Adds mobile async callback hooks

client/mdm/policy_mobile.go

@@ -2,13 +2,41 @@
 
 package mdm
 
-// loadPlatformPolicy is unused on mobile: the native layer (Swift on iOS,
-// Kotlin/Java on Android) reads the OS managed-config store and pushes the
-// resulting dictionary in-process via a gomobile entry point that lands in
-// Phase 5 / Phase 6. The stub keeps the package compilable for mobile
-// builds and returns (nil, nil) — the platform-absent sentinel that
-// LoadPolicy in policy.go treats as "no MDM source present".
-func loadPlatformPolicy() (map[string]any, error) {
-	//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
-	return nil, nil
+// PolicyFetcher is the bridge between Go and the mobile native layer
+// (Kotlin/Java on Android, Swift on iOS). The native layer registers
+// an implementation at gomobile init via SetMobilePolicyFetcher;
+// thereafter every call to loadPlatformPolicy delegates to the
+// registered fetcher, which reads the OS-native managed-config store
+// (RestrictionsManager on Android, com.apple.configuration.managed
+// UserDefaults on iOS) and returns the current snapshot.
+//
+// Set-once at init, never mutated at runtime → no synchronisation
+// required for the read path. The native layer must register before
+// any Go code starts polling or processing MDM events.
+type PolicyFetcher interface {
+	Fetch() map[string]any
+}
+
+var fetcher PolicyFetcher
+
+// SetMobilePolicyFetcher registers the native-provided fetcher. Call
+// exactly once from the gomobile init code (Kotlin Application.onCreate
+// / Swift AppDelegate) before the daemon starts. Passing nil disables
+// MDM enforcement on this build (loadPlatformPolicy returns
+// (nil, nil) — the platform-absent sentinel that LoadPolicy treats as
+// "no MDM source present").
+func SetMobilePolicyFetcher(p PolicyFetcher) {
+	fetcher = p
+}
+
+// loadPlatformPolicy delegates to the native-provided fetcher. Returns
+// (nil, nil) — the platform-absent sentinel — when no fetcher has been
+// registered yet, so the package behaves identically to a desktop
+// device without an MDM source.
+func loadPlatformPolicy() (map[string]any, error) {
+	if fetcher == nil {
+		//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
+		return nil, nil
+	}
+	return fetcher.Fetch(), nil
 }

client/server/mdm_mobile.go

@@ -0,0 +1,20 @@
+//go:build ios || android
+
+package server
+
+// OnMDMPolicyChanged is the mobile entry point invoked by the native
+// layer (Kotlin / Swift) when the OS broadcasts an MDM configuration
+// change (ACTION_APPLICATION_RESTRICTIONS_CHANGED on Android,
+// UserDefaults.didChangeNotification on iOS). The OS notification only
+// signals "something changed" — no payload — so this hook re-runs the
+// same load-and-diff sequence the desktop ticker triggers on each
+// tick. The fresh policy values are read on demand by
+// mdm.loadPlatformPolicy, which on mobile delegates to the
+// PolicyFetcher registered by the native layer via
+// mdm.SetMobilePolicyFetcher.
+//
+// Safe to call at any time after Server construction. Re-entrancy is
+// serialised by the s.mutex acquired inside onMDMPolicyChange.
+func (s *Server) OnMDMPolicyChanged() {
+	s.onMDMPolicyChange(nil, nil)
+}