[codex] Add Android universal wallet readiness gates

.github/CODEOWNERS

@@ -0,0 +1,25 @@
+# Owners must have write access to this repository.
+
+* @soramitsu/fearless
+
+/.github/ @soramitsu/devops-team
+/AGENTS.md @soramitsu/fearless @soramitsu/android-developers
+/CONTRIBUTING.md @soramitsu/fearless @soramitsu/android-developers
+/README.md @soramitsu/fearless @soramitsu/android-developers
+/docs/release-checklist.md @soramitsu/fearless @soramitsu/devops-team
+/docs/rollback-checklist.md @soramitsu/fearless @soramitsu/devops-team
+
+/app/ @soramitsu/fearless @soramitsu/android-developers
+/common/ @soramitsu/fearless @soramitsu/android-developers
+/runtime/ @soramitsu/fearless @soramitsu/android-developers
+/feature-wallet-api/ @soramitsu/fearless @soramitsu/android-developers
+/feature-wallet-impl/ @soramitsu/fearless @soramitsu/android-developers
+/feature-walletconnect-api/ @soramitsu/fearless @soramitsu/android-developers
+/feature-walletconnect-impl/ @soramitsu/fearless @soramitsu/android-developers
+
+/key/ @soramitsu/fearless @soramitsu/android-developers @soramitsu/security
+/common/src/main/java/jp/co/soramitsu/common/model/ @soramitsu/fearless @soramitsu/android-developers @soramitsu/security
+/common/src/main/java/jp/co/soramitsu/common/wallet/ @soramitsu/fearless @soramitsu/android-developers @soramitsu/security
+/**/*Key* @soramitsu/fearless @soramitsu/android-developers @soramitsu/security
+/**/*Keystore* @soramitsu/fearless @soramitsu/android-developers @soramitsu/security
+/**/*Signer* @soramitsu/fearless @soramitsu/android-developers @soramitsu/security

.github/pull_request_template.md

@@ -6,6 +6,11 @@ Describe the change and why it’s needed.
 
 Closes #<issue-number> (or) Relates to #<issue-number>
 
+## Target Branch
+
+- [ ] This PR targets `develop`
+- [ ] This PR targets `master` and is a release or hotfix PR
+
 ## Type of Change
 
 - [ ] feat (new feature)
@@ -26,6 +31,7 @@ Commands run locally:
 ./gradlew detektAll
 ./gradlew runTest
 ./gradlew :app:lint
+./scripts/audit-public-artifacts.sh
 ```
 
 Additional checks and scenarios covered:
@@ -41,5 +47,5 @@ Potential impact, migrations, or config/secrets required.
 - [ ] Added/updated tests for changed code (where applicable)
 - [ ] Updated docs (README/AGENTS) when behavior or commands changed
 - [ ] Ran detektAll, runTest, and :app:lint locally (or via CI)
-- [ ] No secrets or local.properties committed
-
+- [ ] Public artifact audit passed; no secrets or local.properties committed
+- [ ] No direct-to-`master` workflow is introduced

.github/workflows/android-ci.yml

@@ -18,7 +18,11 @@ jobs:
     timeout-minutes: 45
     env:
       CI: true
-      USE_REMOTE_UTILS: "true"
+      FEARLESS_UTILS_COMMIT: 7500809f33243ee47ecb2ec8563fc284ac4de0d6
+      FEARLESS_UTILS_PATH: ${{ github.workspace }}/fearless-utils-Android
+      FORCE_LOCAL_UTILS: "true"
+      FEARLESS_UTILS_LIBRARY_ONLY: "true"
+      USE_REMOTE_UTILS: "false"
       SHARED_FEATURES_VERSION_OVERRIDE: ""
       # Provide safe stubs to avoid repository/config failures during resolution
       PAY_WINGS_REPOSITORY_URL: https://maven.google.com
@@ -41,28 +45,125 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Checkout fearless-utils-Android
+        uses: actions/checkout@v4
+        with:
+          repository: soramitsu/fearless-utils-Android
+          ref: ${{ env.FEARLESS_UTILS_COMMIT }}
+          path: fearless-utils-Android
+          fetch-depth: 0
+
+      - name: Verify fearless-utils source
+        run: ./scripts/ensure-fearless-utils.sh
+
+      - name: Public dependency upstream handoff
+        run: |
+          bash ./scripts/test-public-dependency-upstream-delta-export.sh
+          bash ./scripts/export-public-dependency-upstream-delta.sh --output build/reports/public-dependency-upstream-delta
+
+      - name: Branch flow audit
+        run: |
+          bash ./scripts/audit-branch-flow.sh
+          bash ./scripts/test-branch-flow-audit.sh
+
+      - name: Public artifact audit
+        run: ./scripts/audit-public-artifacts.sh
+
+      - name: TODO debt audit
+        run: |
+          bash ./scripts/test-todo-debt-audit.sh
+          bash ./scripts/audit-todo-debt.sh
+
+      - name: XCM registry metadata audit
+        run: |
+          bash ./scripts/test-xcm-registry-metadata-audit.sh
+          bash ./scripts/audit-xcm-registry-metadata.sh --require-executable \
+            --write-gap-report build/reports/xcm-registry-gap-report.json \
+            --require-route-file scripts/xcm-required-routes.tsv \
+            --require-gap-file scripts/xcm-discovery-only-routes.tsv
+          bash ./scripts/test-xcm-production-evidence-template.sh
+          bash ./scripts/test-xcm-production-evidence-audit.sh
+          bash ./scripts/audit-xcm-production-evidence.sh
+
+      - name: Upload XCM registry gap report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: xcm-registry-gap-report
+          path: build/reports/xcm-registry-gap-report.json
+          if-no-files-found: ignore
+          retention-days: 14
+
+      - name: Upload public dependency handoff
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: public-dependency-upstream-delta
+          path: build/reports/public-dependency-upstream-delta
+          if-no-files-found: ignore
+          retention-days: 14
+
+      - name: Iroha mobile SDK release asset contract
+        env:
+          GH_TOKEN: ${{ github.token }}
+          IROHA_MOBILE_SDK_RELEASE_TAG: ${{ vars.IROHA_MOBILE_SDK_RELEASE_TAG }}
+          IROHA_MOBILE_SDK_RELEASE_REPO: ${{ vars.IROHA_MOBILE_SDK_RELEASE_REPO }}
+        run: |
+          bash ./scripts/check-iroha-mobile-sdk-release-assets.sh --self-test
+          if [[ -n "${IROHA_MOBILE_SDK_RELEASE_TAG:-}" ]]; then
+            bash ./scripts/check-iroha-mobile-sdk-release-assets.sh --download --tag "$IROHA_MOBILE_SDK_RELEASE_TAG"
+          else
+            echo "IROHA_MOBILE_SDK_RELEASE_TAG is not configured; real release asset validation skipped."
+          fi
+
+      - name: Private overlay audit self-test
+        run: bash ./scripts/test-private-overlay-boundary.sh
+
       - name: Setup Java 21 (Temurin)
         uses: actions/setup-java@v4
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
-        with:
-          packages: |
-            platforms;android-36
-            build-tools;36.0.0
-            platform-tools
-            ndk;28.0.12674087
-            ndk;25.2.9519653
+        run: |
+          set -euo pipefail
+          export ANDROID_SDK_ROOT="${ANDROID_SDK_ROOT:-/usr/local/lib/android/sdk}"
+          export ANDROID_HOME="$ANDROID_SDK_ROOT"
+          echo "ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT" >> "$GITHUB_ENV"
+          echo "ANDROID_HOME=$ANDROID_HOME" >> "$GITHUB_ENV"
+
+          sdkmanager_bin="$(command -v sdkmanager || true)"
+          if [[ -z "$sdkmanager_bin" ]]; then
+            for candidate in \
+              "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" \
+              "$ANDROID_SDK_ROOT/cmdline-tools/bin/sdkmanager" \
+              "$ANDROID_SDK_ROOT/tools/bin/sdkmanager"; do
+              if [[ -x "$candidate" ]]; then
+                sdkmanager_bin="$candidate"
+                break
+              fi
+            done
+          fi
+          if [[ -z "$sdkmanager_bin" ]]; then
+            echo "sdkmanager not found under ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT" >&2
+            exit 1
+          fi
+
+          yes | "$sdkmanager_bin" --licenses >/dev/null || true
+          "$sdkmanager_bin" --install \
+            "platforms;android-36" \
+            "build-tools;36.0.0" \
+            "platform-tools" \
+            "ndk;28.0.12674087" \
+            "ndk;25.2.9519653"
 
       - name: Export NDK environment
         run: |
           echo "ANDROID_NDK_HOME=$ANDROID_SDK_ROOT/ndk/28.0.12674087" >> $GITHUB_ENV
           echo "ANDROID_NDK_ROOT=$ANDROID_SDK_ROOT/ndk/28.0.12674087" >> $GITHUB_ENV
           echo "NDK_HOME=$ANDROID_SDK_ROOT/ndk/28.0.12674087" >> $GITHUB_ENV
-      
+
       - name: NDK revision
         run: |
           echo "== NDK (HOME) =="
@@ -71,15 +172,14 @@ jobs:
           ls -1 "$ANDROID_SDK_ROOT/ndk" || true
 
       - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android
-
-      - name: Cache cargo registry and builds
-        uses: Swatinem/rust-cache@v2
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v3
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+          rustup target add \
+            aarch64-linux-android \
+            armv7-linux-androideabi \
+            i686-linux-android \
+            x86_64-linux-android
 
       - name: Gradle version
         run: ./gradlew --version --no-daemon --console=plain --stacktrace

.github/workflows/android-release.yml

@@ -0,0 +1,150 @@
+name: Android Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      build_task:
+        description: Gradle task to run after release overlays are restored.
+        required: true
+        default: :app:bundleRelease
+      strict_provenance:
+        description: Fail if any tracked binary still lacks source/reproducible provenance.
+        required: true
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release-build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      CI: true
+      FEARLESS_UTILS_COMMIT: 7500809f33243ee47ecb2ec8563fc284ac4de0d6
+      FEARLESS_UTILS_PATH: ${{ github.workspace }}/fearless-utils-Android
+      FORCE_LOCAL_UTILS: "true"
+      FEARLESS_UTILS_LIBRARY_ONLY: "true"
+      USE_REMOTE_UTILS: "false"
+      SHARED_FEATURES_VERSION_OVERRIDE: ""
+
+      GOOGLE_SERVICES_RELEASE_JSON_B64: ${{ secrets.GOOGLE_SERVICES_RELEASE_JSON_B64 }}
+      ANDROID_RELEASE_KEYSTORE_B64: ${{ secrets.ANDROID_RELEASE_KEYSTORE_B64 }}
+      PLAY_SERVICE_ACCOUNT_JSON_B64: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON_B64 }}
+      CI_KEYSTORE_PASS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_PASSWORD }}
+      CI_KEYSTORE_KEY_ALIAS: ${{ secrets.ANDROID_RELEASE_KEY_ALIAS }}
+      CI_KEYSTORE_KEY_PASS: ${{ secrets.ANDROID_RELEASE_KEY_PASSWORD }}
+
+      RAMP_TOKEN_RELEASE: ${{ secrets.RAMP_TOKEN_RELEASE }}
+      COINBASE_APP_ID: ${{ secrets.COINBASE_APP_ID }}
+      MOONPAY_PRODUCTION_SECRET: ${{ secrets.MOONPAY_PRODUCTION_SECRET }}
+      MOONPAY_PRODUCTION_PUBLIC_KEY: ${{ secrets.MOONPAY_PRODUCTION_PUBLIC_KEY }}
+      X1_ENDPOINT_URL_RELEASE: ${{ secrets.X1_ENDPOINT_URL_RELEASE }}
+      X1_WIDGET_ID_RELEASE: ${{ secrets.X1_WIDGET_ID_RELEASE }}
+      WEB_CLIENT_ID_RELEASE: ${{ secrets.WEB_CLIENT_ID_RELEASE }}
+      FL_BLAST_API_ETHEREUM_KEY: ${{ secrets.FL_BLAST_API_ETHEREUM_KEY }}
+      FL_BLAST_API_BSC_KEY: ${{ secrets.FL_BLAST_API_BSC_KEY }}
+      FL_BLAST_API_SEPOLIA_KEY: ${{ secrets.FL_BLAST_API_SEPOLIA_KEY }}
+      FL_BLAST_API_GOERLI_KEY: ${{ secrets.FL_BLAST_API_GOERLI_KEY }}
+      FL_BLAST_API_POLYGON_KEY: ${{ secrets.FL_BLAST_API_POLYGON_KEY }}
+      FL_ANDROID_ETHERSCAN_API_KEY: ${{ secrets.FL_ANDROID_ETHERSCAN_API_KEY }}
+      FL_ANDROID_BSCSCAN_API_KEY: ${{ secrets.FL_ANDROID_BSCSCAN_API_KEY }}
+      FL_ANDROID_POLYGONSCAN_API_KEY: ${{ secrets.FL_ANDROID_POLYGONSCAN_API_KEY }}
+      FL_ANDROID_OKLINK_API_KEY: ${{ secrets.FL_ANDROID_OKLINK_API_KEY }}
+      FL_ANDROID_OPMAINNET_API_KEY: ${{ secrets.FL_ANDROID_OPMAINNET_API_KEY }}
+      FL_WALLET_CONNECT_PROJECT_ID: ${{ secrets.FL_WALLET_CONNECT_PROJECT_ID }}
+      WALLET_CONNECT_PROJECT_ID: ${{ secrets.FL_WALLET_CONNECT_PROJECT_ID }}
+      FL_DWELLIR_API_KEY: ${{ secrets.FL_DWELLIR_API_KEY }}
+      FL_ANDROID_TON_API_KEY: ${{ secrets.FL_ANDROID_TON_API_KEY }}
+      FL_ANDROID_TON_INDEXER_URL: ${{ secrets.FL_ANDROID_TON_INDEXER_URL }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Checkout fearless-utils-Android
+        uses: actions/checkout@v4
+        with:
+          repository: soramitsu/fearless-utils-Android
+          ref: ${{ env.FEARLESS_UTILS_COMMIT }}
+          path: fearless-utils-Android
+          fetch-depth: 0
+
+      - name: Verify fearless-utils source
+        run: ./scripts/ensure-fearless-utils.sh
+
+      - name: Setup Java 21 (Temurin)
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Setup Android SDK
+        run: |
+          set -euo pipefail
+          export ANDROID_SDK_ROOT="${ANDROID_SDK_ROOT:-/usr/local/lib/android/sdk}"
+          export ANDROID_HOME="$ANDROID_SDK_ROOT"
+          echo "ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT" >> "$GITHUB_ENV"
+          echo "ANDROID_HOME=$ANDROID_HOME" >> "$GITHUB_ENV"
+
+          sdkmanager_bin="$(command -v sdkmanager || true)"
+          if [[ -z "$sdkmanager_bin" ]]; then
+            for candidate in \
+              "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" \
+              "$ANDROID_SDK_ROOT/cmdline-tools/bin/sdkmanager" \
+              "$ANDROID_SDK_ROOT/tools/bin/sdkmanager"; do
+              if [[ -x "$candidate" ]]; then
+                sdkmanager_bin="$candidate"
+                break
+              fi
+            done
+          fi
+          if [[ -z "$sdkmanager_bin" ]]; then
+            echo "sdkmanager not found under ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT" >&2
+            exit 1
+          fi
+
+          yes | "$sdkmanager_bin" --licenses >/dev/null || true
+          "$sdkmanager_bin" --install \
+            "platforms;android-36" \
+            "build-tools;36.0.0" \
+            "platform-tools" \
+            "ndk;28.0.12674087" \
+            "ndk;25.2.9519653"
+
+      - name: Export NDK environment
+        run: |
+          echo "ANDROID_NDK_HOME=$ANDROID_SDK_ROOT/ndk/28.0.12674087" >> $GITHUB_ENV
+          echo "ANDROID_NDK_ROOT=$ANDROID_SDK_ROOT/ndk/28.0.12674087" >> $GITHUB_ENV
+          echo "NDK_HOME=$ANDROID_SDK_ROOT/ndk/28.0.12674087" >> $GITHUB_ENV
+
+      - name: Setup Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+          rustup target add \
+            aarch64-linux-android \
+            armv7-linux-androideabi \
+            i686-linux-android \
+            x86_64-linux-android
+
+      - name: Restore release overlays
+        run: ./scripts/restore-release-overlays.sh
+
+      - name: Release artifact audit
+        run: |
+          flags=(--release)
+          if [ "${{ inputs.strict_provenance }}" = "true" ]; then
+            flags+=(--strict-provenance)
+          fi
+          ./scripts/audit-public-artifacts.sh "${flags[@]}"
+
+      - name: Build release artifact
+        run: ./gradlew "${{ inputs.build_task }}" --no-daemon --console=plain --stacktrace