Polish the complete Android client for the diversity of Android devices and input/accessibility configurations before the final audit.
Scope
Verify every screen with TalkBack, Switch Access where available, large font/display scaling, high contrast, color correction, reduced motion, hardware keyboard/D-pad, touch, and RTL layouts.
Use semantic labels/actions/state descriptions that do not announce hidden secrets. Provide non-gesture alternatives for swipe, drag/reorder, pull-to-refresh, reveal, copy, and destructive actions.
Validate compact/medium/expanded widths, tablets, foldables in folded/unfolded/tabletop postures, live resize, multi-window, desktop windowing, portrait/landscape, cutouts, edge-to-edge, and IME insets.
Externalize all user-facing Kotlin strings and format plural/date/time values correctly. Rust-owned view-ready text remains the domain source until a separately designed localization contract replaces it; never parse it.
Measure cold/warm startup including native loading, large-tree navigation/search, TOTP cached open/refresh, editor typing, QR analysis, and credential-provider response latency.
Remove main-thread bridge/file/network work, ANRs, unbounded allocations, recomposition churn, and stale/cancelled work. Add Baseline Profiles/Macrobenchmarks for proven critical journeys.
Exercise low-memory/process death, battery saver, doze, offline, metered network, camera interruption, and storage pressure without weakening security.
Run Compose accessibility checks and representative ARM emulator smoke tests across available API/ABI classes.
Acceptance criteria
No unexplained Tier 2 adaptive/large-screen, accessibility, RTL, or keyboard gap remains.
Hidden secrets are not exposed through semantics or accessibility announcements.
Documented performance budgets are met on a representative lower-end API-26-class device and current arm64 device, or deviations have actionable follow-ups.
No interactive secret/repository operation is incorrectly moved into background work to hide latency.
The UI remains coherent across fold/resize/process recreation and cancellation.
Depends on completion of all Android feature UI issues. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
## Goal
Polish the complete Android client for the diversity of Android devices and input/accessibility configurations before the final audit.
## Scope
- Verify every screen with TalkBack, Switch Access where available, large font/display scaling, high contrast, color correction, reduced motion, hardware keyboard/D-pad, touch, and RTL layouts.
- Use semantic labels/actions/state descriptions that do not announce hidden secrets. Provide non-gesture alternatives for swipe, drag/reorder, pull-to-refresh, reveal, copy, and destructive actions.
- Validate compact/medium/expanded widths, tablets, foldables in folded/unfolded/tabletop postures, live resize, multi-window, desktop windowing, portrait/landscape, cutouts, edge-to-edge, and IME insets.
- Externalize all user-facing Kotlin strings and format plural/date/time values correctly. Rust-owned view-ready text remains the domain source until a separately designed localization contract replaces it; never parse it.
- Measure cold/warm startup including native loading, large-tree navigation/search, TOTP cached open/refresh, editor typing, QR analysis, and credential-provider response latency.
- Remove main-thread bridge/file/network work, ANRs, unbounded allocations, recomposition churn, and stale/cancelled work. Add Baseline Profiles/Macrobenchmarks for proven critical journeys.
- Exercise low-memory/process death, battery saver, doze, offline, metered network, camera interruption, and storage pressure without weakening security.
- Run Compose accessibility checks and representative ARM emulator smoke tests across available API/ABI classes.
## Acceptance criteria
- No unexplained Tier 2 adaptive/large-screen, accessibility, RTL, or keyboard gap remains.
- Hidden secrets are not exposed through semantics or accessibility announcements.
- Documented performance budgets are met on a representative lower-end API-26-class device and current arm64 device, or deviations have actionable follow-ups.
- No interactive secret/repository operation is incorrectly moved into background work to hide latency.
- The UI remains coherent across fold/resize/process recreation and cancellation.
Depends on completion of all Android feature UI issues. Part of #87.
## Android support update (2026-10-08)
User-directed scope: Android release and CI targets are **arm64-v8a** and **armeabi-v7a**. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
hugo
added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:15:15 +00:00
Independent implementation committed and pushed to main as 6669b77f4e.
Implemented:
Kotlin-owned notices, action labels, counts and durations use Android resources; repeated editor actions name the field. Hidden editor values are checked against Android accessibility nodes. Automated Compose accessibility checks cover existing app screens.
Actual-window adaptive/RTL/large-font tests and real-IME regression coverage. Fixed the reproduced keyboard overlap in the shared shell using IME insets and explicit adjustResize.
Rust skips repository traversal for blank name searches, bounds QR luminance dimensions before decoder allocation, and zeroizes owned decoded luminance. License loading runs off the main thread. Editor recovery checkpoints coalesce rapid typing and preserve the latest value across protected recovery.
Native journey budgets with strict sanitized numeric reports; a release-code Macrobenchmark harness, native-ready full-display reporting, and a generated unobfuscated startup/Preferences baseline profile packaged into the release APK. Dependency locks, verification metadata and license policy updated.
Android unit tests, lint, ktlint, architecture checks, ARM APK/AAB/native audits and dependency/license inventory passed. CI parser self-checks passed. Release profile packaging was verified.
ARM64 instrumentation passed on API 26 / 4 KB, API 37 / 4 KB, and API 37 / strict 16 KB, including app/core/bridge suites, bounded native journeys and five cold starts per image. Full app RTL instrumentation passed. Six actual-window geometry/font/RTL cases passed on API 26. The reproduced IME regression passed after the fix on API 26 and strict-16-KB API 37.
Five cold and five warm release-like startup iterations passed on API 26 and API 37. Median full-display times: API 26 268.6 ms cold / 131.2 ms warm; API 37 1203.5 ms cold / 427.0 ms warm. These preserve existing compilation state and do not establish a baseline-profile speedup.
Computer use validated the retained Android app's Home/Preferences in the Android Studio embedded emulator. xcodegen and the affected iPhone/watch simulator build passed for shared Rust changes; installed over the retained iPhone app and validated folder navigation with computer use.
Reviewed the connected implementation against the issue; no remaining defect was found in this independent scope. ARMv7 was package-validated, not emulator-runtime tested. Opt-in biometric/inspection assumptions do not establish manual coverage.
This issue remains OPEN by the user's explicit instruction. Its description depends on completion of all Android feature UI issues. #106–#110 are still open and now all carry critical, so those eligible enhancements are implemented in numeric order before revisiting #105. Final coverage still includes finished-feature TalkBack/Switch Access, contrast/motion modes, real hinge/posture/live resize, low-memory/doze/battery/network/camera-interruption/storage-pressure scenarios, TOTP cached-open/refresh presentation latency and provider response latency. Current tests do not certify those future screens or environments.
The committed docs/android/hardening.md records exact budgets, evidence, profile provenance, remaining coverage and resume order. Work stops here as requested; no next issue has been started. Post-closure cargo/DerivedData/Android cleanup remains due after #105 is actually completed and closed.
Independent implementation committed and pushed to main as 6669b77f4e67f938431e4d48b36379d505dcd12a.
Implemented:
- Kotlin-owned notices, action labels, counts and durations use Android resources; repeated editor actions name the field. Hidden editor values are checked against Android accessibility nodes. Automated Compose accessibility checks cover existing app screens.
- Actual-window adaptive/RTL/large-font tests and real-IME regression coverage. Fixed the reproduced keyboard overlap in the shared shell using IME insets and explicit adjustResize.
- Rust skips repository traversal for blank name searches, bounds QR luminance dimensions before decoder allocation, and zeroizes owned decoded luminance. License loading runs off the main thread. Editor recovery checkpoints coalesce rapid typing and preserve the latest value across protected recovery.
- Native journey budgets with strict sanitized numeric reports; a release-code Macrobenchmark harness, native-ready full-display reporting, and a generated unobfuscated startup/Preferences baseline profile packaged into the release APK. Dependency locks, verification metadata and license policy updated.
Validation:
- All required root Rust gates passed: cargo fmt --all -- --check; RUSTFLAGS="-D warnings" cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace.
- Android unit tests, lint, ktlint, architecture checks, ARM APK/AAB/native audits and dependency/license inventory passed. CI parser self-checks passed. Release profile packaging was verified.
- ARM64 instrumentation passed on API 26 / 4 KB, API 37 / 4 KB, and API 37 / strict 16 KB, including app/core/bridge suites, bounded native journeys and five cold starts per image. Full app RTL instrumentation passed. Six actual-window geometry/font/RTL cases passed on API 26. The reproduced IME regression passed after the fix on API 26 and strict-16-KB API 37.
- Five cold and five warm release-like startup iterations passed on API 26 and API 37. Median full-display times: API 26 268.6 ms cold / 131.2 ms warm; API 37 1203.5 ms cold / 427.0 ms warm. These preserve existing compilation state and do not establish a baseline-profile speedup.
- Computer use validated the retained Android app's Home/Preferences in the Android Studio embedded emulator. xcodegen and the affected iPhone/watch simulator build passed for shared Rust changes; installed over the retained iPhone app and validated folder navigation with computer use.
- Reviewed the connected implementation against the issue; no remaining defect was found in this independent scope. ARMv7 was package-validated, not emulator-runtime tested. Opt-in biometric/inspection assumptions do not establish manual coverage.
This issue remains OPEN by the user's explicit instruction. Its description depends on completion of all Android feature UI issues. #106–#110 are still open and now all carry critical, so those eligible enhancements are implemented in numeric order before revisiting #105. Final coverage still includes finished-feature TalkBack/Switch Access, contrast/motion modes, real hinge/posture/live resize, low-memory/doze/battery/network/camera-interruption/storage-pressure scenarios, TOTP cached-open/refresh presentation latency and provider response latency. Current tests do not certify those future screens or environments.
The committed docs/android/hardening.md records exact budgets, evidence, profile provenance, remaining coverage and resume order. Work stops here as requested; no next issue has been started. Post-closure cargo/DerivedData/Android cleanup remains due after #105 is actually completed and closed.
Completed the remaining #105 hardening on top of the existing Rust/native foundation (6669b77); preserved the pre-existing working-tree changes.
Added hinge-safe shell/provider layouts and protected dialogs with window-coordinate bounds, RTL-safe offsets and consumed insets. Tabletop dialogs use the upper pane; large-font forms/actions remain scrollable without dropping protected input state.
Raised consent/selection touch targets to 48 dp and expanded finished-screen accessibility checks. Fixed a real permanent-black-surface bug after foreground cleanup: the parent now observes the cleanup generation and reveals only the clean composed generation. The regression failed before the fix, then passed afterward; computer use verified failed unlock followed by usable Search.
Expanded native Rust-backed performance fixtures to 10,000 encrypted entries, cached TOTP/provider preparation and authenticated GPG fill. Added actual camera interruption/resume and API-26 Keystore protection checks. CI rejects asleep/locked emulators and always stops completed/failed harness and target processes without deleting app data.
Regenerated the baseline profile across startup, Preferences, Passwords, Search and cached TOTP; rebuilt/audited the final packages. Compiled profile: 10,148 bytes plus 1,376-byte metadata.
Validation:
Required Cargo fmt, warnings-as-errors workspace check, Clippy and full workspace tests passed. Android build/lint/ktlint/JVM tests, both ARM ABI/16-KB package audits, manifest/backup exclusions, symbols and dependency/license/SBOM checks passed; CI script self-tests: 11 passed.
Fresh post-restart app/core/bridge/platform suites and five debug cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and API 37/strict 16 KB. Final presentation/security suite: 53 reported cases per configuration, with opt-in inspection/biometric assumption-skips distinguished in the hardening notes.
API 26 passed eight width/font/RTL/landscape/IME/live-resize cases and a real split-screen smoke check. Pixel Fold passed unfolded, book, tabletop, folded cover and tabletop IME, with setup/key-selection also inspected by computer use.
Full phone presentation passed 200% text, RTL, high contrast, grayscale and disabled animations; native cached work passed deep doze, battery saver, offline, metered Wi-Fi and forced-low-storage notification. Settings were restored. Write-failure/rollback is covered by Rust tests; no destructive disk-fill test was used.
Final release full-display startup, five cold and five warm samples each: API 26 cold 191.0–216.4 ms / warm 56.5–84.2 ms; API 37 strict-16-KB cold 246.4–475.9 ms / warm 78.5–139.3 ms. All ten native journey budgets also pass; full numbers and reproducible gates are in docs/android/hardening.md.
Computer use decrypted the retained public provider fixture, inspected Hidden password controls and used bound TalkBack to focus Hidden and open/cancel the native editor. Vault history/data survived install-over updates.
Review: reread the changed shared layouts/dialog callers, cleanup lifecycle, native fixtures and CI failure/cleanup paths against this issue. No remaining implementation finding for #105.
Limits explicitly retained: no spoken-audio verification; Switch Access enabled but its USB/key-assignment setup could not capture emulator/forwarded keys, so scanning is unverified; available ARM images do not expose genuine desktop/freeform decorations; ARMv7 is compile/package-audited, not runtime-tested. The other retained phone vault rejected its historical fixture passphrase, so that specific manual unlock is not counted; the source-defined provider fixture supplies the successful decryption journey. No x86_64/physical-device coverage is claimed. Existing storage-initialization diagnostics observed during validation are retained for the next milestone audit (#111).
Delivered in [45d78aa](https://git.rfc1437.de/hugo/IronStorage/commit/45d78aa5b335d5bdd3b34748c4c7a9bcd5916012).
Completed the remaining #105 hardening on top of the existing Rust/native foundation (6669b77); preserved the pre-existing working-tree changes.
- Added hinge-safe shell/provider layouts and protected dialogs with window-coordinate bounds, RTL-safe offsets and consumed insets. Tabletop dialogs use the upper pane; large-font forms/actions remain scrollable without dropping protected input state.
- Raised consent/selection touch targets to 48 dp and expanded finished-screen accessibility checks. Fixed a real permanent-black-surface bug after foreground cleanup: the parent now observes the cleanup generation and reveals only the clean composed generation. The regression failed before the fix, then passed afterward; computer use verified failed unlock followed by usable Search.
- Expanded native Rust-backed performance fixtures to 10,000 encrypted entries, cached TOTP/provider preparation and authenticated GPG fill. Added actual camera interruption/resume and API-26 Keystore protection checks. CI rejects asleep/locked emulators and always stops completed/failed harness and target processes without deleting app data.
- Regenerated the baseline profile across startup, Preferences, Passwords, Search and cached TOTP; rebuilt/audited the final packages. Compiled profile: 10,148 bytes plus 1,376-byte metadata.
Validation:
- Required Cargo fmt, warnings-as-errors workspace check, Clippy and full workspace tests passed. Android build/lint/ktlint/JVM tests, both ARM ABI/16-KB package audits, manifest/backup exclusions, symbols and dependency/license/SBOM checks passed; CI script self-tests: 11 passed.
- Fresh post-restart app/core/bridge/platform suites and five debug cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and API 37/strict 16 KB. Final presentation/security suite: 53 reported cases per configuration, with opt-in inspection/biometric assumption-skips distinguished in the hardening notes.
- API 26 passed eight width/font/RTL/landscape/IME/live-resize cases and a real split-screen smoke check. Pixel Fold passed unfolded, book, tabletop, folded cover and tabletop IME, with setup/key-selection also inspected by computer use.
- Full phone presentation passed 200% text, RTL, high contrast, grayscale and disabled animations; native cached work passed deep doze, battery saver, offline, metered Wi-Fi and forced-low-storage notification. Settings were restored. Write-failure/rollback is covered by Rust tests; no destructive disk-fill test was used.
- Final release full-display startup, five cold and five warm samples each: API 26 cold 191.0–216.4 ms / warm 56.5–84.2 ms; API 37 strict-16-KB cold 246.4–475.9 ms / warm 78.5–139.3 ms. All ten native journey budgets also pass; full numbers and reproducible gates are in docs/android/hardening.md.
- Computer use decrypted the retained public provider fixture, inspected Hidden password controls and used bound TalkBack to focus Hidden and open/cancel the native editor. Vault history/data survived install-over updates.
Review: reread the changed shared layouts/dialog callers, cleanup lifecycle, native fixtures and CI failure/cleanup paths against this issue. No remaining implementation finding for #105.
Limits explicitly retained: no spoken-audio verification; Switch Access enabled but its USB/key-assignment setup could not capture emulator/forwarded keys, so scanning is unverified; available ARM images do not expose genuine desktop/freeform decorations; ARMv7 is compile/package-audited, not runtime-tested. The other retained phone vault rejected its historical fixture passphrase, so that specific manual unlock is not counted; the source-defined provider fixture supplies the successful decryption journey. No x86_64/physical-device coverage is claimed. Existing storage-initialization diagnostics observed during validation are retained for the next milestone audit (#111).
[Full hardening evidence and reproduction commands](https://git.rfc1437.de/hugo/IronStorage/src/commit/45d78aa5b335d5bdd3b34748c4c7a9bcd5916012/docs/android/hardening.md).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Polish the complete Android client for the diversity of Android devices and input/accessibility configurations before the final audit.
Scope
Acceptance criteria
Depends on completion of all Android feature UI issues. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
Independent implementation committed and pushed to main as
6669b77f4e.Implemented:
Validation:
This issue remains OPEN by the user's explicit instruction. Its description depends on completion of all Android feature UI issues. #106–#110 are still open and now all carry critical, so those eligible enhancements are implemented in numeric order before revisiting #105. Final coverage still includes finished-feature TalkBack/Switch Access, contrast/motion modes, real hinge/posture/live resize, low-memory/doze/battery/network/camera-interruption/storage-pressure scenarios, TOTP cached-open/refresh presentation latency and provider response latency. Current tests do not certify those future screens or environments.
The committed docs/android/hardening.md records exact budgets, evidence, profile provenance, remaining coverage and resume order. Work stops here as requested; no next issue has been started. Post-closure cargo/DerivedData/Android cleanup remains due after #105 is actually completed and closed.
Delivered in 45d78aa.
Completed the remaining #105 hardening on top of the existing Rust/native foundation (
6669b77); preserved the pre-existing working-tree changes.Validation:
Review: reread the changed shared layouts/dialog callers, cleanup lifecycle, native fixtures and CI failure/cleanup paths against this issue. No remaining implementation finding for #105.
Limits explicitly retained: no spoken-audio verification; Switch Access enabled but its USB/key-assignment setup could not capture emulator/forwarded keys, so scanning is unverified; available ARM images do not expose genuine desktop/freeform decorations; ARMv7 is compile/package-audited, not runtime-tested. The other retained phone vault rejected its historical fixture passphrase, so that specific manual unlock is not counted; the source-defined provider fixture supplies the successful decryption journey. No x86_64/physical-device coverage is claimed. Existing storage-initialization diagnostics observed during validation are retained for the next milestone audit (#111).
Full hardening evidence and reproduction commands.