2 Commits

Author	SHA1	Message	Date
null	a79db9474b	docs(crypto): key-storage migration design (design-only, gated) ... Design for moving off the deprecated androidx.security:security-crypto to Tink Android-Keystore-backed storage, without ever losing the couple key. Covers: the load-bearing hazard (SecurePreferencesFactory.reset() silently WIPES the couple key on any read failure) which must be removed first; lazy dual-read + re-wrap + verify-then-clean migration; fail-closed (recover, never delete) failure matrix; consumer ordering (couple key last); staged RC rollout + content-free telemetry; test plan; open questions for the owner. No implementation ships until the owner approves this design (Batch 5.1 gate). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 21:08:52 -05:00
null	a3993d08df	feat: implement partner-proof sealed answers (batches 1-8) ... - UserKeyManager: per-user keypair stored in Android Keystore - SealedAnswerEncryptor: one-time answer key, sealed:v1 ciphertext - PendingAnswerKeyStore: local EncryptedSharedPreferences storage - ReleaseKeyEncryptor: keybox:v1 encrypted to recipient public key - SealedRevealManager: full reveal flow with mutual key release - AnswerCommitment: SHA-256 commitment hash over canonical payload - FirestoreDeviceKeyDataSource: public key CRUD - FirestoreReleaseKeyDataSource: release key CRUD - FirestoreAnswerDataSource: sealed answer writes with schemaVersion=3 - FirestoreCollections: sealed answer and release key paths - firestore.rules: ownership, immutability, timing, prefix enforcement - HomeViewModel: sealed answer state integration - AnswerRevealScreen/ViewModel: sealed reveal flow with UX states - CloserApp: initialize UserKeyManager on startup - LocalAnswer model: schemaVersion field - Unit tests: SealedAnswerEncryptor, ReleaseKeyEncryptor, AnswerCommitment - Crypto test vectors: docs/crypto/sealed-answer-test-vectors.json - .gitignore: add partner-proof build plan	2026-06-20 00:23:58 -05:00