[hupcus]

Summary

Phase 8 of PLAN.md — the release build, an emulator matrix, a battery protocol and the distribution prep.

• Signing (ADR-034): env-var signing (DETECT pattern). No variables → unsigned release (CI, gates); a wrong path, a missing password or an active configuration cache → the build fails. The upload keystore lives outside the repo, its password in the macOS Keychain. tools/build_release.sh builds the APK + AAB from a clean tree only, and fails unless both carry the pinned upload certificate (046f8cd0…669c0e88). It then runs the APK check and prints the commit and SHA-256.
• No logcat output in release: R8 strips every android.util.Log call. tools/check_release_apk.py (in CI) gates on the Landroid/util/Log; descriptor in the dex bytes, flags a debuggable APK and debug-recording literals, and treats an unparseable dexdump as a tool error.
• minSdk 29 (ADR-033): Android 9 delivers a scroll-only service's events only from the "active" window, which it hardly ever updates for such a service. The API 28 emulator measured 0 events in 18 of 18 runs.
• Language outside activities (ADR-035): the delete toast and the notifications came out in English inside the Czech app → Context.inAppLanguage(), with Robolectric tests.
• AAB without language splits: a phone in a third language switched to English would otherwise lack the English strings (lint AppBundleLocaleChanges).
• Docs:
  • emulator matrix API 28/30/33/34/35/36;
  • battery protocol (emulator-relative);
  • README release section;
  • Play internal-testing upload checklist.

Measured (emulators, release build — docs/accuracy-testing.md)

• API 30 / 33 / 35 / 36:
  • onboarding (en / cs), measuring;
  • test list MAPE: View 0.00–0.33 %, Column 3.85–4.99 %;
  • SAF export, share, delete;
  • edge-to-edge;
  • the POST_NOTIFICATIONS prompt.
• API 30: PIN + reboot. Nothing runs before unlock; afterwards the service binds by itself and the data is kept.
• API 36: revoking Usage access switches the detail screen to scroll time, no crash.
• Battery, API 34, 10 min each:
  • scrolling: 3 463 events, ≈ 1.35 s CPU (0.39 ms per event), 0 wakelocks / alarms / jobs, 115 flushes;
  • idle: ≈ 0.4 s CPU, 0 writes;
  • time-in-app sync ≈ 12 ms per app open.
• Screenshots were reviewed by subagents; the only defect found (the English toast) is fixed.

SPEC §54 Definition of Done

• aplikace se sestaví bez chyb — clean-checkout gate below
• target API 36
• AccessibilityService lze aktivovat — emulators API 30–36, OnePlus (Phase 1)
• přijímá TYPE_VIEW_SCROLLED
• načítá package name
• načítá scrollDeltaX/Y
• počítá vzdálenost
• umí fallback přes scrollX/Y
• má outlier protection
• má automatickou kalibraci
• má ruční kalibraci platební kartou — implemented; with a real card → verification debt V2/V3
• ukládá agregace do Room
• ukazuje Today / Week / Month / Lifetime
• ukazuje breakdown podle apps
• má history chart
• má exclusions
• má daily goal
• má CSV export
• má delete data
• má privacy screen
• má Google Play compliant disclosure flow
• nečte text z jiných aplikací — canRetrieveWindowContent=false, typeViewScrolled only (manifest policy + PolicyGuardTest)
• nevyžaduje internet
• nevyžaduje účet
• nepoužívá QUERY_ALL_PACKAGES
• prošel testem Chrome (Phase 1)
• prošel testem Instagram — V1 (no account on the test phone)
• prošel testem Reddit — V1 (not installed)
• prošel testem horizontal scroll
• prošel testem fling
• vlastní testovací screen má MAPE < 5 % — View ≤ 0.33 %, Column ≤ 4.99 % (automatic calibration); with a card → V3
• po restartu aplikace zůstávají data zachována — emulator API 30 / 34; OnePlus (ColorOS) → V4

Battery on real phones (SPEC §39: 1 h / 8 h / 24 h) → new debt V8; ColorOS usage-access revocation + restart → V9.

Gates

GitHub Actions still refuse to start (account billing, see handoff), so this was checked on a clean detached checkout of f23891d with the CI commands:

• testDebugUnitTest lintDebug assembleDebug assembleRelease: 265 JVM tests pass; lint 0 errors, 6 old warnings (SetTextI18n in the debug test list);
• check_manifest_policy.py (debug + release): ok;
• check_release_apk.py on the unsigned release: clean;
• python3 -m unittest discover -s tools: 44 pass;
• tools/build_release.sh end to end from a clean worktree: signed APK + AAB, certificate pinned, APK clean. The password appears in neither the log nor any of 1 278 build files.

Review

• /topshit (cumulative diff): pinned the upload certificate for the APK and the AAB; the script accepts only a clean tree and prints the commit; build-tools are resolved in one place.
• Stage 2 security (Fable):
  • MEDIUM: configuration-cache guard — fixed;
  • MEDIUM: the APK check could pass on an empty dexdump — fixed with the byte gate and a tool error;
  • MEDIUM: certificate pin — fixed by /topshit;
  • LOW: a Gradle daemon keeps the password in its environment — accepted and documented (only the same user can read it, and that user can read the Keychain item anyway);
  • areas without findings: manifest/permissions, CI workflow, ProGuard rule, inAppLanguage, device_accuracy.py.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.