Complete the Android feature-parity, architecture, security, and reliability audit #111

New Issue

hugo · 2026-08-17T19:15:15Z

hugo commented

2026-08-17 19:15:15 +00:00

Goal

Prove that the Android application is a secure, native, complete presentation of IronStorage before distribution.

Scope

Maintain a coverage matrix mapping every current non-Watch iPhone/mobile capability and applicable shared storage behavior to an Android screen, system component, test, and owning Rust API.
Include local/remote onboarding, key generation/import/export, Home/Git, hierarchy/search, viewer/editor/generation, move/copy/delete, biometric lease, TOTP cache/detail, Settings, clipboard/privacy, and Credential Manager/Autofill.
Explicitly exclude Apple Watch/watchOS/Watch Connectivity only. Android Wear is not a substitute and must not be stubbed.
Audit Rust/Kotlin/UniFFI boundaries for direct repository access, parsing, Git/GPG/OTP/password generation, secure-secret policy, app/site identity decisions, display-string state recovery, unsafe Rust, and subprocess launch.
Threat-test Keystore invalidation, rooted/debuggable assumptions, backup/restore, screen capture, logs/crashes, clipboard, accessibility, process death, background/foreground, dirty edits, Git conflicts, TLS/authentication, QR interruption, malicious credential-provider callers, offline and low-storage paths.
Run repository Rust gates, Android CI/release build, Lint/static analysis, dependency/license/SBOM, unit/instrumented/Compose/Macrobenchmark tests, 16 KB native verification, and physical arm64 security/camera/autofill checks.
Document supported SDKs/ABIs/OEM limitations and any untestable physical behavior; do not silently stub gaps.

Acceptance criteria

The parity matrix has no unexplained non-Watch gap.
No Kotlin code owns storage rules, no application component launches external processes, and all Git remotes remain credential-free HTTPS.
Security review finds no ordinary plaintext persistence or pre-authentication credential disclosure.
Required Rust and Android gates pass for release configuration and selected ABIs.
Physical-device biometric, Keystore invalidation, camera QR, update, Credential Manager, Autofill, and representative Git/TOTP journeys pass.
Remaining limitations are explicit and either accepted in #88 or tracked outside this milestone before release.

Depends on all implementation and hardening issues in milestone 06. Part of #87.

## Goal Prove that the Android application is a secure, native, complete presentation of IronStorage before distribution. ## Scope - Maintain a coverage matrix mapping every current non-Watch iPhone/mobile capability and applicable shared storage behavior to an Android screen, system component, test, and owning Rust API. - Include local/remote onboarding, key generation/import/export, Home/Git, hierarchy/search, viewer/editor/generation, move/copy/delete, biometric lease, TOTP cache/detail, Settings, clipboard/privacy, and Credential Manager/Autofill. - Explicitly exclude Apple Watch/watchOS/Watch Connectivity only. Android Wear is not a substitute and must not be stubbed. - Audit Rust/Kotlin/UniFFI boundaries for direct repository access, parsing, Git/GPG/OTP/password generation, secure-secret policy, app/site identity decisions, display-string state recovery, unsafe Rust, and subprocess launch. - Threat-test Keystore invalidation, rooted/debuggable assumptions, backup/restore, screen capture, logs/crashes, clipboard, accessibility, process death, background/foreground, dirty edits, Git conflicts, TLS/authentication, QR interruption, malicious credential-provider callers, offline and low-storage paths. - Run repository Rust gates, Android CI/release build, Lint/static analysis, dependency/license/SBOM, unit/instrumented/Compose/Macrobenchmark tests, 16 KB native verification, and physical arm64 security/camera/autofill checks. - Document supported SDKs/ABIs/OEM limitations and any untestable physical behavior; do not silently stub gaps. ## Acceptance criteria - The parity matrix has no unexplained non-Watch gap. - No Kotlin code owns storage rules, no application component launches external processes, and all Git remotes remain credential-free HTTPS. - Security review finds no ordinary plaintext persistence or pre-authentication credential disclosure. - Required Rust and Android gates pass for release configuration and selected ABIs. - Physical-device biometric, Keystore invalidation, camera QR, update, Credential Manager, Autofill, and representative Git/TOTP journeys pass. - Remaining limitations are explicit and either accepted in #88 or tracked outside this milestone before release. Depends on all implementation and hardening issues in milestone 06. Part of #87.

hugo added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:15:15 +00:00

hugo added the enhancement label 2026-08-17 19:15:15 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#111