# P36-T01 — Branded account journey and persistent key login

Authorized scope: Android signup, key login, account backup and session continuity.
Risk: critical authentication/privacy; no backend schema, endpoint or token TTL changes.

## Behavior contract

- B-BR-AK01: signup retains the issued key in Android Keystore-sealed storage and signs in automatically; the backup step stays visible before entering the app. Closing/restarting the app preserves the account.
- B-BR-AK02: access tokens keep their server TTL. Rotate expired access through the existing refresh route. Only an explicit server `session-expired` may trigger one key login, after checking the old family; never bypass revocation, reuse, suspension or deletion. A replacement session must belong to the same account.
- B-BR-AK03: transport failure preserves local credentials and displays an offline account state. Expired tokens never authorize private reads/writes. Logout clears session and key even offline and prevents an in-flight refresh from restoring them. Mutating auth operations are serialized on Android.
- B-BR-AK04: export is user initiated, masked by default and confirmed before copying/sharing. Explain that the recipient gains account access; recommend a password manager/private destination. No automatic messages, secret logs, saved UI state or public upload. Mark clipboard content sensitive, clear owned clipboard content after a bounded interval, hide secrets on background, protect sensitive windows from screenshots and exclude auth preferences from OS backup/transfer.
- B-BR-AK05: use the existing SVG-derived Android vector, lowercase abastevo wordmark, approved blue/green palette, Material typography, localized text, scrollable layouts and full-width accessible controls. No new dependency.

- B-BR-AK06: account deletion renews expired access before submitting proof and clears local credentials only after server success or a definitive auth denial; a transport failure preserves the account and recovery key. Legacy email login cannot overwrite an existing key-account backup.

## Use cases

- BUC-AK01: create username → receive key → sealed backup + automatic login → save/export deliberately → continue; retry login without recreating the account on transient failure.
- BUC-AK02: restart/resume → inspect sealed session → rotate or reauthenticate only after verified expiry → retain offline state on outage; invalid/revoked/suspended/deleted proof clears local auth.
- BUC-AK03: profile → masked backup → reveal/copy/export confirmation → system chooser → hide on background. Paste the raw or grouped key into another installation of the same environment.
- BUC-AK04: explicit logout → clear local key/session/UI secrets → attempt existing revoke-all; no automatic relogin on this device.

## Acceptance evidence

Status: LOCAL_DONE
Validation: PASS
Integration: INTEGRATION_PENDING

Tested on 2026-10-06, maintained `dev`, parent `2891df9`. Behavior-source SHA256
`3e94cb49ff7d697961a8a95aaa315817ae222274834023a5b5a8917f6944063b`:
SHA256 over sorted changed/new `app/`, `application/`, `data/` paths, each path,
NUL, file bytes, NUL. Documentation is excluded to avoid self-referential evidence.

### Immediate critical checks

- RED: session continuity/offline/refusal cases exposed three failures before implementation. HTTP redirect, oversized valid JSON and malformed session cases exposed three failures. Deletion transport failure exposed credential loss; expired-access deletion exposed two additional failures. Each was corrected before acceptance.
- GREEN: `./gradlew :application:test --tests '*PortableAuthFlowTest' :data:testDebugUnitTest --tests '*SerializedAuthOperationsTest' :app:testDebugUnitTest --tests '*AuthViewModelTest' :app:lintDebug :app:assembleDebug --console=plain` passed. Portable flow: 26; serialized rotation/logout: 2; auth view model: 21. Concurrent rotations send one refresh; logout queued behind refresh leaves no resurrected local session/key.
- Final affected security/write suite: `./gradlew :data:testDebugUnitTest --tests '*AccountHttpApiTest' --tests '*KeystoreAccountKeyTest' --tests '*KeystoreSessionStoreTest' --tests '*FeedbackHttpClientTest' --tests '*SerializedAuthOperationsTest' :app:testDebugUnitTest --tests '*SecurityConfigurationTest' --tests '*FeedbackViewModelTest' --tests '*AuthViewModelTest' --console=plain`. HTTP: 13; sealed key: 5; sealed session: 5; authenticated feedback HTTP: 11; lock: 2; security configuration: 4; feedback view model: 16; auth view model: 21. No auth key follows an HTTP redirect; unavailable/revoked renewal sends no private write.
- `cd backend && go test -race ./internal/modules/account/...` passed.
- Disposable `infra/compose.validation.yml` PostGIS fixture: applied all 42 existing migrations using `go run ./cmd/migrate`; `go test -race -count=1 -tags=integration ./internal/modules/account/adapters` passed. Separate unique validation project; no live database touched; fixture and network removed. Initial fixture startup failed because first image health preceded final TCP readiness; fixed the readiness check and absolute cleanup path, then reran successfully.
- Android compile/debug APK and lint passed: 0 lint errors, 185 warnings. Restored missing auth/capture translations in all six additional supported locales instead of suppressing MissingTranslation. XML parsing, unique resource names and format placeholders verified. APK: `app/build/outputs/apk/debug/app-debug.apk` (debug artifact, not a release-size certification).
- `git diff --check`, `bash scripts/check-mobile.sh --static-only`, `bash scripts/scan-secrets.sh`, `bash scripts/check-security.sh --static-only` passed. Manual secret-surface review: synthetic fixture credentials only, no contributor data, precise GPS, photos, keys or token logging added. No dependency additions.

### Limits and recovery

Device credential confirmation, share chooser, SAF file export, clipboard lifecycle,
screenshot protection, TalkBack, large fonts, light/dark visual QA and process restart
on hardware remain OWED under the standing device deferral. JVM/static checks do not
prove those OS behaviors. Staging runtime account/provider evidence remains OWED;
no live account or external message was created. iOS remains archived; G09 stays
UNCERTIFIED. This checkpoint accepts the scoped source behavior, not all P36,
provider/device acceptance, deployment or a public pilot.

An exported file/message contains the bearer account key and is outside the app's
storage boundary; the warning and OS credential confirmation make that transfer
explicit. The app cannot revoke a recipient's saved copy. Existing server expiry,
revocation, reuse detection, suspension and deletion rules remain authoritative.
Transient renewal/deletion failures preserve sealed recovery data without granting
expired authority. Ordinary app restart/expiry does not require manual key entry.

Rollback: revert this atomic source commit through protected `dev` → `main`
delivery; preserve existing backend migrations/endpoints and sealed key format.
Never clear account backups to roll back styling/session scheduling. Next action:
publish the cumulative dev head as one protected PR, require current-head/base
Quick verification, guarded merge, then mirror the merged documentation once.