Monero mobile wallet with a privacy, security and transparency focus. (Open-source & Reproducible Builds)

Full architecture doc: Kotlin+FFI vs Flutter+FFI decision analyzed specifically on reproducibility (Dart AOT snapshot nondeterminism addressed head-on) with a committed choice; module diagram; FFI boundary specification to upstream wallet2/wallet_api via pinned monero_c; explicit 'what we refuse to build and why' table covering swaps, price APIs, multi-chain, telemetry; sourced, non-speculative prior-art analysis (Milk Sad, Cake Wallet, Feather, Monerujo) with proper crediting per the fairness guardrail.

THREATMODEL.md covering malicious remote node, network observer, lost device, malicious update/distribution channel (with reproducibility as the answer), and explicit out-of-scope threats (compromised OS, coercion); SECURITY.md with honest zeroization/GC-limits documentation and vulnerability disclosure process; GOVERNANCE.md with community maintainership rules, ship-empty default-node policy with curated opt-in onion list process, and the conflict-of-interest disclosure rule for surveillance/analytics-firm work; GPLv3 LICENSE and contributor policy.

Complete repo tree; Gradle/AGP/NDK/SDK version pins with dependency hash verification (dependency-locking + checksum verification metadata); module structure separating app layer from FFI layer; baseline Android manifest for API 26+ with zero Google Play Services/Firebase; justification comments for every dependency chosen (boring, widely-audited only); initial buildable skeleton with stub screens.

Digest-pinned Containerfile producing byte-identical APKs from a git tag; SOURCE_DATE_EPOCH plumbing, stable zip entry ordering, path-prefix stripping, build-timestamp elimination, deterministic resource processing (aapt2 flags, deterministic PNG crunching disabled/normalized); documented determinism checklist mapping each known Android nondeterminism source to its mitigation; local double-build verification harness.

CI workflows: double-build on independent runners with APK diff gating releases; custom static/lint rule that FAILS the build if any non-CSPRNG random source (java.util.Random, kotlin.random.Random, Math.random) is reachable from any code path, with tests proving the gate catches seeded violations; statistical smoke test (frequency/serial tests) on app-layer generated values; documentation of the gate so other wallet projects can adopt it.

FFI binding layer to pinned monero_c built against a pinned upstream monero-project commit; in-container reproducible build of the native libs for all target ABIs; full provenance documentation (upstream commit -> patch set -> container digest -> .so hashes); JNI/Kotlin binding code with error handling, lifecycle-safe handle management, and TODO(VERIFY-UPSTREAM) markers for any uncertain protocol detail; native-lib hash verification wired into CI.

Wallet creation, restoration (from seed and from keys), and open/close flows strictly through wallet2 FFI — app layer never touches key entropy; // SECURITY: comments on every key-touching function; wallet file handling using wallet2's native encryption; unit tests including the failing-on-weak-RNG test and negative tests proving the app layer cannot generate seeds; state machine documentation for wallet lifecycle.

25-word legacy seed and Polyseed support through upstream FFI with round-trip restore tests; Argon2id-stretched wallet password derivation with documented parameters; separate Android Keystore-backed UI PIN with the threat-model difference between PIN and wallet password explicitly documented; best-effort zeroization utilities with honest GC-limitation caveats; seed display/confirm UI flows with FLAG_SECURE enforced.

Networking layer supporting user-supplied node or curated opt-in onion nodes only (shipped empty per policy); embedded Tor via Arti with Orbot fallback option; fail-closed enforcement — connection manager structurally cannot fall back to clearnet when Tor mode is on, with tests proving fail-closed behavior under Tor bootstrap failure, circuit collapse, and mid-session loss; node trust UI copy explaining malicious-node risks.

Blockchain sync via wallet2 refresh through FFI with progress reporting, background/foreground lifecycle handling, and restore-height management; balance (locked/unlocked) and transaction history screens; malicious-remote-node mitigations surfaced in UI (confirmations, fee sanity); persistence and resume-from-interruption handling; unit and instrumentation tests for sync state machine.

Send flow with address/amount validation, fee priority selection, and transaction construction strictly via wallet2 FFI (never app-layer); receive flow with subaddress generation, labeling, and QR display; integrated address and payment-ID-rejection handling per current Monero best practice; comprehensive unit tests plus // SECURITY: annotations on all tx-touching code paths; TODO(VERIFY-UPSTREAM) markers where protocol behavior must be confirmed against upstream.

FLAG_SECURE on all seed/key screens with test coverage; clipboard auto-clear with countdown; incognito IME flags on sensitive fields; screenshot/recents obfuscation; verification that no telemetry, analytics, price API, or network call beyond node/Tor exists (CI network-egress allowlist test); accessibility review that hardening doesn't break screen readers; documentation of each hardening measure and its threat mapping.

Full stagenet integration test plan covering create/restore/sync/send/receive/subaddresses against a controlled stagenet node; automated instrumentation tests runnable in CI where feasible plus documented manual test matrix; adversarial test cases (malicious node responses, truncated sync, Tor failure mid-send); test fixtures and reproducible stagenet environment setup docs.

Complete fdroiddata build recipe (metadata YAML) targeting the reproducible-builds flow with developer-key signing after F-Droid verification; documentation of the F-Droid inclusion requirements audit (no GMS/Firebase, no proprietary blobs); signed GitHub releases as secondary channel with signing metadata; walkthrough of the F-Droid verification handshake for maintainers.

One-command verification script that rebuilds from a git tag in the pinned container and diffs against the released APK ignoring only the signature block (apksigner/zip-structure aware); signing-key generation ceremony document (offline generation, storage, revocation plan); release checklist gating on double-build match, CSPRNG gate, and native-lib provenance verification; verification instructions written for hostile auditors.

Extraction of reusable artifacts for the wider ecosystem: standalone CSPRNG-enforcement harness with adoption guide, reproducible Android+FFI pipeline template, and threat-model template; write-up on how other wallet projects (credited fairly per the guardrail) can adopt the pipeline; project README, user documentation, and donation/funding transparency page; final cross-document consistency audit resolving all TODO(VERIFY-UPSTREAM) items into a tracked verification backlog.