Let a new Android installation create or import a pass-compatible local store and optionally connect an HTTPS Git remote.
Scope
Provide native staged onboarding for local-only setup, GPG key generation/import/selection, repository initialization/opening, and optional HTTPS server/account/repository/application-token setup.
Also support cloning an existing remote: validate a credential-free HTTPS URL, discover branches, select a branch, show progress/cancellation, and safely reuse a matching existing clone.
Pass app-private roots, all validation, key generation/import, .gpg-id, repository layout, Git clone/open/init, remote identity, token storage, and recovery decisions to crates/storage.
Store the application token only through the Android Keystore adapter; permit later replacement without revealing the old value.
Keep remote setup optional so offline/local users can create folders and entries, commit locally, use TOTP, and add HTTPS synchronization later.
Handle denied camera/biometric capabilities by offering safe manual alternatives, not weaker silent behavior.
Never use SAF as the live repository and never launch git, gpg, pass, or a credential helper.
Acceptance criteria
Fresh install can reach a usable encrypted local store without any server.
Existing HTTPS store can be cloned with an application token, and SSH/embedded credentials are rejected before transport.
Failed/cancelled setup cannot replace an existing repository/config/credential.
Setup survives rotation, folding, and process recreation without saving secrets; unsafe interrupted stages restart or roll back deterministically.
Upstream-compatible fixtures prove the produced repository/key/policy format.
Kotlin owns only form/camera/permission presentation and does not select paths, recipients, or repository semantics.
Depends on private-path integration, Keystore, biometric authentication, and the app shell. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
## Goal
Let a new Android installation create or import a pass-compatible local store and optionally connect an HTTPS Git remote.
## Scope
- Provide native staged onboarding for local-only setup, GPG key generation/import/selection, repository initialization/opening, and optional HTTPS server/account/repository/application-token setup.
- Also support cloning an existing remote: validate a credential-free HTTPS URL, discover branches, select a branch, show progress/cancellation, and safely reuse a matching existing clone.
- Pass app-private roots, all validation, key generation/import, `.gpg-id`, repository layout, Git clone/open/init, remote identity, token storage, and recovery decisions to `crates/storage`.
- Store the application token only through the Android Keystore adapter; permit later replacement without revealing the old value.
- Keep remote setup optional so offline/local users can create folders and entries, commit locally, use TOTP, and add HTTPS synchronization later.
- Handle denied camera/biometric capabilities by offering safe manual alternatives, not weaker silent behavior.
- Cover invalid/expired token, TLS/network failure, non-HTTPS scheme, interrupted clone, existing/different clone, key mismatch, low storage, and partially completed setup.
- Never use SAF as the live repository and never launch `git`, `gpg`, `pass`, or a credential helper.
## Acceptance criteria
- Fresh install can reach a usable encrypted local store without any server.
- Existing HTTPS store can be cloned with an application token, and SSH/embedded credentials are rejected before transport.
- Failed/cancelled setup cannot replace an existing repository/config/credential.
- Setup survives rotation, folding, and process recreation without saving secrets; unsafe interrupted stages restart or roll back deterministically.
- Upstream-compatible fixtures prove the produced repository/key/policy format.
- Kotlin owns only form/camera/permission presentation and does not select paths, recipients, or repository semantics.
Depends on private-path integration, Keystore, biometric authentication, and the app shell. Part of #87.
## Android support update (2026-10-08)
User-directed scope: Android release and CI targets are **arm64-v8a** and **armeabi-v7a**. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
hugo
added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:12:18 +00:00
Rust now owns Android app-private local and HTTPS onboarding: encrypted GPG key generation/import/selection, pass-compatible .gpg-id and Git initialization, real HTTPS branch discovery/clone, matching-clone reuse, optional remote connection, and protected token replacement. Compose provides staged forms, progress/cancel, manual key import, and lifecycle handling without persisting passphrases or tokens. Android initializes the operating-system certificate verifier before HTTPS; its official JVM support is checksum-verified, dependency-locked and retained in Release builds.
Setup uses a synced transaction journal and configuration commit point. Recovery preserves existing repositories/keys/configuration and only removes credentials belonging to the interrupted transaction. Regression fixtures exercise encrypted offline entries and OTP payloads, real Git commits, clone/reuse, wrong passphrase/recipients, authentication/TLS/network/cancellation, protected-storage failure, low storage and crash rollback.
Validation: all four required Rust gates passed (459 workspace tests); complete Android verification passed lint, JVM tests, Kotlin formatting, module boundaries, both ARM ABIs, Debug/Release APK and Release AAB audits, 16 KB alignment, UniFFI parity, backup/manifest and dependency/license checks. Instrumentation and five cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and API 37/strict 16 KB. An opt-in real HTTPS integration test discovered public GitHub branches, connected an isolated store and replaced its synthetic token on each emulator. Computer use verified form validation, key selection, rotation with masked input, encrypted local-store creation, Preferences remote setup, and preservation through update/restarts. The user entered the disposable passphrase directly.
Reviewed the complete change against this issue; domain behavior remains in crates/storage and application code launches no subprocesses. See docs/android/onboarding.md for the implementation and reproducible validation.
Limits: no private-server account credential was used; private clone/authentication failure contracts are covered by Rust transport fixtures. ARMv7 was built and audited, but no compatible ARMv7 emulator image was available. Physical-device testing is excluded by the milestone scope. Apple frontend code was unchanged.
Implemented in commit 36e5f552835082a6dc7e727ca80bd14af50a8c52 (main).
Rust now owns Android app-private local and HTTPS onboarding: encrypted GPG key generation/import/selection, pass-compatible .gpg-id and Git initialization, real HTTPS branch discovery/clone, matching-clone reuse, optional remote connection, and protected token replacement. Compose provides staged forms, progress/cancel, manual key import, and lifecycle handling without persisting passphrases or tokens. Android initializes the operating-system certificate verifier before HTTPS; its official JVM support is checksum-verified, dependency-locked and retained in Release builds.
Setup uses a synced transaction journal and configuration commit point. Recovery preserves existing repositories/keys/configuration and only removes credentials belonging to the interrupted transaction. Regression fixtures exercise encrypted offline entries and OTP payloads, real Git commits, clone/reuse, wrong passphrase/recipients, authentication/TLS/network/cancellation, protected-storage failure, low storage and crash rollback.
Validation: all four required Rust gates passed (459 workspace tests); complete Android verification passed lint, JVM tests, Kotlin formatting, module boundaries, both ARM ABIs, Debug/Release APK and Release AAB audits, 16 KB alignment, UniFFI parity, backup/manifest and dependency/license checks. Instrumentation and five cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and API 37/strict 16 KB. An opt-in real HTTPS integration test discovered public GitHub branches, connected an isolated store and replaced its synthetic token on each emulator. Computer use verified form validation, key selection, rotation with masked input, encrypted local-store creation, Preferences remote setup, and preservation through update/restarts. The user entered the disposable passphrase directly.
Reviewed the complete change against this issue; domain behavior remains in crates/storage and application code launches no subprocesses. See docs/android/onboarding.md for the implementation and reproducible validation.
Limits: no private-server account credential was used; private clone/authentication failure contracts are covered by Rust transport fixtures. ARMv7 was built and audited, but no compatible ARMv7 emulator image was available. Physical-device testing is excluded by the milestone scope. Apple frontend code was unchanged.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Let a new Android installation create or import a pass-compatible local store and optionally connect an HTTPS Git remote.
Scope
.gpg-id, repository layout, Git clone/open/init, remote identity, token storage, and recovery decisions tocrates/storage.git,gpg,pass, or a credential helper.Acceptance criteria
Depends on private-path integration, Keystore, biometric authentication, and the app shell. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
Implemented in commit
36e5f55283(main).Rust now owns Android app-private local and HTTPS onboarding: encrypted GPG key generation/import/selection, pass-compatible .gpg-id and Git initialization, real HTTPS branch discovery/clone, matching-clone reuse, optional remote connection, and protected token replacement. Compose provides staged forms, progress/cancel, manual key import, and lifecycle handling without persisting passphrases or tokens. Android initializes the operating-system certificate verifier before HTTPS; its official JVM support is checksum-verified, dependency-locked and retained in Release builds.
Setup uses a synced transaction journal and configuration commit point. Recovery preserves existing repositories/keys/configuration and only removes credentials belonging to the interrupted transaction. Regression fixtures exercise encrypted offline entries and OTP payloads, real Git commits, clone/reuse, wrong passphrase/recipients, authentication/TLS/network/cancellation, protected-storage failure, low storage and crash rollback.
Validation: all four required Rust gates passed (459 workspace tests); complete Android verification passed lint, JVM tests, Kotlin formatting, module boundaries, both ARM ABIs, Debug/Release APK and Release AAB audits, 16 KB alignment, UniFFI parity, backup/manifest and dependency/license checks. Instrumentation and five cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and API 37/strict 16 KB. An opt-in real HTTPS integration test discovered public GitHub branches, connected an isolated store and replaced its synthetic token on each emulator. Computer use verified form validation, key selection, rotation with masked input, encrypted local-store creation, Preferences remote setup, and preservation through update/restarts. The user entered the disposable passphrase directly.
Reviewed the complete change against this issue; domain behavior remains in crates/storage and application code launches no subprocesses. See docs/android/onboarding.md for the implementation and reproducible validation.
Limits: no private-server account credential was used; private clone/authentication failure contracts are covered by Rust transport fixtures. ARMv7 was built and audited, but no compatible ARMv7 emulator image was available. Physical-device testing is excluded by the milestone scope. Apple frontend code was unchanged.