Repository navigation
fix(android): consolidate release and correct recovery cancellation - #1260
Open
takemiyamakoto wants to merge 123 commits into
Open
takemiyamakoto wants to merge 123 commits into
takemiyamakoto wants to merge 123 commits into
Conversation
Pin the Maven Central checksum for junit-bom 5.9.2 Gradle module metadata so strict dependency verification succeeds in fresh emulator lanes.
Compose immutable Drive readback, local original-wallet proof, a durable one-way owner commit marker, and exact authenticated head reconciliation. Keep release recovery disabled until first enrollment, production verifier wiring, and device qualification.
The release database includes the 79-to-80 portable-origin reservation migration. Exercise the current schema in real Room upgrade tests instead of asserting the previous version.
takemiyamakoto
changed the title
takemiyamakoto
changed the title
takemiyamakoto
changed the title
takemiyamakoto
changed the title
takemiyamakoto
changed the title
SDILogin
previously approved these changes
Sep 28, 2026
takemiyamakoto
dismissed
SDILogin’s stale review
October 9, 2026 11:49
The merge-base changed after approval.
Enroll missing TON and Bitcoin testnet accounts when wallets or catalogs change. Add durable TON key storage and replay checks, preserve native and independently imported keys, and retain Bitcoin testnet aliases across catalog refreshes. Keep Taira enabled and Nexus offline with a copy-only production address. Add shared-mnemonic device regressions and tests for key binding, recovery, account preservation, catalog updates, and wallet details. Validation: 444 JVM tests, two API 34 restore tests, debug app Kotlin compilation, default Detekt, and diff checks passed. Scoped analysis introduces no findings compared with the existing source baseline.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Android candidate preserves existing wallet keys, identities, signing/export, native TON and minimum OS support while targeting API 36. Portable recovery and new transfer execution remain disabled pending their enabled-feature production gates.
Current source is
5e8b36a96c07e5fd28ac9761d497896a3cbdeae8. The recovery coroutine correction removes three redundantensureActive()checks before inherited-jobwithContext(Dispatchers.IO)boundaries. It retains cancellation checkpoints around synchronous work and injected callbacks. It also fixes plaintext-export ownership: if cancellation discards an IO result during dispatch back to the caller, the producer erases the completed buffer; successful delivery transfers the original buffer intact. Both draft and verified semantic exporters use this path. No replacement job orNonCancellableexport was introduced.Staged recovery cohorts use
FPWCAI01v2 to bind the compiled receiving-chain policy through encrypted journal readback, restart, original-source sidecars and storage projection. The inventory preserves all 87 bundled Substrate genesis IDs, including 17 disabled historical identities. Unknown/substituted policies reject without erasing stored state. Genuine v1 after-images retain their original empty-policy interpretation, bytes and token commitments during replay and sidecar upgrade. The inventory grants no network or signing permission.The application-owned
FPWMSM01exporter retains V1/V2/V3 original sources, standalone EVM and native TON roots, watch identities, selection/order and display metadata. Receiving checks bind public keys to recorded identities, including canonical iOS TON V4R2 JSON and exact approved Substrate chain IDs. Source-proof and transactional-installer blockers remain.Validation: the final account JVM suite passes 352/352 and the backup suite 292/292, with zero failures, errors or skips. Two deterministic regressions cover cancelled return delivery and successful plaintext ownership transfer. Default Detekt and diff checks pass. Forced analysis of all five Kotlin files in the coroutine fix reports the same 32 existing findings as the parent-source comparison, with none introduced; scoped lint is not clean. The coroutine change received separate agent inspection and parent review. The preceding policy diff's Codex Security scan (
d312253a-9010-48f9-8b1c-36d640806d7b) found zero reportable issues and its hosted Android CI/IAS/Branch Flow checks passed; those results apply tob97098031, not this successor. This head requires its own hosted checks and independent human security approval.Remaining release work includes independent inventory review and future-policy compatibility, transactional replacement installation, installed original-key signing/export, bidirectional passkey/Drive recovery with original devices unavailable, final API 30/31/36 and 16 KiB qualification, Play-signed upgrades, capped funded receipts, protected-branch review/CI and the full-live audit. No production release was deployed.