Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Android›Android — Pre-submission blockers·11 in this wave

Approve: Android pre-submission blockersTo do · blocker Provision apps/android/local.properties so the Android app can reach a backendTo do · blocker GitHub Actions is off for the whole repo — billing wall fails every job in 2sTo do · blocker Add launcher icon setDone Bump compileSdk and targetSdk to Play's current floorDone Produce and validate a real signed release AABDone Confirm Supabase session tokens are encrypted at restDone verify:one-contact-address is red on main — design/card-creation-flow.html publishes kaitlynn@tactile.to 14 timesDone Automate versionCode and versionNameDone Un-pin security-crypto from alphaDone Replace deprecated security-crypto with Android Keystore + migrate enrolled devicesTo do

Wave

Android — Pre-submission blockers

Short, hard list that blocks any Play Store submission. Do these first — they are cheap and absolute.

TacTile › Launch TacTile › Android › Android — Pre-submission blockers

7/11 done4 open3 open blockers

Selected taskclear

Confirm Supabase session tokens are encrypted at rest

DoneOwner · Vivt_b0dcb211

Waiting on 1 · 1 still openProvision apps/android/local.properties so the Android app can reach a backend

Unlocks 1Approve: Android pre-submission blockers

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Confirm Supabase session tokens are encrypted at rest** · done

Where it sits: TacTile › Launch TacTile › Android › Android — Pre-submission blockers

## Waiting on 1

- Provision apps/android/local.properties so the Android app can reach a backend — to do

1 of those is still open. If one genuinely blocks this, say so and stop rather than working around it.

## Unlocks 1

- Approve: Android pre-submission blockers

## The brief on file

CLOSED 2026-08-31 — on-device verification PASSED (the only remaining gate; the fix itself landed in PR #225).

VERDICT: session encrypted at rest, both halves verified live on emulator Medium_Phone_API_36.1, debug build at origin/main c70c1276, signed in as quinn@tactile.to (committed script-default password; op was locked and NOT needed — anon key is the publishable client key via the Supabase connector).

Half 1 (bytes on disk): /data/data/com.tactile.app.debug/shared_prefs/ holds only com.tactile.connect.session.xml (canonical EncryptedSharedPreferences: Tink __androidx_security_crypto_encrypted_prefs_*_keyset__ entries, AES-SIV-encrypted key NAMES, GCM values) + tactile_settings.xml. The legacy plaintext com.tactile.app.debug_preferences.xml does not exist on clean install. grep across all shared_prefs: 0 hits for eyJ / refresh_token / the email / even the literal "session".

Half 2 (restore after force-stop): am force-stop → relaunch → logcat verbatim "Trying to load latest session from storage." → "Successfully loaded session from storage!", NO DevSessionBootstrap re-login, NO EncryptedPrefsSessionManager.kt:85 unreadable-clearing path. App proceeded authenticated.

Residual (out of the task's two steps, code-confirmed + unit-tested only): purgeLegacyPlaintextSession() on an upgrade-in-place path was not observed live (clean install has no legacy blob). Cleanup done: app uninstalled (session + Keystore keys destroyed), emulator killed, gitignored local.properties + scratch removed.

Key files: apps/android/.../data/auth/EncryptedPrefsSessionManager.kt, .../data/supabase/SupabaseClientFactory.kt.

--- ORIGINAL PROMPT (for provenance): Viv — PARTIALLY DONE in PR #225. Do NOT close until the on-device check below is run. ANSWER TO THE ORIGINAL QUESTION: the session was NOT encrypted. supabase-kt 2.6.1's default SettingsSessionManager is multiplatform-settings over plain SharedPreferences, confirmed from artifact bytecode. (Fix: EncryptedPrefsSessionManager over androidx.security.crypto, landed #225.)

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Android — Pre-submission blockers

Confirm Supabase session tokens are encrypted at rest