SignalDock v0.3.0

SignalDock v0.3.0

Third tagged release. License: Apache-2.0 (LICENSE). This release has no breaking change from 0.2.0. The public API of the SDK is the same, and the runtime dependency tree is the same. See Upgrading from 0.2.0. The changes are listed under "Added" in the changelog (versioning policy).

What is included

• The Maven repository ZIP signaldock-sdk-android-0.3.0-maven.zip and its .sha256 file. The coordinate is local.signaldock:sdk-android:0.3.0. Maven Central is not used. See Add the SDK to an app and ADR-0009.
• A build provenance attestation for the ZIP. This is the first release that has one (ADR-0039).
• The source of the Android SDK, the server, the Dashboard, the demo app, the consumer app, and the measurement harnesses, as in the tagged commit. See the repository guide.

Verify the download from the folder that holds both files:

shasum -a 256 -c signaldock-sdk-android-0.3.0-maven.zip.sha256

Verify the attestation (GitHub CLI 2.102.0 or newer; older versions have attestation check flaws):

gh attestation verify signaldock-sdk-android-0.3.0-maven.zip --repo HyeokjaeChoi/signaldock \
  --signer-workflow HyeokjaeChoi/signaldock/.github/workflows/release.yml

The command must print Verification succeeded!. The attestation shows that the release workflow of this repository built the ZIP. It does not show that the code is free of defects.

Requirements of the AAR did not change: compileSdk 36 or newer, minSdk 24 or newer, Kotlin 2.2 or newer, AGP 9.x (README).

What changed in the SDK

No public API change: git diff v0.2.0 -- sdk/sdk-android/api is empty. No runtime dependency change: git diff v0.2.0 -- sdk/sdk-android/dependencies is empty.

• Baseline Profile. The AAR ships baseline-prof.txt (519 rules for local.signaldock.**) for initialize(), track(), the Room queue, and the sender. The AGP of the host app merges it into the app profile. The host needs no change. On one API 37 emulator, the p50 of the SDK startup work was 28 % and 53 % lower than with no compilation in two runs, and 1 % lower in a third run. The SDK rules alone gave no result outside the noise. The modules sdk/profile-app and sdk/baseline-profile generate and measure the profile. They are not published (ADR-0040).

What changed in the server and the build

• Collection kill switch. The operator can block events by exact name (SIGNALDOCK_BLOCKED_EVENTS) and by exact event sdkVersion (SIGNALDOCK_BLOCKED_SDK_VERSIONS). A blocked event gets the existing per-item rejection with the new code COLLECTION_BLOCKED, so the SDK deletes it and counts server_rejected. SIGNALDOCK_INGEST_SHED=true makes the two ingest routes answer 503 with Retry-After (SIGNALDOCK_INGEST_SHED_RETRY_AFTER_SECONDS, default 1). The server reads the variables at start. By default, nothing is blocked. The server cannot stop collection on the device (ADR-0037).
• Gradle dependency verification. Each of the four Gradle builds has gradle/verification-metadata.xml with SHA-256 checksums. A dependency file that is not listed, or that differs, fails the build. scripts/update-gradle-verification.sh rewrites the files. Gap: the checksums are trust on first use. No product code and no published POM changed (ADR-0038).
• Provenance attestation. The publish job of the release workflow signs the attestation before it creates the release (ADR-0039).

Upgrading from 0.2.0

Change the version only: implementation("local.signaldock:sdk-android:0.3.0"). No recompile-only change, no code change, and no database migration is needed. The server change is optional: the kill switch has no effect until you set its environment variables.

Events collected after the update, and client reports, carry sdkVersion 0.3.0. Events queued by 0.2.0 keep the sdkVersion they were collected with (spec 3, "Common information").

What was verified

The commands and results are in the release pull request. Summary:

• SDK unit tests, scripts/release.sh 0.3.0, and scripts/check-repo-rules.sh ran on the release branch before the tag.
• apiCheck and dependencyGuard pass with no baseline change (issue 70).
• The SDK instrumented tests ran once on a physical device: Samsung SM-F766N (Galaxy Z Flip7), Android 16 (API 36). 49 tests finished, 0 failed, 16 skipped because they are phase tests that need -e phase (issue 73).
• The demo app ran on the same phone: one event was sent, stored by the server, and confirmed in the Diagnostics tab (issue 74). The SDK version of that build was 0.2.0.
• The Baseline Profile effect was measured on one API 37 emulator (numbers above, ADR-0040).

The numbers are local environment records, not an SLA.

What was not verified

• The attestation. The gh attestation verify command has not run on a released ZIP. This release workflow produces the first attestation. Run the command after the workflow succeeds and record the result in issue 78.
• SDK measurement on a physical device, and scripts/device-durability.sh on a physical device. The Baseline Profile gain is not proved: it ran on one emulator, and the SDK rules alone gave no result outside the noise (README, Limitations).
• The instrumented tests on a physical device ran on the 0.2.0 code, not on a 0.3.0 build.
• Release signing and Play distribution. The consumer app uses the debug key (ADR-0009).
• A consumer on a Kotlin version other than the AGP 9.3.3 default (2.2.10), or on AGP 8.x (ADR-0009).
• A host app that adds kotlinx-serialization 1.11.0 to its own compile classpath (ADR-0009, PR #157).
• The full server measurement matrix (216 runs, Q133).
• Public internet operation. The stack is local only (README, Limitations).

SignalDock v0.2.0

SignalDock v0.2.0

Second tagged release. License: Apache-2.0 (LICENSE). This release has changes that need action when you upgrade from 0.1.0. Read Upgrading from 0.1.0 first. The SDK is before 1.0, so a MINOR release can break an app. The breaking changes are listed under "Changed" in the changelog (versioning policy).

What is included

• The Maven repository ZIP signaldock-sdk-android-0.2.0-maven.zip and its .sha256 file. The coordinate is local.signaldock:sdk-android:0.2.0. Maven Central is not used. See Add the SDK to an app and ADR-0009.
• The source of the Android SDK, the server, the Dashboard, the demo app, the consumer app, and the measurement harnesses, as in the tagged commit. See the repository guide.

Verify the download from the folder that holds both files:

shasum -a 256 -c signaldock-sdk-android-0.2.0-maven.zip.sha256

Requirements of the AAR did not change: compileSdk 36 or newer, minSdk 24 or newer, Kotlin 2.2 or newer, AGP 9.x (README). The runtime kotlin-stdlib is 2.3.20 and the compile one is 2.2.21. This is expected (ADR-0009, PR #157).

What changed in the SDK

• Opt-out. SignalDock.setOptOut(Boolean), isOptedOut(), and clearQueue() are new. While opted out, track() stores nothing and returns the new TrackResult.OptedOut. Queued events stay and are still sent unless you call clearQueue(). The state is kept across restarts (ADR-0034, PR #159).
• HTTPS enforcement. SignalDock.initialize returns InvalidConfiguration for an endpoint that is not https, unless the scheme is http and the new SignalDockConfig.allowInsecureEndpoint (default false) is true. Every other scheme is always rejected. Reason: a cleartext endpoint sends the collection key in plain text (ADR-0035, PR #160).
• Client reports. The SDK counts the events it dropped (queue_full, storage_error, invalid_event, event_too_large, server_rejected) and sends the counts to the new POST /v1/client-reports, at most once per send cycle. The Room database is now schema 3, with migrations 1 to 2 and 2 to 3, so queued events survive the update (ADR-0036, PR #161; ADR-0025, PR #109 for the migration 1 to 2).
• Deprecation headers. The SDK reads Deprecation and Sunset headers, logs one warning per process, and shows the dates in Diagnostics.contractDeprecation. A Retry-After HTTP-date with trailing text is now ignored. The server does not send these headers yet (ADR-0030, PR #123).
• Clock jump. The stored retry wait is clamped when the device clock moves back (ADR-0025, PR #109).
• Dependency baseline. sdk/sdk-android/dependencies/ lists the resolved runtime and compile classpaths. A change without a new baseline fails scripts/verify-contract.sh (ADR-0033, PR #147). Gap: the baseline is a record. It does not stop a consumer from resolving other versions.

What changed in the server and the Dashboard

• The server has two new endpoints: POST /v1/client-reports and GET /v1/client-report-counts. The contract version stays 1. The change is compatible. Migration V3__create_client_reports.sql stores one row per entry, with no installation ID. The Dashboard shows a "Dropped events" card (ADR-0036, PR #161).
• Optional tracking plan status for stored events (ADR-0022, PR #101).
• /ready database check and a restart policy in Compose (ADR-0026, PR #110).

Upgrading from 0.1.0

1. Recompile your app. The JVM constructor and copy signatures of SignalDockConfig changed, because of the new allowInsecureEndpoint parameter. The change is source compatible. It is not binary compatible (ADR-0035, PR #160).
2. Handle TrackResult.OptedOut. A when expression over TrackResult with no else branch does not compile until it has a branch for OptedOut (ADR-0034, PR #159).
3. Check your endpoint. An http:// endpoint now gives InvalidConfiguration. Use https://. For a local test, set allowInsecureEndpoint = true. The demo and consumer apps do this for http:// endpoints (ADR-0035, PR #160).
4. Update the server for client reports. An old server answers 404 to POST /v1/client-reports. The SDK then discards the report and keeps sending events as before. You lose the drop counts, not events (ADR-0036, PR #161). Deploy the new server, run migration V3, then update the apps.
5. Expect a database migration. On the first start, the SDK moves Room schema 1 to 3. The queue and retry state are kept (ADR-0025, ADR-0036).
6. Expect a new sdkVersion value. Events collected after the update, and client reports, carry sdkVersion 0.2.0. Events queued by 0.1.0 keep the sdkVersion they were collected with (spec 3). Server data by SDK version shows it (spec 3, "Common information").

What was verified

The commands and results are in the release pull request. Summary:

• SDK unit tests, apiCheck, dependencyGuard, scripts/release.sh 0.2.0, scripts/release.sh 0.2.0 --check, scripts/verify-consumer.sh, and scripts/check-size-budget.sh ran on the release branch before the tag.
• The Room migration from 1 to 3 has tests in the SDK (ADR-0025, ADR-0036).

The numbers are local environment records, not an SLA.

What was not verified

• Physical devices. SDK measurement ran on emulators only (README, Limitations).
• A new device measurement of 0.2.0. The 0.1.0 results in perf/sdk-results/ are not repeated for 0.2.0 (ADR-0014).
• Release signing and Play distribution. The consumer app uses the debug key (ADR-0009).
• A consumer on a Kotlin version other than the AGP 9.3.3 default (2.2.10), or on AGP 8.x (ADR-0009).
• A host app that adds kotlinx-serialization 1.11.0 to its own compile classpath (ADR-0009, PR #157).
• Public internet operation. The stack is local only (README, Limitations).

SignalDock v0.1.0

First tagged release of the SignalDock Android SDK. License: Apache-2.0.

Release notes (included, verified, not verified): docs/releases/v0.1.0.md

Install: unzip signaldock-sdk-android-0.1.0-maven.zip into a folder, add it as a Maven repository, and depend on local.signaldock:sdk-android:0.1.0. See Add the SDK to an app.

Verify the download (folder with both files):

shasum -a 256 -c signaldock-sdk-android-0.1.0-maven.zip.sha256

SHA-256: 1f3cb0af551ca908e97d34cd250ae6805ced6de0a104cd2c98a1480a7916a401

Built with scripts/release.sh 0.1.0 at fb06396.