# Android release progress

Updated 14 September 2026. PR #17, which integrates the Android contribution from PR #9, merged into main as `1c175af` after all checks passed. The owner approved submitting a free-trial/personal-key preview while paid work continues. Version 4 is uploaded and saved in a Google Play production draft; it has **not been submitted for review or published**. Hosted guest conversations and optional AI-output reporting are active; paid access and checkout remain disabled.

## Verified work

The signed version 4 candidate passes 257 JVM tests, all 49 isolated UI/device tests and 21 release-validator tests, with no skips or failures. Release lint reports zero errors and 44 warnings. The UI suite covers onboarding, consent, settings, concurrent credential storage, account screens and deletion support, activity recreation, purchases, local learning data, reporting and long-reply subtitle visibility. Earlier purchase controls also passed at 160% text size. Tests use a separate application ID and preserve the personal debug installation and its data. The live conversation evidence below covers version 3; its final check verified automatic Meaning updates and the end-of-conversation reset against the deployed backend.

Settings now follows the iOS grouping, with language and meaning controls, account access, a collapsed Advanced section, conversation length, data actions and support. The purchase sheet uses the same warm background, orb and rounded typography. Its prices come from Google Play and are checked against the server quote; sales are disabled by default. [Design captures](android-design/README.md) include settings at large text sizes and synthetic purchase states. The review prices are fixtures, not launch prices.

Hosted conversations retain their original provider and helper session through completion. Account changes settle known or interrupted hosted sessions before discarding their credentials. Reauthentication can renew only the original account while a conversation remains unresolved. Personal-key assessment recovery stays separate from the shorter hosted assessment window.

Confirmed sign-out and deletion survive activity recreation. Account changes invalidate delayed readiness results, and checkout rechecks the current account, transition state and original activity immediately before opening Play. Encrypted session reads, writes and deletion are serialized across the account, voice and purchase owners.

The complete backend suite passes 303 tests against local PostgreSQL, with no skips. It includes minute purchases and refunds, guest transfer, the approved 15-second conversation minimum, earned teaching budgets, safe pre-provider cancellation, uncertain requests and same-account reauthentication. The actual-AI-value Stripe sandbox checkout, signed event replay, proportional partial/full refunds and encrypted receipts passed separately. Only AI value was credited, and sandbox value remained unavailable to public paid conversations. One synthetic OpenAI voice session confirmed server-side closure; this was not an Android microphone test. See [commerce and voice evidence](android-commerce-and-voice.md).

Backend commit `471133e` is deployed with migrations through 018 and restricted database grants. Health, database readiness and Google sign-in capabilities pass. Hosted guest voice, teaching and AI-output reporting are enabled; paid conversations and checkout remain disabled. Reporting activation used the existing API image and preserved the trial/funding policies. Public-source and history scans found no credentials. Signed-candidate scans also found no matches for known secret patterns; those scans do not establish that no vulnerability exists.

The [production reporting check](../release/android/evidence/ai-reporting-live-2026-09-14.json) verified the public capability, an accepted synthetic report, idempotent replay, 30-day expiry, restricted reviewer access and runtime cleanup. The synthetic row was removed. Report and admission-table contents are excluded from daily and deployment backups. William Imoh owns manual review through hi@hackmamba.io; no report notifications or replies are sent automatically. A separate [native version 4 check](../release/android/evidence/native-reporting-2026-09-14-v4.json) sent a synthetic excerpt from the sealed preview APK, verified its database row and 30-day expiry, and removed that test row. The owner profile was restored and the emulator shut down. A PostgreSQL regression reproduces and prevents inherited runtime access to the optional reviewer view; all 20 reporting tests passed without skips.

Shared content remains consistent across the two native apps. The earlier baseline passed 24 Python checks and 73 Swift core tests; the latest unchanged shared-content and Swift CI jobs pass. The launcher artwork is byte-identical to the canonical iOS icon. The Play icon uses the same artwork, converted to the required 512-pixel RGBA format without changing its RGB pixels.

## Packaging and decisions

The signed candidate uses package `chat.mural.android`, version 0.1 (code 4), minimum API 26 and target API 36. It was built from clean commit `cd75bdb`, with paid checkout explicitly `false` and its environment `test`. Its release manifest disables backups, cleartext traffic and debugging. All 607 bundle payload signatures verify against the approved upload certificate. Bundle validation, five generated ARM64 split signatures and 16 KB alignment checks pass. The earlier Android 15 ARM64 emulator reported a 16,384-byte page size and passed both native compatibility tests; its tested native libraries match version 4 byte for byte. This confirms native loading and offline offer creation, not installation of the exact version 4 bundle or a Play-signed build. [Candidate evidence](../release/android/signed-candidate-2026-09-14-v4.md) records the source, configuration and artifact hashes. Version 3 files remain unchanged as historical evidence.

The owner requested a Documents-folder backup instead of password-manager setup. The key, password, public certificate and instructions were copied and byte-verified with owner-only file permissions. This is a second copy on the same Mac; no off-device recovery backup is claimed. Play accepted version 4 into the saved production release draft. The public production release has not been submitted for review or published. Version 4 is available on the internal testing track; its reviewer tester list is being configured. English listing text, including “Mural: Language Practice,” six screenshots, the matching icon and feature graphic are saved. Screenshots are ordered greeting, conversation, themes, vocabulary, languages and settings. Adults 18+ is saved as the target audience. The owner approved 162 Play markets selected from OpenAI-supported coverage.

The corrected Data safety form is saved for this preview. Name is optional and ephemeral because the complete Google ID token can include a name that Mural processes transiently; email is optional. User IDs, device/other IDs and app interactions are required. Voice is optional because typed replies are available; in-app search is optional. Other user-generated content is required for app functionality and personalization, while sending a selected report remains a separate optional, consented action. All selected types are marked collected and not shared under the service-provider exception. No financial/payment information is selected while commerce is disabled. OAuth exchange is encrypted in transit, and device credentials are encrypted at rest. The deletion URL is `https://mural.chat/support/#delete-account`; the form makes no blanket 90-day deletion promise. [Declaration details](../release/android/declarations.md) retain the data-flow explanation and remaining checks.

The live free-trial policy is $200 per UTC day and $2,000 total, with $1.50 reserved for each ten-minute grant. That funds 133 full new trials per day and 1,333 in total before accounting for grants already issued. The USD grant policy is the only campaign ceiling; the former signup-count and restricted-test voice ceilings do not govern public funded users. Pausing new grants preserves existing balances.

The approved paid model is exact AI cost, a configurable 15% Mural fee, and separately quoted processing costs/buffer. Database policy and quote calculations are implemented. The owner confirmed that paid minutes are estimates and balances deduct actual provider charges. Verified purchase fulfillment, separate voice/teaching settlement, proportional refunds and Android estimated-minute screens are implemented and locally tested. The backend implementation is deployed with paid access and sales disabled pending fee configuration and channel verification; fixed-minute purchases stay disabled. [Pricing decision and current scope](../services/api/docs/actual-cost-pricing.md).

## Live guest verification

A temporary Android emulator profile completed Spanish (Spain) onboarding, selected English meanings, accepted the adult/AI consent and received a ten-minute allowance without signing in or entering a provider key. Mural produced a Spanish greeting and its English meaning. A synthetic typed reply through the voice screen's fallback produced a Spanish follow-up with gentle teaching.

The server confirmed closure after 125 seconds, charged 125,000 milliseconds, released the reservation and retained 475,000 milliseconds. Android displayed 7.9 minutes available and returned to its idle screen. Recorded voice cost was $0.104166667; teaching costs are separate. The emulator used no host microphone or speaker, so this does not verify acoustic quality or spoken-input recognition. Google guest-to-member transfer has local integration coverage but was not completed in this fresh live profile.

A brief live policy-pause check returned HTTP 200 with the normal unavailable state, created no extra account and preserved existing wallet balances. The welcome policy was restored immediately. This verifies the deployed pause path; concurrent budget exhaustion is covered by PostgreSQL tests.

In a later fresh emulator profile, version 1 completed a 108-second session but left Meaning stuck after a partial translation. Version 2 improved sentence coalescing and safe retry handling. Its subsequent 154-second session showed the greeting's complete English meaning, then an initial failure for a longer Spanish reply. Toggling Meaning off and on recovered the complete translation, which remained visible after End. All seven admitted teaching requests settled, with no provider-limit breaches. A follow-up diagnostic build captured `HTTP 429 / helper_session_limit`, confirming the shared request-count allowance as a failure cause. Its log contains only an allowlisted purpose, status and error code. The follow-up also exposed clipping when a longer target-language reply occupied the entire caption area. Version 2 displayed the remaining 5.6 minutes immediately after settlement. That version verified the balance-display fix and manual translation recovery; it did not resolve automatic Meaning consistently.


Version 3 was tested against backend `471133e`, with a 24-request count allowance per earned minute and unchanged dollar and concurrency limits. Two synthetic typed replies exercised a longer Spanish response about Madrid and an in-conversation spelling correction. The full English meaning appeared automatically, with no manual retry; both captions remained visible in their bounded scroll regions. Meaning remained available after End, followed by the normal idle reset. The final process emitted no helper-failure diagnostics. Server accounting confirmed 184 seconds charged, 68 seconds remaining, no remaining minute reservation and all 13 teaching requests settled. Provider cost was $0.15589 for this synthetic session. These checks used the live voice connection and typed fallback, not a physical microphone or speaker.

The installed APK's known-pattern credential scan found no credentials. Source/history scans also passed after reviewing nine false positives: exact SHA-256 file digests in two historical build manifests. The scanner exception is restricted to those exact values and paths; changed values and matches in another file still trigger detection.

## Latest launch-readiness work

PR #17 merged as `1c175af` after the Android, emulator, Swift, backend, contract, release-file and security checks passed. Version 4 includes the manual deletion-support flow with email draft, copyable address and web fallback, while preserving automatic deletion and billing guards. Nine focused account tests and the final full 49-test UI suite pass. The corrected long-reply regression also passed at CI Pixel 6 geometry.

The live website now serves the account-deletion request path at `https://mural.chat/support/#delete-account`, with updated privacy and terms for hosted trials, usage records and adults 18+. The three deployed pages were checked in the browser. Manual support does not resolve unknown late Play charges or authorise forfeiting a balance; the operator report and closeout runbook preserve those checks.

The Play signing certificate is registered with Android Google OAuth client `1034240936303-774v7n4qad7s7un8sb1vjrhl3bi79sa3.apps.googleusercontent.com`. Its SHA-1 is `EA:A2:9C:7D:43:D4:59:3A:F6:B4:81:40:1A:3D:47:39:0A:96:40:5F`; the owner confirmed that the current and previous signing fingerprints match. These identifiers are public configuration. A successful Play-signed login is still unverified. The owner has provided a dedicated Google reviewer account; its first Mural sign-in and review-minute grant are pending. Reviewer credentials and private account records are not stored in this repository.

A protected Stripe live restricted key passed read-only verification against the intended Mural account. Stripe reports charges and payouts enabled. This verifies account configuration, not a live payment, refund or sales activation. Google Play commerce setup and testing remain separate work. The production API remains at `471133e`, with all paid gates off. The private sales-disabled staging script's seven offline transformation/rollback tests are not evidence of a live commerce deployment.

The two weak test assertions identified by CodeQL were corrected. The other 35 reported findings have individual source/data-flow evidence in [the security review](android-codeql-review-2026-09-14.md). Security checks, including the aggregate CodeQL gate and gitleaks, passed before merge. No scanner configuration was weakened. This is not a whole-application security guarantee.

## Remaining verification and submission work

- Complete the dedicated reviewer account’s first Mural sign-in and its review-minute grant. Keep reviewer credentials private and confirm that the saved access instructions work without a personal provider key.
- Verify Google sign-in from a Play-delivered installation. Complete live guest-to-member transfer and check the preserved allowance after login, token renewal and restart.
- Complete oldest-supported Android checks and verify the final signed bundle on 16 KB Android. Test microphone, speaker, Bluetooth and interruptions on a physical Android phone.
- Confirm any remaining listing AI-asset declaration and reviewer-access fields, then submit the saved production draft. Review Play's pre-launch report and resolve applicable findings before rollout. The adult audience, 162 markets and corrected Data safety answers are already saved.
- Keep paid checkout disabled while Google Play merchant/product/service-account setup, channel fees, taxes, catalog prices and controlled purchase/refund/recovery tests are completed. Android uses Play Billing; Stripe account readiness alone does not activate its purchase sheet. Resolve deletion after an abandoned Play order before paid activation, preserving the ability to handle an unknown late charge. Update Data safety for commerce before enabling it.
- Add the website’s Play Store link after the listing and installation are public.

The full candidate-specific checklist is in [release gates](../release/android/release-gates.md). Emulator and local provider tests do not certify physical audio quality, live commerce or public release readiness.