Complete native Android flows, adaptive UI and repository hardening

.github/workflows/android.yml

@@ -13,18 +13,19 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
-      - uses: actions/setup-java@v4
+          persist-credentials: false
+      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
         with:
           distribution: temurin
           java-version: '21'
-      - uses: android-actions/setup-android@v3
+      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
         with:
           packages: platform-tools
           log-accepted-android-sdk-licenses: false
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
         with:
           cache-read-only: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
       - run: chmod +x gradlew
@@ -34,7 +35,7 @@ jobs:
           # Generator-template tests run in :app:verifyNativeTemplates with Gradle's exact JAR.
           python3 -m unittest discover -s scripts/tests -p 'test_native_packaging.py' -v
           python3 scripts/check_native_packaging.py app/build/outputs/apk/debug/app-debug.apk app/build/outputs/apk/release/app-release-unsigned.apk
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
           name: android-reports
@@ -44,6 +45,7 @@ jobs:
             app/build/outputs/apk/release
             app/build/outputs/bundle/release
             validation/native-packaging.json
+            app/build/generated/brand-fonts.json
   ui:
     runs-on: ubuntu-latest
     timeout-minutes: 60
@@ -54,18 +56,19 @@ jobs:
         device: ${{ fromJSON(github.event_name == 'workflow_dispatch' && '["compact","small-phone","common-phone","phone","large","small-tablet","tablet","wide-tablet","tablet-landscape","large-tablet"]' || '["phone","tablet"]') }}
     name: UI (${{ matrix.device }})
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
-      - uses: actions/setup-java@v4
+          persist-credentials: false
+      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
         with:
           distribution: temurin
           java-version: '21'
-      - uses: android-actions/setup-android@v3
+      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
         with:
           packages: platform-tools
           log-accepted-android-sdk-licenses: false
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
         with:
           cache-read-only: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
       - name: Enable KVM
@@ -74,14 +77,15 @@ jobs:
           sudo udevadm control --reload-rules
           sudo udevadm trigger --name-match=kvm
       - run: chmod +x gradlew
-      - uses: reactivecircus/android-emulator-runner@v2
+      - name: Run native UI journeys
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2
         with:
           api-level: 35
           arch: x86_64
           target: google_apis
           profile: ${{ contains(matrix.device, 'tablet') && 'pixel_tablet' || 'pixel_6' }}
           script: bash scripts/device-matrix.sh ${{ matrix.device }}
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: always()
         with:
           name: android-ui-${{ matrix.device }}

.gitignore

@@ -12,3 +12,14 @@ google-services.json
 /validation/
 __pycache__/
 *.pyc
+
+# Local deployment credentials; public branding and synthetic test fixtures stay tracked.
+.env
+.env.*
+!.env.example
+*.p12
+*.pfx
+*.pem
+*.key
+keystore.properties
+signing.properties

AGENTS.md

@@ -19,16 +19,16 @@
 
 ## Branch delivery workflow
 
-The owner merged the A0 foundation and requested this workflow on 2026-10-16:
+The owner's latest delivery instruction, updated 2026-10-18, authorizes the existing PR #4 delivery workflow:
 
-- Start ongoing work from `dev`, commit there, and push to `origin/dev`.
-- Finish the phase's implementation and validation before opening its final `dev` → `main` pull request.
-- Keep `main` for reviewed merges. Preserve the owner's configured commit identity and the required Codex co-author trailer.
+- Consolidate ongoing mobile work on `dev`, retain phase commits, and push tested progress to `origin/dev`; do not create other pull requests or feature branches.
+- Complete exact-source local/CI checks, the required full device matrix and actual screenshot review, then merge only the reviewed head of existing [PR #4](https://github.com/SpaceWorks-HQ/SpaceWorks-Android/pull/4) into `main`. Keep `dev` and preserve phase commits.
+- Preserve the owner's configured commit identity, the required Codex co-author trailer and all immutable inputs. A failed or skipped required gate cannot establish acceptance.
 
 
 ## Owner execution extension — 2026-10-16
 
-The owner's latest complete-build instruction extends the original PRD: implement remaining phases on `dev`, commit and push tested progress there, and prepare the final `dev` → `main` PR after the batch. Intermediate merge gates are superseded; green CI remains mandatory before proceeding between phases. Phone AND tablet layouts are now in scope, including 320/360dp phones, common/large phones, 600/840dp tablets, portrait/landscape, light/dark and 2× font scale. Keep `docs/PRD.md` byte-identical to its owner source; record extensions here and in `docs/IMPLEMENTATION-PLAN.md`. Preserve Shaan's GitHub identity plus the Codex co-author trailer. Use the local Docker API for integration, contract/generated models only, no backend implementation edits or provider/attestation bypasses. Document precise backend-request issues for unavailable native capabilities; continue independent supported work.
+The owner's complete-build extension adds remaining phases on `dev` with tested progress committed and pushed there. The latest delivery instruction authorizes only existing PR #4: consolidate and validate `dev`, then merge its reviewed head into `main`, retaining `dev` and phase commits. Do not create other pull requests or feature branches. Intermediate merge waits are superseded; green CI remains mandatory for phase acceptance. Phone AND tablet layouts are now in scope, including 320/360dp phones, common/large phones, 600/840dp tablets, portrait/landscape, light/dark and 2× font scale. Keep `docs/PRD.md` byte-identical to its owner source; record extensions here and in `docs/IMPLEMENTATION-PLAN.md`. Preserve Shaan's GitHub identity plus the Codex co-author trailer. Use the local Docker API for integration, contract/generated models only, no backend implementation edits or provider/attestation bypasses. Document precise backend-request issues for unavailable native capabilities; continue independent supported work.
 
 Owner backend deferment: complete and test the full native flow using an explicit DEBUG-only, isolated in-memory demo. The backend will be supplied later. Never infer live success or invent production routes/models; missing native contract/provider configuration stays visibly unavailable outside demo.
 

CONTRIBUTING.md

@@ -0,0 +1,53 @@
+# Contributing and maintenance
+
+This is a native Kotlin/Jetpack Compose application. Read [AGENTS.md](AGENTS.md)
+and the unchanged [PRD](docs/PRD.md) before changing behavior. The owner currently
+authorizes the existing [PR #4](https://github.com/SpaceWorks-HQ/SpaceWorks-Android/pull/4)
+for final delivery: work on `dev`, preserve tested phase commits and `dev`, and
+merge only the reviewed head after its required gates pass. Do not create other
+pull requests or feature branches for this batch.
+
+## Local checks
+
+Use JDK 21, Python 3 and Android SDK platform 36/build tools. Clone recursively,
+switch to `dev`, and retain the pinned Design submodule. Keep SDK paths in ignored
+`local.properties` or `ANDROID_HOME`; never commit local credentials.
+
+```sh
+git submodule update --init --recursive
+./gradlew lint test assembleDebug assembleRelease bundleRelease assembleDebugAndroidTest
+python3 -m unittest discover -s scripts/tests -p 'test_native_packaging.py' -v
+python3 scripts/check_native_packaging.py app/build/outputs/apk/debug/app-debug.apk app/build/outputs/apk/release/app-release-unsigned.apk
+```
+
+Use `gradlew.bat` and `python` on Windows. Run `connectedDebugAndroidTest` with a
+ready emulator/device for native journeys. The manually dispatched Android
+workflow runs every case across the ten profiles in
+[release readiness](docs/RELEASE-READINESS.md). Do not skip failing cases or infer
+actual layout quality from compilation or a screenshot listing.
+
+## Change boundaries
+
+- Use only the generated API client and authoritative schema. Do not invent
+  endpoints, models, production successes or backend behavior.
+- Generated API, theme, typography and copy output belongs under build directories;
+  change the reviewed inputs/generators instead. Keep `docs/PRD.md`,
+  `api/openapi.json` and the Design gitlink unchanged unless explicitly authorized.
+- Retain source-generation, unit/transport, lint, native packaging and relevant
+  instrumented checks. Review original full-OS captures for affected phone/tablet,
+  theme, orientation and text-scale states. Keep secrets and recovery codes out
+  of logs, issues and evidence.
+- Preserve the configured Shaan commit identity and required Codex attribution
+  for Codex-authored commits. Record concrete behavior, tests and remaining owner
+  gates; do not claim live backend/provider or store acceptance from demo tests.
+- Dependency/toolchain changes require a separate reviewed phase and a resolved
+  graph/provenance comparison; see [dependency maintenance](docs/DEPENDENCIES.md).
+  Do not automatically update SDKs, generate update PRs or trust new checksum
+  metadata without review.
+
+The backend is deferred. Debug's labelled in-memory demo is isolated; Release
+does not acquire production authority from it. Signing, legal/privacy inputs,
+physical-device/provider verification and store distribution remain owner gates.
+
+Report vulnerabilities through the [security policy](SECURITY.md), not a public
+issue containing credentials or private account data.