Apply Android-specific presentation security consistently across the main app and external credential components.
Scope
Feed foreground/background, explicit user activity, protected-state loss, trim-memory, and process recreation events into storage-owned authentication lifecycle APIs.
Apply FLAG_SECURE to sensitive activities/windows so screenshots, screen recording, casting surfaces, and recent-app thumbnails do not expose protected content; document unavoidable platform/OEM limits.
Mask and clear decrypted Compose state before/when the app backgrounds, the lease expires, or manual lock occurs. Never rely on a later recomposition as the only cleanup.
Implement storage-directed copy with Android ClipboardManager, mark clips sensitive using ClipDescription.EXTRA_IS_SENSITIVE where supported, show explicit feedback, and compare identity/content before timed clearing so newer clipboard data is never erased.
Do not extend the authentication lease for passive TOTP ticks, animations, recomposition, background work, or clipboard cleanup.
Audit logs, crash text, analytics (none by default), notifications, saved state, previews, accessibility text, autofill structures, and memory diagnostics for secrets.
Define behavior for multi-window, picture-in-picture rejection, screen sharing, external displays, process death, and task switching.
Acceptance criteria
Passwords, PIN fields, OTP URIs/codes, key armor, tokens, and passphrases never appear in screenshots/recents/logs/saved state.
Clipboard timeout and race tests preserve unrelated/newer user clipboard content.
Background/expiry/manual lock synchronously masks all protected UI and drops bridge presentation objects.
Passive display work does not renew authentication.
Security behavior is exercised on minimum/current API devices and documented where OEM behavior cannot be guaranteed.
Depends on the Compose shell, biometric authentication, and platform-neutral contract issues. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
## Goal
Apply Android-specific presentation security consistently across the main app and external credential components.
## Scope
- Feed foreground/background, explicit user activity, protected-state loss, trim-memory, and process recreation events into storage-owned authentication lifecycle APIs.
- Apply `FLAG_SECURE` to sensitive activities/windows so screenshots, screen recording, casting surfaces, and recent-app thumbnails do not expose protected content; document unavoidable platform/OEM limits.
- Mask and clear decrypted Compose state before/when the app backgrounds, the lease expires, or manual lock occurs. Never rely on a later recomposition as the only cleanup.
- Implement storage-directed copy with Android `ClipboardManager`, mark clips sensitive using `ClipDescription.EXTRA_IS_SENSITIVE` where supported, show explicit feedback, and compare identity/content before timed clearing so newer clipboard data is never erased.
- Do not extend the authentication lease for passive TOTP ticks, animations, recomposition, background work, or clipboard cleanup.
- Audit logs, crash text, analytics (none by default), notifications, saved state, previews, accessibility text, autofill structures, and memory diagnostics for secrets.
- Define behavior for multi-window, picture-in-picture rejection, screen sharing, external displays, process death, and task switching.
## Acceptance criteria
- Passwords, PIN fields, OTP URIs/codes, key armor, tokens, and passphrases never appear in screenshots/recents/logs/saved state.
- Clipboard timeout and race tests preserve unrelated/newer user clipboard content.
- Background/expiry/manual lock synchronously masks all protected UI and drops bridge presentation objects.
- Passive display work does not renew authentication.
- Security behavior is exercised on minimum/current API devices and documented where OEM behavior cannot be guaranteed.
Depends on the Compose shell, biometric authentication, and platform-neutral contract issues. Part of #87.
## Android support update (2026-10-08)
User-directed scope: Android release and CI targets are **arm64-v8a** and **armeabi-v7a**. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
hugo
added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:12:20 +00:00
Implemented Android presentation security in Rust with native lifecycle and window adapters.
Added Rust lifecycle revocation for memory pressure/process recreation, foreground-without-renewal coverage, editor disposal, and immediate content-checked copy cleanup.
Android synchronously covers and clears protected UI, cancels setup/authentication work, orders Rust revocation before a new unlock, and rejects stale results. Focus loss and task leaving also revoke access, including Android 37 Recents keeping an activity resumed. Owned dialogs and active OS biometric requests remain usable.
Secure windows/recents, autofill/content-capture exclusions, IME learning/extract restrictions, secondary-display rejection and disabled picture-in-picture are applied. Protected input is not saved across recreation.
Clipboard copies use separate capabilities, sensitive metadata, owner identity plus OS timestamp, and Rust content comparison. Cleanup preserves unrelated/newer copies, including identical text and restored metadata. Copy feedback follows a successful OS write.
Reviewed the complete change against all issue acceptance criteria, dialog/menu callers, lifecycle races, diagnostics, saved state and architecture boundaries. Documented platform limits and reuse by the future credential components in docs/android/presentation-security.md.
Validation: all four required Rust workspace gates passed. Full Android build/unit/lint/ktlint/architecture/package/dependency gates passed for arm64-v8a and armeabi-v7a, including release APK/AAB and symbols. App/core/bridge instrumentation, native-load checks and five cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and strict API 37/16 KB emulators. Computer use in Android Studio's embedded emulator verified blank Recents and cleared, visible input on return. Real Keystore fixture testing passed enrollment, unlock, cancellation, background cancellation, foreground remaining locked, post-background unlock and synchronous memory-pressure revocation using public disposable credentials and the enrolled synthetic fingerprint.
Limits: no suitable ARMv7 emulator image; ARMv7 build/package validation only. Physical devices and OEM-specific casting/capture are excluded from the milestone test scope. OS clipboard IPC is not atomic, background access can be denied, and JVM strings cannot be forensically zeroized; these limits are documented. No Apple UI/project changed.
Delivered in commit a06f39af23bc46df6c79d1ad53b531235c1b452c.
Implemented Android presentation security in Rust with native lifecycle and window adapters.
- Added Rust lifecycle revocation for memory pressure/process recreation, foreground-without-renewal coverage, editor disposal, and immediate content-checked copy cleanup.
- Android synchronously covers and clears protected UI, cancels setup/authentication work, orders Rust revocation before a new unlock, and rejects stale results. Focus loss and task leaving also revoke access, including Android 37 Recents keeping an activity resumed. Owned dialogs and active OS biometric requests remain usable.
- Secure windows/recents, autofill/content-capture exclusions, IME learning/extract restrictions, secondary-display rejection and disabled picture-in-picture are applied. Protected input is not saved across recreation.
- Clipboard copies use separate capabilities, sensitive metadata, owner identity plus OS timestamp, and Rust content comparison. Cleanup preserves unrelated/newer copies, including identical text and restored metadata. Copy feedback follows a successful OS write.
- Reviewed the complete change against all issue acceptance criteria, dialog/menu callers, lifecycle races, diagnostics, saved state and architecture boundaries. Documented platform limits and reuse by the future credential components in docs/android/presentation-security.md.
Validation: all four required Rust workspace gates passed. Full Android build/unit/lint/ktlint/architecture/package/dependency gates passed for arm64-v8a and armeabi-v7a, including release APK/AAB and symbols. App/core/bridge instrumentation, native-load checks and five cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and strict API 37/16 KB emulators. Computer use in Android Studio's embedded emulator verified blank Recents and cleared, visible input on return. Real Keystore fixture testing passed enrollment, unlock, cancellation, background cancellation, foreground remaining locked, post-background unlock and synchronous memory-pressure revocation using public disposable credentials and the enrolled synthetic fingerprint.
Limits: no suitable ARMv7 emulator image; ARMv7 build/package validation only. Physical devices and OEM-specific casting/capture are excluded from the milestone test scope. OS clipboard IPC is not atomic, background access can be denied, and JVM strings cannot be forensically zeroized; these limits are documented. No Apple UI/project changed.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Apply Android-specific presentation security consistently across the main app and external credential components.
Scope
FLAG_SECUREto sensitive activities/windows so screenshots, screen recording, casting surfaces, and recent-app thumbnails do not expose protected content; document unavoidable platform/OEM limits.ClipboardManager, mark clips sensitive usingClipDescription.EXTRA_IS_SENSITIVEwhere supported, show explicit feedback, and compare identity/content before timed clearing so newer clipboard data is never erased.Acceptance criteria
Depends on the Compose shell, biometric authentication, and platform-neutral contract issues. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
Delivered in commit
a06f39af23.Implemented Android presentation security in Rust with native lifecycle and window adapters.
Validation: all four required Rust workspace gates passed. Full Android build/unit/lint/ktlint/architecture/package/dependency gates passed for arm64-v8a and armeabi-v7a, including release APK/AAB and symbols. App/core/bridge instrumentation, native-load checks and five cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and strict API 37/16 KB emulators. Computer use in Android Studio's embedded emulator verified blank Recents and cleared, visible input on return. Real Keystore fixture testing passed enrollment, unlock, cancellation, background cancellation, foreground remaining locked, post-background unlock and synchronous memory-pressure revocation using public disposable credentials and the enrolled synthetic fingerprint.
Limits: no suitable ARMv7 emulator image; ARMv7 build/package validation only. Physical devices and OEM-specific casting/capture are excluded from the milestone test scope. OS clipboard IPC is not atomic, background access can be denied, and JVM strings cannot be forensically zeroized; these limits are documented. No Apple UI/project changed.