacy_import` or `community`. */
+    val sources: List<String> = emptyList(),
 )
 
 /** Independent source evidence retained on an imported database row. */

app/src/test/java/com/sysadmindoc/callshield/data/SpamRepositorySyncTest.kt

@@ -3,13 +3,40 @@ package com.sysadmindoc.callshield.data
 import com.sysadmindoc.callshield.data.model.SourceEvidenceJson
 import com.sysadmindoc.callshield.data.model.SpamNumber
 import com.sysadmindoc.callshield.data.model.SpamNumberJson
+import com.sysadmindoc.callshield.data.remote.GitHubDataSource
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class SpamRepositorySyncTest {
+    @Test
+    fun `a community row keeps its community provenance on the device`() {
+        // The shape the pipeline publishes: provenance in `sources`, no
+        // evidence list. The STIR/SHAKEN trust allow reads it back.
+        val shard =
+            GitHubDataSource()
+                .parseSpamShardJson(
+                    """
+                    {"shard_id": "00", "prefixes": [], "numbers": [
+                      {"number": "+18002990523", "type": "spam", "reports": 2, "first_seen": "2026-08-25",
+                       "last_seen": "2026-08-25", "description": "Community reported", "sources": ["community"]},
+                      {"number": "+12012302420", "type": "robocall", "reports": 2, "first_seen": "2016-08-17",
+                       "last_seen": "2016-08-17", "description": "FCC caller ID: Robocalls", "sources": ["legacy_import"]}
+                    ]}
+                    """.trimIndent(),
+                ).getOrThrow()
+
+        val sanitized = sanitizeDatabaseNumbers(shard.numbers, normalizeNumber = { it }, preservedUserBlockedNumbers = emptyMap())
+
+        val community = SourceEvidenceCodec.decode(sanitized[0].evidenceJson)
+        assertEquals(listOf("github_database", "community_reports"), community.map { it.sourceId })
+        assertEquals("corroborated", community.last().confidenceTier)
+        assertEquals("2026-08-25", community.last().lastSeen)
+        assertEquals(listOf("github_database"), SourceEvidenceCodec.decode(sanitized[1].evidenceJson).map { it.sourceId })
+    }
+
     @Test
     fun `sanitizeDatabaseNumbers preserves user block flag for matching remote numbers`() {
         val sanitized =