build(todo): Todo deployable beside Learn's server, and released as an APK, on F-Droid and as a snap (ADR 0033, step 5)

deploy/compose.todo.yaml adds Todo's server at todo.halkyon.eu, a member
of Learn's register, its database halkyon_todo in the instance's
PostgreSQL, its image built as Train's. redeploy.sh and backup.sh go over
every app server .env switches on (train, todo). Each compose file names
its server to the register in a variable of its own
(INSTANCE_MEMBER_TRAIN, INSTANCE_MEMBER_TODO), which halkyon_base adds to
INSTANCE_MEMBERS, each address once, as a second compose file's default
would have replaced Train's.

apps/todo/release.dart configures the release tool for Todo's APK and
snap: a key of its own (pinned once made; until then nothing is
released), the F-Droid listing (Time, NonFreeNet), and the snap from
apps/todo/snap/, which the tool builds in a clone of the repository at the
tag with that folder in place of snap/, as snapcraft builds one recipe a
folder and the root's is Learn's. What's new for 0.1.0 in English and
German, now shown. Android's backup and transfer are off, as Train's
(D53): the reminders scheduled keep their tasks' titles unsealed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/todo/halkyon_todo_flutter/android/app/build.gradle.kts

@@ -18,7 +18,6 @@ android {
     }
 
     defaultConfig {
-        // TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
         applicationId = "app.halkyon.todo"
         // You can update the following values to match your application needs.
         // For more information, see: https://flutter.dev/to/review-gradle-config.
@@ -32,13 +31,46 @@ android {
         versionName = flutter.versionName
     }
 
+    // The app's own key signs release builds when tool/release.dart hands it over
+    // through the environment, as Learn's and Train's do: the keystore's path and the
+    // key's alias, and the password asked for at each release, never written down. Other
+    // release builds are signed with the debug key, so `flutter run --release` works
+    // anywhere; the release tool releases no APK signed otherwise.
+    val releaseKeystore = System.getenv("HALKYON_ANDROID_KEYSTORE")
+    signingConfigs {
+        if (releaseKeystore != null) {
+            create("release") {
+                storeFile = file(releaseKeystore)
+                keyAlias = System.getenv("HALKYON_ANDROID_KEY_ALIAS")
+                // A PKCS #12 keystore has one password, for the store and its key.
+                storePassword = System.getenv("HALKYON_ANDROID_KEYSTORE_PASSWORD")
+                keyPassword = System.getenv("HALKYON_ANDROID_KEYSTORE_PASSWORD")
+            }
+        }
+    }
+
     buildTypes {
         release {
-            // TODO: Add your own signing config for the release build.
-            // Signing with the debug keys for now, so `flutter run --release` works.
-            signingConfig = signingConfigs.getByName("debug")
+            signingConfig =
+                signingConfigs.findByName("release") ?: signingConfigs.getByName("debug")
         }
     }
+
+    // The native libraries go into the APK compressed, as Learn's: one APK serves
+    // every phone, holding them for three architectures, and Android unpacks the
+    // phone's own as it installs the app.
+    packaging {
+        jniLibs {
+            useLegacyPackaging = true
+        }
+    }
+
+    // Leaves out the list of dependencies Gradle would otherwise add to the APK,
+    // encrypted for Google Play alone; F-Droid's and others' scanners flag it.
+    dependenciesInfo {
+        includeInApk = false
+        includeInBundle = false
+    }
 }
 
 kotlin {

apps/todo/halkyon_todo_flutter/android/app/src/main/AndroidManifest.xml

@@ -1,4 +1,5 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
     <!-- The app talks to its instance: release builds need this too (Flutter's
          template grants it to debug and profile builds only). -->
     <uses-permission android:name="android.permission.INTERNET"/>
@@ -8,10 +9,19 @@
          them off; without, Android may bring a reminder a few minutes late). -->
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
     <uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM"/>
+    <!-- No backup and no transfer to another phone (ADR 0033, step 5, as
+         Train's ADR 0030, D53): the reminders scheduled, with their tasks'
+         titles, are kept unsealed. Through Android 11 allowBackup and
+         fullBackupContent stop both, from 12 on the extraction rules stop the
+         transfer. -->
     <application
         android:label="Halkyon Todo"
         android:name="${applicationName}"
-        android:icon="@mipmap/ic_launcher">
+        android:icon="@mipmap/ic_launcher"
+        android:allowBackup="false"
+        android:fullBackupContent="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        tools:targetApi="s">
         <activity
             android:name=".MainActivity"
             android:exported="true"

apps/todo/halkyon_todo_flutter/android/app/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Nothing of Todo's goes to a backup or to another phone, from Android 12
+     on (ADR 0033, step 5, as Train's ADR 0030, D53): allowBackup="false"
+     stops the backup, and only these rules stop the transfer. What Todo keeps
+     unsealed (the reminders it has scheduled, with their tasks' titles) stays
+     on this phone; what is sealed comes back from the instance on the next. -->
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="root" path="."/>
+        <exclude domain="file" path="."/>
+        <exclude domain="database" path="."/>
+        <exclude domain="sharedpref" path="."/>
+        <exclude domain="external" path="."/>
+        <exclude domain="device_root" path="."/>
+        <exclude domain="device_file" path="."/>
+        <exclude domain="device_database" path="."/>
+        <exclude domain="device_sharedpref" path="."/>
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="root" path="."/>
+        <exclude domain="file" path="."/>
+        <exclude domain="database" path="."/>
+        <exclude domain="sharedpref" path="."/>
+        <exclude domain="external" path="."/>
+        <exclude domain="device_root" path="."/>
+        <exclude domain="device_file" path="."/>
+        <exclude domain="device_database" path="."/>
+        <exclude domain="device_sharedpref" path="."/>
+    </device-transfer>
+</data-extraction-rules>

apps/todo/halkyon_todo_flutter/assets/whats_new/0.1.0.de.txt

@@ -0,0 +1 @@
+- Die erste Version von Halkyon Todo: Aufgaben im Eingang und in Projekten mit Abschnitten, Heute und Demnächst, wiederkehrende Aufgaben und Erinnerungen, jedes Projekt als Liste, Board oder Kalender, alles versiegelt.

apps/todo/halkyon_todo_flutter/assets/whats_new/0.1.0.en.txt

@@ -0,0 +1 @@
+- The first release of Halkyon Todo: tasks in an Inbox and in projects with sections, Today and Upcoming, repeating tasks and reminders, each project as a list, a board or a calendar, everything sealed.

apps/todo/halkyon_todo_flutter/lib/main.dart

@@ -1,5 +1,6 @@
 import 'dart:io';
 
+import 'package:flutter/services.dart';
 import 'package:halkyon_app/halkyon_app.dart';
 import 'package:halkyon_todo_flutter/src/app/licences.dart';
 import 'package:halkyon_todo_flutter/src/app/todo_app.dart';
@@ -28,12 +29,23 @@ Future<void> main() async {
   );
   await instances.load(usedBefore: device.storage.usedBefore());
   runApp(
-    TodoApp(
-      choice: instances,
-      // Only an instance of Halkyon Todo: one of another Halkyon app's
-      // answers too, but holds nothing of this app's.
-      checker: ServerpodInstanceChecker(app: 'todo'),
-      open: (instance) => TodoDependencies.create(instance, device),
+    // What's new in each release (Train's ADR 0030, D61), from
+    // assets/whats_new/, shown once after an update.
+    WhatsNewScope(
+      whatsNew: WhatsNew(
+        AssetWhatsNewSource(rootBundle),
+        FileWhatsNewStore(File(p.join(device.support, 'whats_new.json'))),
+        version: device.appVersion,
+      ),
+      // An instance chosen before: the app ran on this device already.
+      usedBefore: instances.current != null,
+      child: TodoApp(
+        choice: instances,
+        // Only an instance of Halkyon Todo: one of another Halkyon app's
+        // answers too, but holds nothing of this app's.
+        checker: ServerpodInstanceChecker(app: 'todo'),
+        open: (instance) => TodoDependencies.create(instance, device),
+      ),
     ),
   );
 }

apps/todo/halkyon_todo_flutter/pubspec.yaml

@@ -80,6 +80,10 @@ flutter:
     # The instance the build names, unless --dart-define=SERVER_URL=… does
     # (serverpod_flutter's getServerUrl).
     - assets/config.json
+    # What each release changed, one file a release and language
+    # (<version>.<language>.txt), drafted by tool/release.dart and edited
+    # (Train's ADR 0030, D61): halkyon_app's What's new shows them.
+    - assets/whats_new/
     # The app's icon, Lucide's list-todo (ADR 0031), and Lucide's licence for the
     # licence list (the repository's tool/app_icons.py writes both).
     - assets/icon/halkyon_todo_icon.png

apps/todo/halkyon_todo_flutter/test/android/backup_rules_test.dart

@@ -0,0 +1,60 @@
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+
+/// Nothing of Todo's leaves the phone by Android's backup or a transfer to
+/// another phone (ADR 0033, step 5, as Train's ADR 0030, D53): the reminders
+/// scheduled are kept unsealed, with their tasks' titles, and what is sealed
+/// comes back from the instance anyway. Read as text, the files are small and
+/// Android's own.
+void main() {
+  const folder = 'android/app/src/main';
+
+  test('backup is off, through Android 11 as from 12 on', () {
+    final manifest = File('$folder/AndroidManifest.xml').readAsStringSync();
+    final application = RegExp(
+      '<application([^>]*)>',
+    ).firstMatch(manifest)![1]!;
+
+    expect(application, contains('android:allowBackup="false"'));
+    expect(application, contains('android:fullBackupContent="false"'));
+    expect(
+      application,
+      contains('android:dataExtractionRules="@xml/data_extraction_rules"'),
+    );
+  });
+
+  test("from Android 12 on, neither a backup nor a transfer takes any of the app's "
+      'folders', () {
+    // allowBackup="false" leaves a transfer to another phone on from Android
+    // 12 on: the rules have to exclude it too, folder by folder.
+    final rules = File(
+      '$folder/res/xml/data_extraction_rules.xml',
+    ).readAsStringSync();
+    for (final kind in ['cloud-backup', 'device-transfer']) {
+      final section = RegExp(
+        '<$kind>(.*?)</$kind>',
+        dotAll: true,
+      ).firstMatch(rules)?[1];
+      expect(section, isNotNull, reason: '$kind is missing');
+      expect(section, isNot(contains('<include')), reason: kind);
+      final excluded = {
+        for (final exclude in RegExp(
+          r'<exclude domain="(\w+)" path="\."/>',
+        ).allMatches(section!))
+          exclude[1],
+      };
+      expect(excluded, {
+        'root',
+        'file',
+        'database',
+        'sharedpref',
+        'external',
+        'device_root',
+        'device_file',
+        'device_database',
+        'device_sharedpref',
+      }, reason: kind);
+    }
+  });
+}