v0.3.3 — R8 hardening: 5× smaller APK, Play-ready

First GitHub release since v0.3.1, two app updates in one: the consent/settings wave (0.3.2, versionCode 7 — this is what is currently on Google Play) and the R8 hardening pass (0.3.3, versionCode 8 — the APK attached here).

Smaller and R8-obfuscated (0.3.3)

• Release builds now enable code shrinking and obfuscation (R8 + resource shrinking), answering the Google Play "DEX code optimization" gate that warns below 25%.
• APK went from 6.9 MB to 1.4 MB; the packed dex went from 13.5 MB + 5.1 MB to a single 2.4 MB classes.dex — less code held in memory during a scan and a faster start. An AAB of 3.4 MB is what Play receives.
• No behavior change. Same detectors, same reports, same grade thresholds.

Consent, settings, and legal docs (0.3.2)

• First-run consent dialog: the package-visibility permission (QUERY_ALL_PACKAGES) is disclosed on launch and used only after you agree. Declining keeps the app usable through a single-APK file picker (pick or share any Flutter APK and get the same report).
• Privacy policy and the security model readable in-app from bundled legal documents (Settings) — same text as gwhyyy.com/privacy/flutterguard.
• The picked-APK flow holds its namespace everywhere — package list, cache and stored reports — not just on disk.
• Batch review fixes across the consent/settings wave.

Google Play

The store listing is live on the Play side: Google Play listing (first product release in review). The GitHub APK and the Play APK both install as com.flutterguard.app; if you sideload and later install from Play you may need one uninstall because Play serves builds signed with its own key.

Verification

• 282 unit tests / 38 suites / 0 failures on a clean rerun; lintVitalRelease passes.
• Signed with the same certificate as 0.2.0–0.3.1 (7350a257df573946d83c1dfeb1124c3e35e8ca59eb175972300b2600ebbeb1bf), so it updates an existing install in place and keeps stored reports.
• Zero INTERNET permissions.
• On a physical device the R8 build was exercised end to end earlier: install, launch, a full headless scan writing an identical graded report (0/5/5/5/8 findings on a real Flutter app before and after obfuscation), report screen and launcher icon render. The release/publishing steps in this wave were done with the device disconnected; the artifact itself was not rebuilt or changed since that on-device check.
• R8 mapping.txt is generated for every release build and uploaded to Play with the release, so obfuscated traces stay deobfuscatable.

Known limits (unchanged)

• A matched package, host or key proves the string is in the APK — evidence, not proof that a code path runs or that a key is live.
• Candidate routes are recovered strings rather than a navigation graph; libapp.so is AOT machine code (strings and symbols, not decompiled Dart); AABs are not scanned (expand to APKs first); signature checking is structural rather than a full apksigner verification.
• Some ROMs block APK reads of other apps; that is an OS policy, not a FlutterGuard setting.