Prove that the Android application is a secure, native, complete presentation of IronStorage before distribution.
Scope
Maintain a coverage matrix mapping every current non-Watch iPhone/mobile capability and applicable shared storage behavior to an Android screen, system component, test, and owning Rust API.
Include local/remote onboarding, key generation/import/export, Home/Git, hierarchy/search, viewer/editor/generation, move/copy/delete, biometric lease, TOTP cache/detail, Settings, clipboard/privacy, and Credential Manager/Autofill.
Explicitly exclude Apple Watch/watchOS/Watch Connectivity only. Android Wear is not a substitute and must not be stubbed.
Audit Rust/Kotlin/UniFFI boundaries for direct repository access, parsing, Git/GPG/OTP/password generation, secure-secret policy, app/site identity decisions, display-string state recovery, unsafe Rust, and subprocess launch.
Threat-test Keystore invalidation, rooted/debuggable assumptions, backup/restore, screen capture, logs/crashes, clipboard, accessibility, process death, background/foreground, dirty edits, Git conflicts, TLS/authentication, QR interruption, malicious credential-provider callers, offline and low-storage paths.
Run repository Rust gates, Android CI/release build, Lint/static analysis, dependency/license/SBOM, unit/instrumented/Compose/Macrobenchmark tests, 16 KB native verification, and ARM emulator security/camera/autofill checks.
Document supported SDKs/ABIs/OEM limitations and any untestable emulator/OS behavior; do not silently stub gaps.
Acceptance criteria
The parity matrix has no unexplained non-Watch gap.
No Kotlin code owns storage rules, no application component launches external processes, and all Git remotes remain credential-free HTTPS.
Security review finds no ordinary plaintext persistence or pre-authentication credential disclosure.
Required Rust and Android gates pass for release configuration and selected ABIs.
ARM emulator biometric, Keystore invalidation, camera QR, update, Credential Manager, Autofill, and representative Git/TOTP journeys pass for the available emulator/API matrix; unavailable combinations are recorded explicitly.
Remaining limitations are explicit and either accepted in #88 or tracked outside this milestone before release.
Depends on all implementation and hardening issues in milestone 06. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
## Goal
Prove that the Android application is a secure, native, complete presentation of IronStorage before distribution.
## Scope
- Maintain a coverage matrix mapping every current non-Watch iPhone/mobile capability and applicable shared storage behavior to an Android screen, system component, test, and owning Rust API.
- Include local/remote onboarding, key generation/import/export, Home/Git, hierarchy/search, viewer/editor/generation, move/copy/delete, biometric lease, TOTP cache/detail, Settings, clipboard/privacy, and Credential Manager/Autofill.
- Explicitly exclude Apple Watch/watchOS/Watch Connectivity only. Android Wear is not a substitute and must not be stubbed.
- Audit Rust/Kotlin/UniFFI boundaries for direct repository access, parsing, Git/GPG/OTP/password generation, secure-secret policy, app/site identity decisions, display-string state recovery, unsafe Rust, and subprocess launch.
- Threat-test Keystore invalidation, rooted/debuggable assumptions, backup/restore, screen capture, logs/crashes, clipboard, accessibility, process death, background/foreground, dirty edits, Git conflicts, TLS/authentication, QR interruption, malicious credential-provider callers, offline and low-storage paths.
- Run repository Rust gates, Android CI/release build, Lint/static analysis, dependency/license/SBOM, unit/instrumented/Compose/Macrobenchmark tests, 16 KB native verification, and ARM emulator security/camera/autofill checks.
- Document supported SDKs/ABIs/OEM limitations and any untestable emulator/OS behavior; do not silently stub gaps.
## Acceptance criteria
- The parity matrix has no unexplained non-Watch gap.
- No Kotlin code owns storage rules, no application component launches external processes, and all Git remotes remain credential-free HTTPS.
- Security review finds no ordinary plaintext persistence or pre-authentication credential disclosure.
- Required Rust and Android gates pass for release configuration and selected ABIs.
- ARM emulator biometric, Keystore invalidation, camera QR, update, Credential Manager, Autofill, and representative Git/TOTP journeys pass for the available emulator/API matrix; unavailable combinations are recorded explicitly.
- Remaining limitations are explicit and either accepted in #88 or tracked outside this milestone before release.
Depends on all implementation and hardening issues in milestone 06. Part of #87.
## Android support update (2026-10-08)
User-directed scope: Android release and CI targets are **arm64-v8a** and **armeabi-v7a**. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
hugo
added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:15:15 +00:00
Implemented the Android parity/security/reliability audit and its findings in b54636b.
Completed the current non-Watch capability matrix with concrete Android screens/services, Rust owners and executable coverage. Reviewed connected storage, UniFFI and Kotlin callers, lifecycle/error handling, provider identity/authorization, private persistence and release packaging. The current empty iPhone AutoFill controller is described truthfully; Android providers are implemented.
Fixed real startup contention across onboarding, binding and Home using one bounded Rust runtime lock; long contention stays retryable without a false recovery claim. Distinguished valid first-run setup from missing configuration with existing encrypted data. Added Rust data-preservation/contention regressions and a real native concurrent onboarding/Home regression.
Added a decoded production-manifest gate rejecting debug/test/profile access. Updated Android-reachable Rustls, faster-hex, rqrr/lru and yanked chacha20 versions; rebuilt both selected ARM ABIs. Unpatched RSA timing and deprecated bisync remain explicit outside-milestone tracking in #125; cargo-audit is not claimed clean.
All four required Rust gates passed (524 tests, zero failures/ignored). Full Android debug/release/AAB build, Lint/release Lint, ktlint, JVM/static/architecture checks, both ARM native/16-KB/package/backup/transfer audits, native symbols/R8 mapping and 1,839-component license/SBOM checks passed. CI script self-tests: 11 passed.
Fresh isolated API 26/4-KB, API 37/4-KB and strict API 37/16-KB ARM64 runs passed app/core/bridge/platform instrumentation and five cold starts each. API 26 exposed a Compose test disposal race: the fixed test waits for removal and checks the counter on the UI thread, retaining the no-further-ticks assertion; three focused reruns and the full suite passed. The failed original run is not counted.
Release-equivalent Macrobenchmark passed five cold and five warm starts on API 26 and strict API 37. Computer use verified retained repositories/clean Git state, real first-run setup guidance, fold install-over/Preferences, framework Autofill and Credential Manager through the external client (exact expected synthetic credentials).
Real OS biometric lease/security fixture passed matching/rejected/cancelled/background/relock journeys without changing the retained phone enrollment. On the separate API 35 platform-test-only emulator, real enrollment change invalidated the biometric-only key while the device-unlocked key still decrypted. Its first operator-driven attempt exceeded the 180-second fixture deadline; the fresh run passed in 124.4 seconds. Disposable keys were deleted and that emulator shut down gracefully.
Emulators were shut down and cold-booted with existing app containers/preferences retained after the reported crash. No uninstall, erase, credential reset or repository seeding was used. Expired provider requests were rejected; fresh requests passed within the unchanged lifetime.
Runtime evidence is ARM64 emulator-only. ARMv7 has build/package coverage; x86_64 and physical devices are excluded by the issue. OEM transfer/StrongBox/TEE guarantees, compromised-device/local timing observers and external switch scanning/speech output are not claimed. Detailed evidence, limitations and dependency findings are in docs/android/audit.md, parity.md and architecture.md. No unrestricted release approval or clean whole-workspace vulnerability audit is implied.
After the final setup-contention title correction, the full Rust and Android gates passed again; the final native viewer/concurrency regression passed in 54.9 seconds and a fresh cold launch retained the three-commit clean vault.
Final connected-code review reconciled the implementation, callers, tests and acceptance criteria before commit and closure.
Implemented the Android parity/security/reliability audit and its findings in [b54636b](https://git.rfc1437.de/hugo/IronStorage/commit/b54636b7bcfc0fc9a804509e3f811578ff8a481f).
- Completed the current non-Watch capability matrix with concrete Android screens/services, Rust owners and executable coverage. Reviewed connected storage, UniFFI and Kotlin callers, lifecycle/error handling, provider identity/authorization, private persistence and release packaging. The current empty iPhone AutoFill controller is described truthfully; Android providers are implemented.
- Fixed real startup contention across onboarding, binding and Home using one bounded Rust runtime lock; long contention stays retryable without a false recovery claim. Distinguished valid first-run setup from missing configuration with existing encrypted data. Added Rust data-preservation/contention regressions and a real native concurrent onboarding/Home regression.
- Added a decoded production-manifest gate rejecting debug/test/profile access. Updated Android-reachable Rustls, faster-hex, rqrr/lru and yanked chacha20 versions; rebuilt both selected ARM ABIs. Unpatched RSA timing and deprecated bisync remain explicit outside-milestone tracking in #125; cargo-audit is not claimed clean.
- All four required Rust gates passed (524 tests, zero failures/ignored). Full Android debug/release/AAB build, Lint/release Lint, ktlint, JVM/static/architecture checks, both ARM native/16-KB/package/backup/transfer audits, native symbols/R8 mapping and 1,839-component license/SBOM checks passed. CI script self-tests: 11 passed.
- Fresh isolated API 26/4-KB, API 37/4-KB and strict API 37/16-KB ARM64 runs passed app/core/bridge/platform instrumentation and five cold starts each. API 26 exposed a Compose test disposal race: the fixed test waits for removal and checks the counter on the UI thread, retaining the no-further-ticks assertion; three focused reruns and the full suite passed. The failed original run is not counted.
- Release-equivalent Macrobenchmark passed five cold and five warm starts on API 26 and strict API 37. Computer use verified retained repositories/clean Git state, real first-run setup guidance, fold install-over/Preferences, framework Autofill and Credential Manager through the external client (exact expected synthetic credentials).
- Real OS biometric lease/security fixture passed matching/rejected/cancelled/background/relock journeys without changing the retained phone enrollment. On the separate API 35 platform-test-only emulator, real enrollment change invalidated the biometric-only key while the device-unlocked key still decrypted. Its first operator-driven attempt exceeded the 180-second fixture deadline; the fresh run passed in 124.4 seconds. Disposable keys were deleted and that emulator shut down gracefully.
- Emulators were shut down and cold-booted with existing app containers/preferences retained after the reported crash. No uninstall, erase, credential reset or repository seeding was used. Expired provider requests were rejected; fresh requests passed within the unchanged lifetime.
Runtime evidence is ARM64 emulator-only. ARMv7 has build/package coverage; x86_64 and physical devices are excluded by the issue. OEM transfer/StrongBox/TEE guarantees, compromised-device/local timing observers and external switch scanning/speech output are not claimed. Detailed evidence, limitations and dependency findings are in docs/android/audit.md, parity.md and architecture.md. No unrestricted release approval or clean whole-workspace vulnerability audit is implied.
After the final setup-contention title correction, the full Rust and Android gates passed again; the final native viewer/concurrency regression passed in 54.9 seconds and a fresh cold launch retained the three-commit clean vault.
Final connected-code review reconciled the implementation, callers, tests and acceptance criteria before commit and closure.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Prove that the Android application is a secure, native, complete presentation of IronStorage before distribution.
Scope
Acceptance criteria
Depends on all implementation and hardening issues in milestone 06. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
Implemented the Android parity/security/reliability audit and its findings in b54636b.
Runtime evidence is ARM64 emulator-only. ARMv7 has build/package coverage; x86_64 and physical devices are excluded by the issue. OEM transfer/StrongBox/TEE guarantees, compromised-device/local timing observers and external switch scanning/speech output are not claimed. Detailed evidence, limitations and dependency findings are in docs/android/audit.md, parity.md and architecture.md. No unrestricted release approval or clean whole-workspace vulnerability audit is implied.
After the final setup-contention title correction, the full Rust and Android gates passed again; the final native viewer/concurrency regression passed in 54.9 seconds and a fresh cold launch retained the three-commit clean vault.
Final connected-code review reconciled the implementation, callers, tests and acceptance criteria before commit and closure.