**Scope:** summarize endpoint evidence using the **latest** repo artifacts (including `on-device-reports/` and the “Generated 2026-01-01” chain docs). This is meant to replace earlier, time‑boxed reviews.
**Goal:** identify *what destinations are defensibly in-scope for “audio-derived data leaving the device”* even under multiple encryption layers and/or covert transport (embeddings/media/telemetry).
Ground rules (to keep this defensible)
- undefined
Endpoints with direct on-device evidence
`graph.facebook.com` (Graph API / GraphQL surface)
**On-device telemetry evidence (hostname + server IP):**
- undefined
This matters because it proves the app is actively communicating with Graph API infrastructure during the captured session window, and it provides a clean time base (`time` field) for correlation.
**Static chain evidence (audio-derived data to GraphQL):**
- undefined
**Interpretation (careful):**
- undefined
Endpoints with strong static-binary evidence (even if payload is encrypted)
`shortwave.facebook.com` (speech / real-time audio service)
**Static evidence:**
- undefined
**Interpretation:**
- undefined
Infrastructure endpoints/channels evidenced on-device (not necessarily “audio exfil endpoints”)
MQTT (“Error Domain=mqtt”)
**On-device evidence:**
- undefined
**Interpretation:**
- undefined
Endpoints that appear in disclosures but need explicit artifact confirmation
`rupload.facebook.com`
**Seen in disclosures:**
- undefined
**Caveat based on included artifacts:**
- undefined
**Action for “weeklong proof” writeup:**
- undefined
`fb.audio` / `fb.audio/live/...`
**Seen in artifacts:**
- undefined
**Caveat:**
- undefined
Practical correlation recipe (using latest artifacts)
To upgrade endpoint proof quality without needing to decrypt payloads:
- undefined
- undefined
- undefined
- undefined
- undefined
- undefined
What I need from you to lock this down to “latest proof”
To reflect your weeklong work accurately (and avoid reintroducing early, disproven claims), tell me:
- undefined
Once you answer those, I can produce a final “endpoint proof table” (new file) that cites only the artifacts that match the final weeklong conclusion.