Display an authenticated password entry losslessly with native Android controls and strict secret masking.
Scope
Render storage-provided sections for password, named fields, notes, OTP information, unknown/repeated fields, and diagnostics.
Keep passwords, PIN fields, OTP URIs, and other storage-marked sensitive fields hidden by default; provide explicit reveal/hide, edit, and storage-directed copy actions.
Authenticate only when decrypted content is requested, respect the shared lease, and immediately clear values on expiry/background/manual lock.
Show the current TOTP code/countdown when storage identifies an OTP-bearing entry, without Kotlin parsing the URI or calculating codes.
Support long/multiline/Unicode values, safe text selection where allowed, large fonts, TalkBack labels, keyboard actions, compact and list-detail layouts.
Offer Edit and applicable mutation actions through Material top-app-bar/overflow controls.
Retain no decrypted document in SavedStateHandle, Bundle, DataStore, logs, clipboard history, previews, or accessibility announcements beyond the explicit presentation.
Sensitive values are absent before authentication and immediately unavailable after relock/background policy.
Reveal/copy operate only on stable field IDs and values returned by storage.
TOTP display ticks do not renew authentication.
Compose contains no entry parser, serializer, sensitivity heuristic, OTP parser, or crypto logic.
Depends on biometric authentication, lifecycle security, hierarchical navigation, and the shared mobile contract. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
## Goal
Display an authenticated password entry losslessly with native Android controls and strict secret masking.
## Scope
- Render storage-provided sections for password, named fields, notes, OTP information, unknown/repeated fields, and diagnostics.
- Keep passwords, PIN fields, OTP URIs, and other storage-marked sensitive fields hidden by default; provide explicit reveal/hide, edit, and storage-directed copy actions.
- Authenticate only when decrypted content is requested, respect the shared lease, and immediately clear values on expiry/background/manual lock.
- Show the current TOTP code/countdown when storage identifies an OTP-bearing entry, without Kotlin parsing the URI or calculating codes.
- Support long/multiline/Unicode values, safe text selection where allowed, large fonts, TalkBack labels, keyboard actions, compact and list-detail layouts.
- Offer Edit and applicable mutation actions through Material top-app-bar/overflow controls.
- Retain no decrypted document in SavedStateHandle, Bundle, DataStore, logs, clipboard history, previews, or accessibility announcements beyond the explicit presentation.
## Acceptance criteria
- Ordinary, dynamic, repeated, multiline, PIN, OTP-bearing, and partially malformed fixtures display losslessly.
- Sensitive values are absent before authentication and immediately unavailable after relock/background policy.
- Reveal/copy operate only on stable field IDs and values returned by storage.
- TOTP display ticks do not renew authentication.
- Compose contains no entry parser, serializer, sensitivity heuristic, OTP parser, or crypto logic.
Depends on biometric authentication, lifecycle security, hierarchical navigation, and the shared mobile contract. Part of #87.
## Android support update (2026-10-08)
User-directed scope: Android release and CI targets are **arm64-v8a** and **armeabi-v7a**. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
hugo
added this to the 06 - Implement an Android version of the software milestone 2026-08-17 19:12:20 +00:00
Implemented in commit c0ba6d43d8aaba034f27dceb2e0c93bb89137c95 on main.
The Android viewer now renders Rust-provided structured sections with masked sensitive fields, explicit reveal/hide/copy/edit, Rust-generated TOTP codes/countdown, wrapped Unicode/multiline/repeated fields and diagnostics. Material edit and overflow controls execute revision-checked Rust save and move/copy/delete workflows. Field IDs are bound to the presented document revision; stale documents lock instead of targeting a replacement field. Shared lease revocation drops displayed values and editor/mutation state. TOTP ticks do not renew authentication.
Storage-directed clipboard copies use sensitive Android clips and Rust timeout/cancellation cleanup without retaining/restoring clipboard history. Allowed selection copies the complete stored field through the same API. Sensitive windows block capture, and secret-bearing state objects redact string output. Details and limits: docs/android/entry-viewer.md.
Review: checked all issue acceptance criteria against storage APIs, bridge exports, Kotlin facade, Compose presentation, tests and CI integration. No Kotlin entry/OTP parser, crypto implementation or saved decrypted state.
Validation: all four required Rust workspace gates passed; full Android build/lint/test/module-boundary/dependency/license and ARM64/ARMv7 package audits passed. Full app/core/bridge instrumentation and five cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and API 37/strict 16 KB. Native instrumentation uses actual Rust-encrypted isolated fixtures for save/copy/delete/stale revision/expiry. Computer use in Android Studio's embedded emulator verified masking, PIN editing, Unicode/repeated fields and contextual copy at 200% fonts; native Copy dispatched the correct field ID.
Limits: no ARMv7 emulator image is available; ARMv7 builds and artifacts were audited. Manual TalkBack speech was not observed; accessibility actions are instrumented. Physical-device testing is excluded by this milestone's support policy.
Implemented in commit `c0ba6d43d8aaba034f27dceb2e0c93bb89137c95` on main.
The Android viewer now renders Rust-provided structured sections with masked sensitive fields, explicit reveal/hide/copy/edit, Rust-generated TOTP codes/countdown, wrapped Unicode/multiline/repeated fields and diagnostics. Material edit and overflow controls execute revision-checked Rust save and move/copy/delete workflows. Field IDs are bound to the presented document revision; stale documents lock instead of targeting a replacement field. Shared lease revocation drops displayed values and editor/mutation state. TOTP ticks do not renew authentication.
Storage-directed clipboard copies use sensitive Android clips and Rust timeout/cancellation cleanup without retaining/restoring clipboard history. Allowed selection copies the complete stored field through the same API. Sensitive windows block capture, and secret-bearing state objects redact string output. Details and limits: `docs/android/entry-viewer.md`.
Review: checked all issue acceptance criteria against storage APIs, bridge exports, Kotlin facade, Compose presentation, tests and CI integration. No Kotlin entry/OTP parser, crypto implementation or saved decrypted state.
Validation: all four required Rust workspace gates passed; full Android build/lint/test/module-boundary/dependency/license and ARM64/ARMv7 package audits passed. Full app/core/bridge instrumentation and five cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and API 37/strict 16 KB. Native instrumentation uses actual Rust-encrypted isolated fixtures for save/copy/delete/stale revision/expiry. Computer use in Android Studio's embedded emulator verified masking, PIN editing, Unicode/repeated fields and contextual copy at 200% fonts; native Copy dispatched the correct field ID.
Limits: no ARMv7 emulator image is available; ARMv7 builds and artifacts were audited. Manual TalkBack speech was not observed; accessibility actions are instrumented. Physical-device testing is excluded by this milestone's support policy.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Display an authenticated password entry losslessly with native Android controls and strict secret masking.
Scope
Acceptance criteria
Depends on biometric authentication, lifecycle security, hierarchical navigation, and the shared mobile contract. Part of #87.
Android support update (2026-10-08)
User-directed scope: Android release and CI targets are arm64-v8a and armeabi-v7a. x86_64 Android is excluded for now. Validation for every Android milestone issue uses emulator devices only; physical-device testing and physical-device checklists are excluded. Record the limits of available ARM emulator/API images without claiming physical-device coverage.
Implemented in commit
c0ba6d43d8aaba034f27dceb2e0c93bb89137c95on main.The Android viewer now renders Rust-provided structured sections with masked sensitive fields, explicit reveal/hide/copy/edit, Rust-generated TOTP codes/countdown, wrapped Unicode/multiline/repeated fields and diagnostics. Material edit and overflow controls execute revision-checked Rust save and move/copy/delete workflows. Field IDs are bound to the presented document revision; stale documents lock instead of targeting a replacement field. Shared lease revocation drops displayed values and editor/mutation state. TOTP ticks do not renew authentication.
Storage-directed clipboard copies use sensitive Android clips and Rust timeout/cancellation cleanup without retaining/restoring clipboard history. Allowed selection copies the complete stored field through the same API. Sensitive windows block capture, and secret-bearing state objects redact string output. Details and limits:
docs/android/entry-viewer.md.Review: checked all issue acceptance criteria against storage APIs, bridge exports, Kotlin facade, Compose presentation, tests and CI integration. No Kotlin entry/OTP parser, crypto implementation or saved decrypted state.
Validation: all four required Rust workspace gates passed; full Android build/lint/test/module-boundary/dependency/license and ARM64/ARMv7 package audits passed. Full app/core/bridge instrumentation and five cold starts passed on ARM64 API 26/4 KB, API 37/4 KB and API 37/strict 16 KB. Native instrumentation uses actual Rust-encrypted isolated fixtures for save/copy/delete/stale revision/expiry. Computer use in Android Studio's embedded emulator verified masking, PIN editing, Unicode/repeated fields and contextual copy at 200% fonts; native Copy dispatched the correct field ID.
Limits: no ARMv7 emulator image is available; ARMv7 builds and artifacts were audited. Manual TalkBack speech was not observed; accessibility actions are instrumented. Physical-device testing is excluded by this milestone's support policy.