# TASK-016: Release hardening

Status: partially implemented — the two open items (R8 minification, on-device regression of every authenticated screen) are on hold by the human product owner's decision (2026-09-29)
Owner: Claude (human product owner directed Claude to own all subsequent tasks, 2026-08-26)
Reviewer: Codex

## Outcome

The parts of release hardening that can be verified without an authenticated Gitea session are done: the one previously-recorded P3 dispatcher issue is fixed, the whole repository (not just this task's diff) was scanned for hardcoded secrets, the manifest/backup/token-storage security posture was reviewed, and the release build variant itself was confirmed to compile. The parts that require being signed in — regression-testing every screen built this session, and any decision to enable R8/ProGuard minification — are explicitly left open, not silently skipped.

## Scope

- Included:
  - Fix the P3 finding recorded during the TASK-004/005/006 review (`docs/development-log.md`, 2026-08-25): `CodeBrowserViewModel` ran JSON parsing, base64 decoding, directory sort/dedupe, and the TASK-006A content classifier on `viewModelScope`'s Main dispatcher.
  - Full-repository secret/credential scan (not scoped to one task's diff).
  - Manifest, token-storage, and backup-rule security review.
  - Confirm the `release` build variant itself compiles (`assembleRelease`), independent of any minification decision.
  - Pre-authentication on-device smoke test using a local emulator: cold install, launch, sign-in screen renders and is localized, tapping "Gitea로 로그인" correctly hands off to the system browser toward the OAuth authorize flow, no crash.
- Excluded (explicitly blocked, not attempted):
  - Enabling `isMinifyEnabled`/R8 shrinking for the release build type. See "Known limitations."
  - Any device regression of a screen that requires being signed in (repository list, favorites, organizations, code browser, history, work items, notifications, the navigation back stack, logout) — see "Known limitations."
  - Configuring a real release signing config / keystore — this involves a secret-management decision (where the keystore lives, whether to use Play App Signing) that belongs to the human product owner, not something to invent here.
  - Bumping `versionCode`/`versionName` — left at `1`/`0.1.0`; not yet meaningful until an actual release is cut.

## Writable paths

- `app/src/main/java/com/ubisam/ubgitea/feature/codebrowser/CodeBrowserViewModel.kt`
- `app/src/test/java/com/ubisam/ubgitea/feature/codebrowser/CodeBrowserViewModelTest.kt`
- `tasks/016-release-hardening.md`

## Acceptance criteria

- [x] The recorded P3 dispatcher issue in `CodeBrowserViewModel` is fixed (heavy work moved off the Main dispatcher), with the dispatcher injectable for deterministic tests, matching the existing pattern in `AndroidKeystoreTokenVault`.
- [x] A full-repository secret/credential scan finds no hardcoded secrets (only the pre-existing test that asserts `client_secret` is absent from the OAuth URI).
- [x] Manifest/backup/token-storage security posture reviewed: `allowBackup="false"`, `data_extraction_rules.xml` excludes all `sharedpref` data from both cloud backup and device transfer, `AndroidKeystoreTokenVault` uses AES/GCM via the Android Keystore with `MODE_PRIVATE` prefs, no `Log.*`/`println` calls exist anywhere in `app/src/main`, cleartext HTTP traffic is blocked by Android's own default (no `usesCleartextTraffic` override, `minSdk 28`).
- [x] `./gradlew assembleRelease` succeeds (confirms the release build type itself is not broken), independent of the minification decision below.
- [x] Pre-authentication screen verified on a real emulator (see Evidence).
- [ ] **Blocked** — R8/ProGuard minification decision: left disabled (`isMinifyEnabled = false`, unchanged). Enabling it is a real correctness risk specific to this codebase — every `data/*Api.kt` class uses Gson with `TypeToken<List<T>>` generic reflection, which R8 can silently break (wrong/missing keep rules erase generic signatures or rename `@SerializedName`-less fields) with no compile-time signal, and the only way to catch that is exercising the JSON-parsing-heavy authenticated screens on a minified build — which requires the login this session cannot complete (see below). Left as an open decision for whoever has real device + login access.
- [ ] **Blocked** — On-device regression of every authenticated screen built this session (repository list/paging/favorites/organizations, code browser, history, work items, notifications, navigation back-stack restoration, logout). Structurally cannot be completed by Claude in this environment: completing Gitea OAuth login requires entering the human product owner's password, which is a universally prohibited action regardless of whose credentials are offered — no amount of additional emulator/tooling work changes that. Confirmed with the human product owner (2026-08-26): proceed with everything else, leave this explicitly open for the user or Codex (whichever has real login access) to complete.

## Required checks

```text
./gradlew assembleDebug
./gradlew testDebugUnitTest
./gradlew lintDebug
./gradlew assembleRelease
```

## Evidence

- Branch `claude/task-015-notifications` (continued in the same worktree/branch as TASK-015, per the standing "proceed to the next task without stopping" direction; no separate branch was cut since this is a small, tightly-scoped follow-on).
- `CodeBrowserViewModel.kt`: `loadDirectory`'s tree-listing/dedupe/sort and `loadFile`'s fetch+classify are now wrapped in `withContext(defaultDispatcher)`, with `defaultDispatcher: CoroutineDispatcher = Dispatchers.Default` as a constructor parameter (production code takes the default; `CodeBrowserViewModelTest` injects the same `StandardTestDispatcher` already used for `Dispatchers.Main`, so `advanceUntilIdle()` still deterministically drives the moved work instead of racing a real background thread pool).
- Full-repository secret scan: `git grep -inE "client_secret[[:space:]]*[:=]...|password[[:space:]]*[:=]...|BEGIN (RSA|EC|OPENSSH|PGP) PRIVATE KEY|AKIA[0-9A-Z]{16}|xox[baprs]-..."` across the whole tree — zero matches.
- `git grep -inE "clientSecret|client_secret"` — only the pre-existing test assertion that it's absent from the authorization URI, and prior dev-log/task-file mentions of that same test; no leaked value.
- `git grep -inE "Log\.(d|v|i|w|e)\(|println\(|System\.out" -- 'app/src/main/**/*.kt'` — zero matches; nothing to strip for release.
- Reviewed `AndroidManifest.xml`: `allowBackup="false"`, App Link intent filter has `android:autoVerify="true"` scoped to the exact OAuth callback host+path, no `usesCleartextTraffic` override (blocked by default at `minSdk 28`).
- Reviewed `data_extraction_rules.xml`: both `<cloud-backup>` and `<device-transfer>` exclude `domain="sharedpref" path="."` — the encrypted token vault's prefs file cannot leave the device via Android 12+ backup/transfer, on top of `allowBackup="false"` already blocking the legacy path.
- Reviewed `AndroidKeystoreTokenVault.kt`: AES/GCM key generated inside the Android Keystore (`PURPOSE_ENCRYPT/DECRYPT`, `setRandomizedEncryptionRequired(true)`), tokens stored only as ciphertext+IV in `MODE_PRIVATE` SharedPreferences, a decrypt failure clears the store rather than surfacing a stale/corrupt token. No changes needed.
- `./gradlew assembleRelease`: BUILD SUCCESSFUL (unsigned release APK; `lintVitalRelease` passed).
- On-device smoke test: booted the `WhatToEat_API_36` AVD (Android emulator already present in this environment; confirmed with the human product owner before using it), installed the debug build, launched cold — no crash, no `AndroidRuntime`/`FATAL` in logcat. Screenshot confirms the sign-in screen renders with correct Korean text ("사내 Gitea에 로그인해 접근 가능한 저장소를 확인하세요" / "Gitea로 로그인"). Tapping the login button correctly launches the system browser (Chrome) rather than crashing or no-opping, confirming the `browserRequests` → `startActivity(ACTION_VIEW)` handoff in `MainActivity` works on a real Android runtime, not just in unit tests.
- `./gradlew assembleDebug testDebugUnitTest lintDebug --rerun-tasks` (after the dispatcher fix): BUILD SUCCESSFUL, 182 unit tests total across 30 suites, 0 failures/errors, 0 lint errors.
- Emulator was shut down (`adb emu kill`) after the smoke test; no device is left running.

## Review findings

None yet — no Codex review pending (Codex retired, 2026-09-29), with the two explicitly blocked acceptance criteria above flagged for whoever picks this up next.