Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Android›Android — Pre-submission blockers·11 in this wave

Approve: Android pre-submission blockersTo do · blocker Provision apps/android/local.properties so the Android app can reach a backendTo do · blocker GitHub Actions is off for the whole repo — billing wall fails every job in 2sTo do · blocker Add launcher icon setDone Bump compileSdk and targetSdk to Play's current floorDone Produce and validate a real signed release AABDone Confirm Supabase session tokens are encrypted at restDone verify:one-contact-address is red on main — design/card-creation-flow.html publishes kaitlynn@tactile.to 14 timesDone Automate versionCode and versionNameDone Un-pin security-crypto from alphaDone Replace deprecated security-crypto with Android Keystore + migrate enrolled devicesTo do

Wave

Android — Pre-submission blockers

Short, hard list that blocks any Play Store submission. Do these first — they are cheap and absolute.

TacTile › Launch TacTile › Android › Android — Pre-submission blockers

7/11 done4 open3 open blockers

Selected taskclear

Replace deprecated security-crypto with Android Keystore + migrate enrolled devices

To doOwner · Vivt_69307e75

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Replace deprecated security-crypto with Android Keystore + migrate enrolled devices** · to do

Where it sits: TacTile › Launch TacTile › Android › Android — Pre-submission blockers

## The brief on file

Viv — follow-up to t_c24d8d34. NOT a launch blocker; deliberately kept out of PR #225 so the pre-submission work could ship.

CONTEXT: PR #225 moved androidx.security:security-crypto from 1.1.0-alpha06 to 1.1.0 stable. That closed the "alpha in production crypto" risk for one line. But 1.1.0 stable ships with EVERY API in the library deprecated — the release note is "Deprecated all APIs in favour of existing platform APIs and direct use of Android Keystore." The stable release exists only to give the deprecated API a non-alpha resting place. No commits since July 2025, no successor AndroidX artifact, and the deprecation notices contradict each other (release note says Android Keystore; the class Javadoc @deprecated tag says plain SharedPreferences). Google's current published guidance is Android Keystore for key material + Tink for the encryption itself. Note the widely-repeated "DataStore + Tink" migration pattern is community consensus, NOT Google guidance — do not cite it as such.

TWO CONSUMERS, AND THEY MUST MOVE TOGETHER. Building one on a new primitive and leaving the other behind gives this platform two encryption stories, which is exactly what PR #225 avoided:
  - apps/android/app/src/main/java/com/tactile/app/data/auth/EncryptedSharedPrefsDeviceTrustStore.kt:31-43
  - apps/android/app/src/main/java/com/tactile/app/data/auth/EncryptedPrefsSessionManager.kt

THE HARD PART IS MIGRATION, NOT CRYPTO. Device-trust tokens exist on real devices in the wild; iOS parity means only their PRESENCE matters, never their value (see DeviceKeychain.swift). So for device-trust you may be able to accept re-enrollment rather than migrate — but that forces those users back through the OTP gate, which is a product decision, not a technical one. Get it decided before writing code. The session store is easier: PR #225 already established the precedent that a session change forces one re-login, and purgeLegacyPlaintextSession is the model for cleaning up behind yourself.

ALSO FIX WHILE YOU ARE IN THERE: EncryptedSharedPreferences has documented Keystore-corruption failures on some OEM devices ("master key exists but is unusable" at init) — google/tink#535, issuetracker 176215143 and 272569538. EncryptedPrefsSessionManager already degrades to a re-login rather than crashing; EncryptedSharedPrefsDeviceTrustStore does NOT have that guard and will throw. Whatever replaces it should keep the degrade-not-crash policy.

TESTABILITY — the thing that will bite you: Robolectric ships no AndroidKeyStore provider, so EncryptedSharedPreferences.create() throws "KeyStoreException: AndroidKeyStore not found" and NOTHING keystore-backed can be unit-tested on the JVM. EncryptedPrefsSessionManager handles this with an injected prefsFactory seam; mirror that. And read the warning in EncryptedPrefsSessionManagerTest's kdoc first: an earlier draft asserted "token not readable in cleartext on disk" and passed vacuously because nothing was ever written. Any test you write here must be checked against the PRE-fix code to confirm it actually fails, per the standard set by apps/api/tactile-api/tests/routes/destructive-replace-ordering.test.ts.

Real verification is on-device only:
  adb shell run-as com.tactile.app.debug cat shared_prefs/com.tactile.connect.session.xml
then force-stop and relaunch to confirm the session still restores — a store that silently fails to read looks identical to a working sign-out. Blocked on the same local.properties provisioning as the rest of the wave.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Android — Pre-submission blockers

Replace deprecated security-crypto with Android Keystore + migrate enrolled devices