qqq-android/docs/TODO.md

TODO

• Apply scoped copyright/import/header/formatter corrections, mechanical CI gate and Kotlin warnings-as-errors;163JVM plus46TC22 sample native cases pass. See review for the remaining formatter CI limitation.

• Add Query artwork, app version, Dogfooding/Query links and license access under Settings → About QQQ Mobile.

• Qualify real Authentik desktop nonce rejection and retained-browser A → company logout → fresh B; actual Android callback acceptance remains separate.

• Resolve the explicitly retained legacy source follow-ups: metadata typing, renderer contracts, navigation/action validation and build identity. Removing inline work markers does not implement these features.

• Replace the raw diagnostics popup with tested full-screen status/activity, filtering, pause, copy/share/clear and Back; 159 client JVM tests, zero-warning lint/build and the focused TC22 diagnostics UI test pass.

• Default foreground location reporting on, preserving explicit opt-out and one-time Android permission behavior; settings/policy tests pass.

• Verify current trusted EMDK Code128, QR leading zeros and menu/reopen on installed checkpoint1c766bf/E34AC3C6.

• Observe the diagnostics/location update on the normal package, grant/deny/restore location permission and verify an actual provider fix; keep physical lifecycle/outage/retry and provider acceptance gates open.

• Verify the API1.10 original-nonce and optional company-logout client patch: 151 JVM tests, zero-warning lint/build and 28 disposable TC22 native authentication/lifecycle tests pass; independent 26-file source review completed with no findings.

• Qualify the paired strict server policy and actual Authentik A-to-company-logout-to-B handoff, including the exported native callback and real SDK/browser logging boundary; synthetic native tests do not close this gate.

• Verify current TC22 Code128 hardware trigger-to-save on the trusted EMDK path with operator Saved scan, matching backend source/model and distinct event identities; see physical evidence.

• Finish current EMDK leading-zero QR, repeat-intent, lifecycle/ownership and retry/leave acceptance; historical DataWedge scans do not qualify these checks.

• Verify the synchronized rotation/recreation assertions in both5ba GitHub native runs; one entire run passed and the other reached a later fresh-login timeout.

• Verify final fresh-login readiness at229fce3 and the later portrait-default7de checkpoint: all eleven hosted checks pass, including native navigation/input, PixelCopy and semantic scenarios with a new session. QR documentation2e0fd962 does not qualify physical QR acceptance.

• Make portrait the default for missing/invalid preferences while preserving explicit choices; four focused tests, lint/debug assembly and preserving TC22 install pass, with actual requested portrait orientation confirmed.

• Finish the operator walkthrough on the newly updated normal TC22 app; private data/enrollment and the development signing identity were preserved.

• Compile the opt-in screen-consent QA harness and ordinary E2E tests; verify early opt-in/protected-port safety gates. Actual permission/display acceptance remains open.

• Compile/review additive consent-based device-screen client and paired1.2 server:137 JVM, package/lint/APK inspection, ordinary-UID TC22 scan-input rejection,39 server/six demo/all15 browser cases and strict provenance pass. Actual projection acceptance remains separate.

• Execute opt-in actual Android consent, notification, Home/background pixels, Stop, lease expiry, lock/rotation and forced-session-end acceptance on the refined device-screen candidate.

• Supersede the historical hosted Back/focus failure gate with all eleven passing checks at7de; retain the failed-job diagnostics and actual Back/focus regression requirements in history.

• Establish the current EMDK Code128 positive control after the historical failed attempt: eight priorF3AF events and oneC891 event are verified. Preserve the failed-attempt evidence and bounded operator stage; QR/lifecycle/retry acceptance remains open above.

• Resolve normal backend ownership and perform the reviewed API 1.9 upgrade with fresh backup, original-column/data checks, recovery logins and live account validation; preserve the operator APK. Private verification confirms two devices and three scans retained.

• Verify five client audit fixes: password/legacy callback origin binding, independent local Auth0 sign-out, sample release HTTPS and no-backup session storage. The batch passes 109 JVM tests and all 32 selected TC22 native cases; packaged release controls are inspected. See review scope and evidence.

• Verify the trusted scanner-ingress replacement with production-path ordinary-UID rejection and actual installed EMDK Code128 positive controls. Preserve the historical security report scope; this does not close the remaining physical lifecycle/QR matrix.

• Correct the demo's mixed RC.20 runtime and test-engine dependencies; qualify exact-source core ecf0f550a0357cec6387c2b54efca128a405a629 with server b14d925b741e815d1cfa4f62301f19207f25b03f. Fresh37 server/five demo, strict provenance and all15 nullable-admin/session-monitor/browser cases pass. Core full closure:4,507 discovered/16 existing skips/zero failures/errors.

• Reverify hosted Back/focus behavior at7de with real Back injection and the focus guard; historical failures remain documented in session state.

• Qualify stable Auth03.0.0/Coil3.0.4, notice-generator incremental inputs and overlay/window-focus scan gating:127 JVM,34 shared TC22 cases, an additional eight-overlay native regression, ordinary-UID injection rejection and all package/lint/notice gates pass. See candidate acceptance.

• Resolve viewing scope through optional operator-consented DEVICE_SCREEN on mobile1.2 source, retaining default APP_CONTENT and old-server compatibility. Actual projection acceptance remains open; normal mobile1.1 runtime exposes app-content only.

• Verify the unconfirmed-scan exit correction: 46 mobile JVM tests and all 21 selected TC22 native cases pass, including failed cancellation and explicit Leave anyway with preserved receipt/retry identity and in-flight/photo guards.

• Finish the operator walkthrough of the unconfirmed-scan exit correction on the normal scanner installation.

• Qualify semantic OAuth2 client protocol/policy and generated notices; all seven synthetic browser-result cases and the selected native navigation suite passed on TC22. See acceptance evidence.

• Complete actual configured Authentik acceptance: real browser/exported-callback round trip, authorization rotation/process death, and next-operator switching with prior browser SSO. See authentication deployment.

• Verify the single hamburger drawer correction: no duplicate Apps/Switch app controls, fixed Settings/Diagnostics, signed-out gating, drawer Back preserving drafts, and guarded Home/app switching with exactly one cancellation.

• Verify persisted device Orientation choices on TC22, including process draft and pending-photo preservation across rotation.

• Implement and verify navigation UX: primary Apps/app/process navigation, secondary Account/Settings/diagnostics, shared Back/leave policy, protected in-flight operations and sign-out lifecycle.

• Prepare independent scanner release workflow and environment-only signing/version configuration; actionlint passes.

• Independently review the exact release workflow, reusable verification and Gradle signing configuration; see review scope and hashes. No actionable source finding; external protection settings are not verified by this review.

• Configure reviewed GitHub release protections and the organization signing identity, verify the actual signed APK and upgrade/migration, and publish only after all release prerequisites pass. Signing/distribution remains owner-deferred until the final step.

• Correct false legacy network blocking while the scanner's server is reachable; preserve multi-network connectivity for shared clients.

• Persist workstation host-GPU configuration and document cold-start commands.

• Add runtime server branding and a foreground connection footer with bounded sanitized diagnostics.

• Verify customer header/theme, diagnostics and connection loss/recovery on the emulator.

• Verify customer-specific logo assets and physical TC22 appearance.

• Complete Gradle unit tests, debug APK, signature, and lint verification (26 tests; zero lint errors).

• Complete the current EMDK physical matrix: QR, lifecycle/ownership, retry/revocation, bad credentials, sign-out and re-login. The completed DataWedge checks below are historical and do not qualify current EMDK behavior.

• Verify TC22 physical Code128 and QR triggers through DataWedge intent output, visible Saved scan, preserved leading-zero QR data and independently inspected backend provenance; two Code128 triggers plus one QR trigger produced exactly three records.

• Verify release APK signing/distribution separately; current deliverable is a debug APK.

• Reconcile exact historical project-owned source license boilerplate and the IDE template with the existing Apache-2.0 migration; preserve copyright ownership and other notices.

• Verify third-party asset/dependency attribution and signed release/upgrade delivery before production distribution.

• Configure and test production identity-provider integration; TABLE_BASED remains supported, and native OAuth2 requires explicit server advertisement and callback registration.

• Implement public /qqq/v1/version compatibility checks before credentials or native screens, including required features and the registered mobile-scanners extension.

• Implement semantic process completion, field/step updates, editable/view forms, backend cancellation and explicit unsupported-component blocking.

• Verify semantic migration JVM suites: 53 tests passed (core 21/mobileapp 23/scanner 9), including hidden fields, explicit null clearing, generic event ID isolation and completion when the server omits nextStep.

• Verify companion browser E2E after the semantic migration: six scenarios passed in 2.9 minutes.

• Require Android client-channel discovery; companion real HTTP tests use the Android header on every request and pass.

• Complete final JVM/lint/build verification of this semantic API migration: 53 tests, zero lint errors/six warnings, normal debug and isolated E2E/test APKs.

• Verify all six native scenarios across focused runs and the OpenAPI request audit: incompatible core, missing extension, missing Android channel, baseline/additive scans and native administrative forms.

• Identify the TC22 through ADB, authorize USB debugging, install the latest normal APK with login/enrollment preserved, approve its device record and open native Scan Capture with Connected status. Initial Code128 decoding passed; the remaining physical matrix is still pending.

• Extend the documented native component boundary with remote possible values, record lists, specialized forms and table/report/download screens as required; add conformance and rendered E2E coverage for each new capability.

Offline queue/background synchronization is deliberately outside version one.

• Implement semantic mobile session activity, server termination, demand-based own-app screen viewing and optional foreground location.
• Add capture lifetime/lease/race tests, complete scanner receipt checks, strict maxLength and NavController regression coverage.
• Verify short-viewport login and focused long-form submission after IME Done and dismissal handling.
• Complete integrated session/native administrator termination E2E and all 12 shared TC22 navigation/input/account tests; local emulator remains closed.
• Freeze and review session/whole-device source within the documented security scopes and independent architecture A1–A11 closure. Final release revision/scope and external-runtime gates remain in the release ledger.
• Integrate camera/gallery with Record Files typed routes and guarded optional bridge fixture; synthetic native E2E verifies persisted receipt, rotation and forced-logout cleanup.
• Complete actual camera-lens/operator acceptance after final runtime installation; synthetic activity results do not prove the OEM camera application flow.
• Supersede the October31 hosted checkpoint gate with all eleven passing hosted checks at7de; retain earlier revision-specific results as history.
• Verify the published push/PR native E2E lanes through the current7de hosted checkpoint; physical operator acceptance remains separate.
• Run the native sample instrumentation suite (six passed on API35).
• Add and run real-server scanner-host E2E: login, pending enrollment, approval, native app/process selection, manual scan persistence and revoked-device denial. Use an isolated app ID and database.
• Run and verify native real-server E2E on pushes and pull requests; current7de hosted checks pass.
• Complete the final operator walkthrough on TC22 after updating the preserved demo/runtime, including outage/reconnect and real camera capture.