[smart-ssh-coder]

Closes #888

Summary

The foreground session service and the microphone permission plugin (Kotlin, manifest entries, strings, lifecycle-process) now ship in the new crate crates/tauri-plugin-android-host with its own Android library module (dev.smartssh.androidhost). app-shell uses its two constructors (session_service(), microphone()); the community app lists the crate as a direct Android dependency and loses the moved files, manifest lines and strings. The notification icon is now the host app's icon at runtime (applicationInfo.icon).

Acceptance Criteria

• Crate with build.rs, android/ library, three Kotlin classes, manifest, strings: met (crates/tauri-plugin-android-host).
• App tree contains only MainActivity.kt; app manifest has no moved entries: met.
• Merged APK manifest keeps all entries; scripts/check-android-apk-manifest.sh runs in android-build: met in code; verified in CI on the built APK (job Android debug APK green) and locally against a stubbed aapt dump (pass and fail case).
• tauri.settings.gradle lists the library (CI step): met (same CI step, green).
• Existing Android CI job incl. emulator smoke test: met (both green).
• Desktop cargo clippy -p app-shell -p tauri-plugin-android-host --all-targets -D warnings: met (the desktop unit test was dropped: a test binary linking Tauri cannot start on the Windows runner); cargo check -p app-shell --target aarch64-linux-android compiles.
• Docs, ADR 0154, Spec 0114 §4: met.
• Manual device check: needs manual check on Android (below).

Tests

Desktop unit test tauri-plugin-android-host/src/lib.rs:plugins_are_named_and_build_on_desktop. No regression test applies (refactoring); no full gate run locally.

Assumptions

• Two plugin constructors, as recommended in the issue.
• The crate is an Android-only direct dependency of the app (it is a no-op elsewhere); app-shell depends on it unconditionally.
• Library minSdk 26 and compileSdk 36 as in the app. Intent action strings now use the library namespace prefix (internal).

CI changes

• .github/workflows/community.yml, job android-build, new step after the 16 KB alignment check: greps tauri.settings.gradle for the library and runs scripts/check-android-apk-manifest.sh on each built APK. No new actions, secrets or permissions.

Spec

updated 0114 (§4)

Threat model: no change – same permissions and service, only the packaging of the Kotlin code moves.

Manual test steps

1. Install the debug APK on a device/emulator, open a session, background the app: notification with "Disconnect all" appears with the app's icon.
2. Start voice input: the microphone permission prompt appears.

Follow-ups

None.

🤖 Generated with Claude Code

[smart-ssh-reviewer]

Review

Verdict: approved
Review level: normal

Blocking

None.

Non-blocking

• crates/tauri-plugin-android-host/src/lib.rs:1 — the doc comment cites "ADR 0153", but the new ADR is 0154 (0153 is the entitlement ADR). Cosmetic.
• PR body "Tests" names plugins_are_named_and_build_on_desktop, but the crate has no test (the Summary says it was dropped). Refactoring only, so no regression test is required.

Verified

• counter-proof: not applicable, because this is a packaging refactoring with no behaviour fix
• edge cases: microphone plugin still registered in the after-unlock chain via microphone_plugin() (read: lib.rs:1129,1157) → ok; non-Android builds get empty plugins → ok; session_service handle missing is handled via try_state (read: android_service.rs) → ok; all R.* references in the Kotlin files resolve to the library's own package and strings (executed: rg) → ok
• callers checked: voice_input::microphone_plugin removed (no remaining references), Handle/SessionServiceHandle (2 call sites) → ok
• tests run locally: cargo clippy --locked -p tauri-plugin-android-host -p app-shell --all-targets -- -D warnings → clean (executed). The crate has no tests; the aarch64-linux-android check was not run locally (toolchain not available), covered by CI instead.
• CI: all checks green, including Android debug APK (with the new manifest/Gradle step) and the launch smoke test (executed: gh pr checks 990)
• read: all moved Kotlin files (diff), manifest, strings, build.gradle.kts, scripts/check-android-apk-manifest.sh, workflow step
• files read: 5/5 logic files
• UI: not a UI change
• data: not touched

Timing analysis

• no test files changed

Spec

• visible behaviour changed: none (notification shows the host app's icon, same app icon as before)
• spec searched (terms: Hintergrund, foreground, Mikrofon, android), spec covering it: 0114 §4, which the PR updates
• verdict: spec change present and matches the code

Security checks

• Permissions, service entry and foregroundServiceType unchanged; the service only reflects the session count. The CI step only greps and runs aapt; no new actions, secrets or permissions. No filter/risk/redaction/credential code touched. Threat model: no change is justified. Assigned security-paths.txt paths are not touched.

Manual checks pending

• Notification with "Disconnect all" and the app icon after backgrounding with an open session; microphone permission prompt on voice input (Android device or emulator)

Follow-ups

None.

[smart-ssh-reviewer]

Review

Verdict: approved
Review level: normal

Blocking

None.

Non-blocking

• Carried over from the previous review: the doc comment in crates/tauri-plugin-android-host/src/lib.rs cites ADR 0153, but the new ADR is 0154. The PR body names a desktop test that was dropped. Both are cosmetic.

Verified

• follow-up round: the only change since the approved commit a8f83d8 is a merge of develop. The PR's own files (plugin crate, app-shell android files, manifest check script, Spec 0114) have an identical diff against the merge base before and after (executed: git diff + sha1sum).
• CI on the new head: all checks green, including Android debug APK, the launch smoke test, and tests on all three OSes (executed: gh pr checks 990).
• ADR number 0154 is unique on the base branch, and no other open PR touches it (executed: ls, gh pr list).
• tests run locally: none. The Rust toolchain could not be installed in this container (permission denied), so I relied on CI.
• counter-proof, UI, data: not applicable (packaging refactoring).

Timing analysis

• no test files changed

Spec

• visible behaviour changed: none
• spec searched earlier (terms: Hintergrund, foreground, Mikrofon, android); covering spec 0114 §4, updated in the PR
• verdict: spec change present and matches the code

Security checks

• Unchanged since the previous review. Permissions and service entry are unchanged, and no security-critical paths are touched.

Manual checks pending

• Notification with "Disconnect all" and the app icon after backgrounding with an open session; microphone permission prompt on voice input (Android device or emulator)

Follow-ups

None.

[smart-ssh-reviewer]

Review

Verdict: approved
Review level: normal

Blocking

None.

Non-blocking

• Carried over: doc comment in crates/tauri-plugin-android-host/src/lib.rs cites ADR 0153 instead of 0154; PR body names a dropped desktop test. Cosmetic.

Verified

• follow-up round: since the approved commit 7e51cb6 only a merge of develop (ff5d957). The PR diff against the base is still the same 28 files (executed: git diff --stat origin/develop...HEAD), none of the PR's files changed by the merge.
• CI on the new head: all checks green, including Android debug APK, launch smoke test, Tests on 3 OSes, Browser tests, audit, threat-model-note (executed: gh pr checks 990).
• ADR 0154 unique on base (executed: ls docs/adr).
• bash -n scripts/check-android-apk-manifest.sh ok (executed).
• tests run locally: none; the Rust toolchain cannot be installed in this container (permission denied), so CI is relied on.
• counter-proof / UI / data: not applicable (packaging refactoring).

Timing analysis

• no test files changed

Spec

• visible behaviour changed: none; spec 0114 §4 updated and matches the code (unchanged since the last review)

Security checks

• Unchanged: permissions and service entry the same, no security-critical paths touched, threat-model note justified.

Manual checks pending

• Android: notification with "Disconnect all" and app icon after backgrounding; microphone permission prompt on voice input.

Follow-ups

None.

[smart-ssh-coder]

Merge conflicts with develop resolved (rebased onto develop because the base changed under .github/workflows; conflicts only in Spec 0114 and the ADR index, both sides kept). CI is green on the new head d61dc4e.

[smart-ssh-reviewer]

Review

Verdict: approved
Review level: normal

Blocking

None.

Non-blocking

• crates/tauri-plugin-android-host/src/lib.rs:1 — doc comment cites ADR 0153, but the new ADR is 0154 (0153 is the entitlement ADR). Cosmetic.
• PR body "Tests" still names the dropped desktop unit test. Cosmetic.

Verified

• follow-up round: the head changed since the last approved commit (rebase onto develop, plus a commit dropping the desktop unit test). I re-read the full diff of the plugin crate, app-shell changes, workflow step, manifest script, ADR, Spec (read: git diff origin/develop...HEAD).
• ADR 0154 is unique on develop and in all other open PRs (executed: git ls-tree, gh pr list).
• bash -n scripts/check-android-apk-manifest.sh ok (executed).
• CI on head d61dc4e: all checks green, including Android debug APK (with the new manifest/Gradle step), launch smoke test, tests on 3 OSes (executed: gh pr checks 990).
• callers: session_service handle now taken via try_state right after app.plugin(...) (setup runs synchronously there) → ok; microphone_plugin still in the after-unlock chain → ok.
• tests run locally: none; the Rust toolchain cannot be installed in this container (permission denied), so CI is relied on.
• counter-proof / UI / data: not applicable (packaging refactoring).

Timing analysis

• no test files changed (a test was removed)

Spec

• visible behaviour changed: none (notification shows the host app's icon)
• spec searched (terms: Hintergrund, foreground, Mikrofon, android): 0114 §4, updated in the PR
• verdict: spec change present and matches the code

Security checks

• Permissions, service entry and foregroundServiceType unchanged; no filter/risk/redaction/credential code touched; CI step is read-only (aapt + grep). Threat model: no change is justified.

Manual checks pending

• Android: notification with "Disconnect all" and the app icon after backgrounding with an open session; microphone permission prompt on voice input.

Follow-ups

None.