Expose all Android-relevant shared and mobile preferences without displaying or duplicating secret state.
Scope
Build Material 3 settings sections for repository/server identity, optional HTTPS remote setup, application-token replacement/removal, default GPG key identity, Git author name/email, inactivity timeout, biometric unlock capability/status/toggle, appearance, manual Lock, TOTP cache status/rebuild, and GPG QR import/export.
Read/write shared settings through crates/storage and config.toml; use DataStore only for explicitly presentation-only Android choices approved by #88.
Store tokens/passphrases only through secure-secret APIs. Existing secret values are never displayed, returned as placeholders that could be mistaken for data, or copied.
Enabling biometrics performs capability/authentication/enrollment before committing the setting; disabling removes the protected credential.
Validate dependent changes atomically in Rust and present typed errors without partial state.
Link to Android Credential Manager/Autofill provider system settings and accurately report enabled/disabled capability without requesting broad settings privileges.
Include version/licenses/privacy/support information and recovery explanations for invalidated Keystore data, missing repository, corrupt cache, and offline operation.
Omit all Apple Watch pairing/sharing/status controls.
Acceptance criteria
Shared values stay consistent with CLI/TUI/desktop configuration.
Git name/email are used by Android commits.
Secret replacement/removal and biometric enable/disable are transactional and redacted.
Settings are searchable/navigable where platform conventions support it and pass TalkBack/large-font/adaptive checks.
No Watch-only setting appears, and Kotlin does not directly edit config.toml.
Depends on onboarding, Keystore, biometric authentication, TOTP cache, and app shell. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
## Goal
Expose all Android-relevant shared and mobile preferences without displaying or duplicating secret state.
## Scope
- Build Material 3 settings sections for repository/server identity, optional HTTPS remote setup, application-token replacement/removal, default GPG key identity, Git author name/email, inactivity timeout, biometric unlock capability/status/toggle, appearance, manual Lock, TOTP cache status/rebuild, and GPG QR import/export.
- Read/write shared settings through `crates/storage` and `config.toml`; use DataStore only for explicitly presentation-only Android choices approved by #88.
- Store tokens/passphrases only through secure-secret APIs. Existing secret values are never displayed, returned as placeholders that could be mistaken for data, or copied.
- Enabling biometrics performs capability/authentication/enrollment before committing the setting; disabling removes the protected credential.
- Validate dependent changes atomically in Rust and present typed errors without partial state.
- Link to Android Credential Manager/Autofill provider system settings and accurately report enabled/disabled capability without requesting broad settings privileges.
- Include version/licenses/privacy/support information and recovery explanations for invalidated Keystore data, missing repository, corrupt cache, and offline operation.
- Omit all Apple Watch pairing/sharing/status controls.
## Acceptance criteria
- Shared values stay consistent with CLI/TUI/desktop configuration.
- Git name/email are used by Android commits.
- Secret replacement/removal and biometric enable/disable are transactional and redacted.
- Settings are searchable/navigable where platform conventions support it and pass TalkBack/large-font/adaptive checks.
- No Watch-only setting appears, and Kotlin does not directly edit `config.toml`.
Depends on onboarding, Keystore, biometric authentication, TOTP cache, and app shell. Part of #87.
## Android support update (2026-10-08)
User-directed scope: Android release and CI targets are **arm64-v8a** and **armeabi-v7a**. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
hugo
added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:15:15 +00:00
Implemented the complete Android Settings screen with storage-owned preferences and recovery controls.
Material 3 searchable sections show repository/server and public GPG identities, HTTPS/token setup and explicit removal, Git author, bounded inactivity timeout, biometric capability/status, appearance, manual lock, TOTP cache status/rebuild, and GPG QR import/export. Version, MIT license, dependency license policy, privacy, support, and recovery information are included; no Watch controls are exposed.
Rust validates and persists shared configuration. Default-key changes reject public-only identities and lock protected state. QR import validates private-key passphrases before writing, preserves current settings, and rolls back key writes when the dependent configuration update fails. Kotlin reads no password-store/configuration files directly.
Biometric disable removes encrypted protected records transactionally without requiring authentication from an invalidated key. Pending removals recover from the committed Rust setting after interruption. Enrollment/configuration failures retain the prior setting and credential. Cached native ownership preserves these transactions across FFI; binding verification and Home reads no longer cancel a live shared lease, while Keystore inventory remains validated.
The system image picker reads bounded content URIs and feeds the Rust QR decoder. Transfer frames and form secrets are cleared on close/background and excluded from saved Activity state. Dedicated public Android password/autofill-provider settings intents, accessible key choices, checkbox roles, headings and a scrollable, explicitly sized QR canvas support large fonts.
The CI runner now stops successful instrumentation packages before measuring real application cold starts, releasing retained test activities and native owners. Its seven orchestration unit tests pass. Each of the three emulator configurations passed all instrumentation suites and five cold starts.
Reviewed the connected implementation against the issue scope and acceptance criteria. Verification: all four required Rust gates; complete Android debug/release APK/AAB, lint, formatting, unit-test, dependency/binding/manifest/native-package checks; ARM64 API 26 and API 37 emulator suites including strict 16 KB pages; actual native encrypted-entry/settings/QR/cache and invalidated-key regressions. Computer-use validation used the embedded emulator and public fixture for Git identity changes, timeout rejection, biometric enrollment/removal, readable QR export, system-picker public-key import, and cache rebuilding. Installed TalkBack activated Preferences and searchable settings; its previous emulator configuration was restored. Large-font/adaptive and saved-state redaction checks pass.
Shared bindings were regenerated; xcodegen and iPhone/dependent Watch simulator builds pass. The updated iPhone app was installed over the existing app and its retained locked repository navigation was verified.
Android packages cover arm64-v8a and armeabi-v7a. ARMv7 has build/package validation; available live ARM emulators are ARM64. x86_64 and physical-device testing remain outside the milestone's stated support scope.
Implemented in [43f660a](https://git.rfc1437.de/hugo/IronStorage/commit/43f660ace302427f344ff6006f3a6f099ae7f617).
Implemented the complete Android Settings screen with storage-owned preferences and recovery controls.
- Material 3 searchable sections show repository/server and public GPG identities, HTTPS/token setup and explicit removal, Git author, bounded inactivity timeout, biometric capability/status, appearance, manual lock, TOTP cache status/rebuild, and GPG QR import/export. Version, MIT license, dependency license policy, privacy, support, and recovery information are included; no Watch controls are exposed.
- Rust validates and persists shared configuration. Default-key changes reject public-only identities and lock protected state. QR import validates private-key passphrases before writing, preserves current settings, and rolls back key writes when the dependent configuration update fails. Kotlin reads no password-store/configuration files directly.
- Biometric disable removes encrypted protected records transactionally without requiring authentication from an invalidated key. Pending removals recover from the committed Rust setting after interruption. Enrollment/configuration failures retain the prior setting and credential. Cached native ownership preserves these transactions across FFI; binding verification and Home reads no longer cancel a live shared lease, while Keystore inventory remains validated.
- The system image picker reads bounded content URIs and feeds the Rust QR decoder. Transfer frames and form secrets are cleared on close/background and excluded from saved Activity state. Dedicated public Android password/autofill-provider settings intents, accessible key choices, checkbox roles, headings and a scrollable, explicitly sized QR canvas support large fonts.
The CI runner now stops successful instrumentation packages before measuring real application cold starts, releasing retained test activities and native owners. Its seven orchestration unit tests pass. Each of the three emulator configurations passed all instrumentation suites and five cold starts.
Reviewed the connected implementation against the issue scope and acceptance criteria. Verification: all four required Rust gates; complete Android debug/release APK/AAB, lint, formatting, unit-test, dependency/binding/manifest/native-package checks; ARM64 API 26 and API 37 emulator suites including strict 16 KB pages; actual native encrypted-entry/settings/QR/cache and invalidated-key regressions. Computer-use validation used the embedded emulator and public fixture for Git identity changes, timeout rejection, biometric enrollment/removal, readable QR export, system-picker public-key import, and cache rebuilding. Installed TalkBack activated Preferences and searchable settings; its previous emulator configuration was restored. Large-font/adaptive and saved-state redaction checks pass.
Shared bindings were regenerated; xcodegen and iPhone/dependent Watch simulator builds pass. The updated iPhone app was installed over the existing app and its retained locked repository navigation was verified.
Android packages cover arm64-v8a and armeabi-v7a. ARMv7 has build/package validation; available live ARM emulators are ARM64. x86_64 and physical-device testing remain outside the milestone's stated support scope.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Expose all Android-relevant shared and mobile preferences without displaying or duplicating secret state.
Scope
crates/storageandconfig.toml; use DataStore only for explicitly presentation-only Android choices approved by #88.Acceptance criteria
config.toml.Depends on onboarding, Keystore, biometric authentication, TOTP cache, and app shell. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
Implemented in 43f660a.
Implemented the complete Android Settings screen with storage-owned preferences and recovery controls.
The CI runner now stops successful instrumentation packages before measuring real application cold starts, releasing retained test activities and native owners. Its seven orchestration unit tests pass. Each of the three emulator configurations passed all instrumentation suites and five cold starts.
Reviewed the connected implementation against the issue scope and acceptance criteria. Verification: all four required Rust gates; complete Android debug/release APK/AAB, lint, formatting, unit-test, dependency/binding/manifest/native-package checks; ARM64 API 26 and API 37 emulator suites including strict 16 KB pages; actual native encrypted-entry/settings/QR/cache and invalidated-key regressions. Computer-use validation used the embedded emulator and public fixture for Git identity changes, timeout rejection, biometric enrollment/removal, readable QR export, system-picker public-key import, and cache rebuilding. Installed TalkBack activated Preferences and searchable settings; its previous emulator configuration was restored. Large-font/adaptive and saved-state redaction checks pass.
Shared bindings were regenerated; xcodegen and iPhone/dependent Watch simulator builds pass. The updated iPhone app was installed over the existing app and its retained locked repository navigation was verified.
Android packages cover arm64-v8a and armeabi-v7a. ARMv7 has build/package validation; available live ARM emulators are ARM64. x86_64 and physical-device testing remain outside the milestone's stated support scope.