Harbor 0.2.0-alpha05

Harbor 0.2.0-alpha05

This release prepares the tagged source for clean F-Droid builds.

Highlights

• Adds verification hashes for the Kotlin reflection artifacts resolved by a
  clean Gradle/F-Droid build.
• Publishes the F-Droid recipe for the latest tested version and explicit tag
  version extraction.
• Adds Fastlane metadata, release changelogs, and physical-device screenshots
  for repository presentation.

Security and compatibility

• No hidden APIs, reflection, arbitrary shell, network access, telemetry, or
  new runtime dependencies were added.
• Shizuku remains optional and is not required for the core work-profile path.
• The Monstera-signed GitHub APK remains separate from the future F-Droid
  signing key.

Validation

• F-Droid readmeta and lint pass with the current fdroidserver validator.
• F-Droid checkupdates detects v0.2.0-alpha05 from gradle.properties.
• A clean F-Droid-style Gradle 9.7 build completes with verification enabled.
• The standard Harbor unit, lint, release, SBOM, manifest, and reproducibility
  checks remain required before publication.

Harbor 0.2.0-alpha04

Harbor 0.2.0-alpha04

This alpha hardens work-profile policy boundaries, app shortcuts, cross-profile navigation, and dependency reproducibility.

Highlights

• Keeps APK installation restricted after provisioning until the user explicitly enables it in the work-profile UI.
• Warns that Android's generic cross-profile share filters may offer selected files to other work-profile apps.
• Pins launcher shortcut mappings to the target app's current signing certificate and invalidates stale identities.
• Uses Android's public CrossProfileApps reachability model when opening the work-profile Harbor instance.
• Refreshes Kotlin, AndroidX, DataStore, Compose, and coroutines dependency pins with updated lockfiles and verification metadata.
• Refreshes README screenshots from a physical Samsung SM-S921B running Android 16/API 36.

Security and compatibility

• No hidden APIs, reflection, arbitrary shell, network access, telemetry, or new heavy dependencies were added.
• Existing work-profile file import behavior is unchanged; the storage-quota policy remains outside this alpha's scope.
• Monstera-signed APKs are for direct alpha testing and are separate from the future F-Droid signing key.

Validation

• testDebugUnitTest, lintDebug, assembleRelease, and generateSbom pass.
• Manifest permission audit and unsigned APK reproducibility checks pass.
• Signed APK installed and launched through ADB on Samsung SM-S921B; package version 6 and APK Signature Scheme v3 verified.

Harbor 0.2.0-alpha02

Harbor 0.2.0-alpha02

This alpha fixes personal-to-work file transfers while preserving the default work-profile isolation boundary in the reverse direction.

Highlights

• Clears the supported DISALLOW_SHARE_INTO_MANAGED_PROFILE restriction for the Harbor work profile.
• Registers Android's standard ACTION_SEND and ACTION_SEND_MULTIPLE personal-to-work filters.
• Re-applies the policy for existing profiles when the work-profile Harbor instance starts.
• Adds an explicit “Allow personal → work files” action with a retry message.

Security and compatibility

• Work-to-personal file sharing remains blocked by default.
• No hidden APIs, reflection, arbitrary shell, network access, or telemetry was added.
• OEM file managers may still expose different move controls or reject transfers.

Validation

• JVM tests, debug lint, release assembly, SBOM generation, manifest audit, and reproducibility checks pass.
• Physical validation remains required on Pixel Android 16, Android 10 hardware, Samsung, Xiaomi, another OEM, and a GMS-free device.

Harbor 0.2.0-alpha01

Harbor 0.2.0-alpha01

This alpha improves everyday work-profile management while keeping the public-API core independent from Shizuku.

Highlights

• Standard, Shizuku ADB, and Shizuku Root privilege indicators with fail-closed UID handling.
• Lazy app icons, search, selection mode, sequential batch freeze/unfreeze, and partial-failure reporting.
• Clone candidates enriched with local app names/icons and target-installed state when safely available.
• Workspace dashboard cards, local Harbor aliases/icons, stale user-ID protection, and conservative remote state.
• Work-profile-local pinned shortcuts that unfreeze and launch a validated package using an opaque UUID mapping.

Security and compatibility

• No network permission, telemetry, arbitrary shell, hidden APIs, or cross-profile RPC was added.
• Shizuku remains optional and uses the same allowlist for ADB and root identities.
• Multiple full-user workspaces remain experimental and require real-device validation.
• Launcher shortcut behavior and secondary-user work-profile provisioning are OEM-dependent.

Validation

• JVM tests, debug lint, release assembly, SBOM generation, manifest audit, and reproducibility checks are required for this tag.
• Physical validation remains required on Pixel Android 16, Android 10 hardware, Samsung, Xiaomi, another OEM, and a GMS-free device.

Harbor 0.1.0-alpha02

Harbor 0.1.0-alpha02

This is a development release of Harbor, a free and open-source Android work-profile manager.

Included

• Standard consent-based work-profile provisioning and profile-owner recovery.
• Local work-profile app catalog with search, launch, details, freeze/unfreeze, and uninstall actions.
• User-triggered APK-install preparation that preserves Android's per-source consent prompt.
• Optional Shizuku diagnostics and allowlisted package-manager operations.
• Experimental multiple-full-user workspace primitives.
• Dependency verification, reproducible unsigned APK checks, SBOM generation, and F-Droid packaging metadata.

Important limitations

• This release is alpha software and is not a stable F-Droid release.
• The signed APK is for direct Monstera alpha testing. F-Droid remains the intended production signing authority; its signed package will not update a Monstera-signed installation unless signing is explicitly coordinated.
• Shizuku is optional, external, and device-dependent.
• Multiple full-user workspaces are experimental and may be unavailable on OEM devices.
• Do not use a development profile containing irreplaceable data.

Validation

• JVM tests, debug lint, release assembly, release SBOM, and manifest permission audit pass.
• Two clean unsigned release builds are byte-for-byte reproducible.
• Production application ID remains com.monstera.harbor.

Physical-device coverage is still required before a stable release.

Harbor 0.1.0-alpha01

Harbor 0.1.0-alpha01

This is the first public development release of Harbor, a free and open-source Android work-profile manager.

Included

• Standard consent-based work-profile provisioning.
• Profile-owner state detection and recovery guidance.
• Local work-profile app catalog with search.
• Launch, system details, freeze/unfreeze, and uninstall actions.
• Optional Shizuku diagnostics and allowlisted package-manager operations.
• Experimental multiple-full-user workspace primitives.
• F-Droid-oriented build, dependency verification, SBOM, privacy, and threat-model documentation.

Important limitations

• This release is alpha software and is not yet a stable F-Droid release.
• The release provides both a Monstera-signed alpha APK and an unsigned upstream APK. F-Droid remains the intended production signing authority; its signed package will not update a Monstera-signed installation unless signing is explicitly coordinated.
• Shizuku is optional, external, and device-dependent.
• Multiple full-user workspaces are experimental and may be unavailable on OEM devices.
• Do not use a development profile containing irreplaceable data.

Validation

• JVM tests and debug lint pass.
• Release APK assembly passes with application ID com.monstera.harbor.
• AOSP API 36 provisioning and freeze/unfreeze were validated.
• API 29 emulator provisioning remains limited by the image's encryption configuration.

Physical-device coverage is still required before a stable release.