Android 0.6.8 — sharing, listening and images

Production-key signed Android 0.6.8 (31), requiring Android 13 or later. Update in place; do not uninstall first.

• Include permitted app playback with screen sharing; microphone controls remain separate. KithMoot excludes its own room audio from capture.
• Keep the selected listening device on automatic joins; explicit Listen here handovers take effect even within the same second.
• Send drawings while the finger is down and show local and remote marks in expanded screen views.
• Open incoming encrypted PNG, JPEG, WebP and GIF images, with fit, actual size, zoom and explicit Open in another image app.

Apps can prohibit playback capture; protected content and voice-call audio are excluded. Image viewing supports up to 32 MiB encrypted files and 16 megapixels. Attachment uploads and floating overlays over other Android apps are not included. The current web client has the sustained-drawing fix; desktop 0.1.9 retains its older rate limit.

Validation: all four Android CI jobs passed, including encrypted recovery and signing-lineage upgrades on Android 13 and 15. Emulator checks proved actual Android playback capture reaching WebRTC with the microphone off, live drawing and encrypted image viewing. The signed APK passed independent package, SDK, hash, certificate and embedded lineage checks, then installed and opened cleanly in a disposable arm64 emulator. Physical-phone acceptance remains pending.

Source: 2e2ef22
APK SHA-256: 448565177d94e219b305ef92054a1915e93b11914ace4fda09b2187a86d40607
Certificate SHA-256: 135bcabf715216d13b7a596c6f891c3220a7f90826ef8e75930d51b34506a2e9

0.6.7: rejoin, call membership, rotation, no telemetry

Production-signed 0.6.7 (30). Android 13 or later. Update over 0.6.6; do not uninstall first.

• Rejoining a room works first time. A tap made while the last room is still closing waits and is carried out, instead of being dropped silently.
• Media starts as soon as the room's secure epoch is ready, instead of on a single retry 30 seconds later.
• Call membership: the phone now tells the room when it is on a call and reads when others are, so desktop and web show Join call against a phone that is on one, and the phone shows it for theirs.
• The app turns with the phone all four ways, honouring the system rotation lock.
• Google's usage reporting is removed from background effects (MediaPipe) and the QR scanner (ML Kit). A build check fails if the reporting library returns.
• New join-path logging (tag KithMootJoin) for diagnosing slow connections.

APK SHA-256: a1f4c64b1c296d4eb66bbfdbbfc18206b0d5cc7815e1e92592d64597f4521a5a
Certificate SHA-256: 135bcabf715216d13b7a596c6f891c3220a7f90826ef8e75930d51b34506a2e9

Android 0.6.6 preview

KithMoot Android 0.6.6 (29) fixes the cause of "I can see them but not hear them".

• Two ends of a call could complete different negotiations without either noticing: one side answered before its microphone reached the connection, the offer was repeated, and the second, true answer was refused by the stack (the tile then read "Video connection failed" for the rest of the call, though nothing had failed) or dropped by the far end as a duplicate. Descriptions are now compared by what they propose, not by their bytes; a genuine disagreement is repaired with one ordinary renegotiation; a repeated offer is answered from store.
• An offer that gets lost is sent again until it is answered. A lost offer used to wedge the pair for good.
• Everything in 0.6.5: tiles keyed by role, mute that keeps the microphone ready, "muted" and "silenced for you" on tiles, Backdrop sea scenes, the third default relay. The profile-2 call scheme is still compiled in and switched off.

Android 13 or later. Production-key signed with APK Signature Scheme v3 and the preview-to-production lineage; update in place, do not uninstall first.

APK SHA-256: 3c894eb69f106b7987726e3b7e04980057cecf0055759d6995bcfa5ffd918fcd
Certificate SHA-256: 135bcabf715216d13b7a596c6f891c3220a7f90826ef8e75930d51b34506a2e9
Built from 639bc71.

Verified by machine: 120 unit test suites including 15 negotiation cases (split-direction reproducers, interop with a fixed and an unfixed web far end, convergence over a transport that loses, duplicates and reorders), lint, the instrumented test compile. Installed in place over 0.6.5 on one Pixel. Not yet proven where it matters: a real call between this build, desktop 0.1.7 and the web client.

Android 0.6.5 preview

KithMoot Android 0.6.5 (28) is about calls.

• A person who toggles their camera or microphone keeps their tile: remote tiles are keyed by role, not by track.
• The microphone button mutes by disabling the track and keeps the microphone ready, as the web client does, so unmuting is instant and your tile says "muted" to everybody else. The microphone is released when you leave the call.
• Tiles show "muted" (they did it) and "silenced for you" (you did it) as two distinct states.
• Backdrop replaces what is behind you with one of four tropical sea scenes, with fish swimming past. No blur.
• A third default relay for rooms.
• The profile-2 call scheme (reliable signalling, fixed media slots, pair health) is compiled in and switched off; the wire is unchanged.

Android 13 or later. Production-key signed with APK Signature Scheme v3 and the preview-to-production lineage; update in place, do not uninstall first. The download is about 28 MiB larger than 0.6.4, nearly all of it the MediaPipe runtime behind Backdrop.

APK SHA-256: 1a4f0c7226ee5fac299f6b492eaae039892edf401df208cdd4e7d65de58320cc
Certificate SHA-256: 135bcabf715216d13b7a596c6f891c3220a7f90826ef8e75930d51b34506a2e9
Built from b759947.

Verified by machine: 118 unit test suites, lint, the instrumented test compile, CI's emulators, and an arm64 emulator run of the Backdrop pipeline. Installed in place over 0.6.4 on one Pixel. Still open on real handsets: the three microphone button states and their TalkBack labels, the tile badges, the front-camera mirror of a backdrop, its frame cost and battery, and a call between this build, desktop 0.1.5 and the web client.

Android 0.6.4 preview

KithMoot Android 0.6.4 (27) adds synced account room bookmarks, Nostr profile and relay settings, clearer call navigation, and notification controls with an optional Zen bell.

• Notification message previews are off by default. Reading clears unread counts; calls suppress the bell.
• Notifications require an active connection to the joined room. Closed-app push and alerts from other rooms are not supported yet.
• Retains the current remote-signer and rendezvous setup.

Android 13 or later. Install over your existing preview to retain its data; do not uninstall first. The APK uses the established signing lineage.

SHA-256: 124759cefe9c0eb028fdefc842d0b01f71a5987d1b29bf5cd45d08f44f2ee3fa

Validation: 612 unit tests, debug/release lint and builds, local recovery/UI journeys, and hosted signing-lineage checks on Android 13 and 15. Physical device notification and background delivery acceptance remains separate.

0.5.12 — paired private conversations through Bothy

KithMoot 0.5.12 adds the paired Bothy journey for native private conversations.

A signed-in participant can create a sealed two-person conversation, explicitly pair a Bothy route, authenticate it with the selected signer, install the minimum room-scoped grant and switch only after confirmed custody. The guest proves its exact persona, room and device before cutover. Disconnect and revocation retire server authority before local Link material is removed, including restart recovery after a lost response.

• source: f7f33e063ee6be97425cddfab2e610821457612d
• package: dev.forgesworn.kithmoot, version 0.5.12 (20)
• APK size: 71,442,792 bytes
• APK SHA-256: 077af82e5f4fc2ecf890217630c9db1c20d95935ffeb16aad023a08ce66d03ba
• preview certificate SHA-256: 5A:04:A7:7F:AF:9D:74:77:28:B8:D7:41:75:22:5A:A1:92:0A:DD:75:37:1A:9D:56:6D:80:1F:E5:5E:39:08:74
• Link bridge: f127d18, both arm64-v8a and x86_64 packaged and checked in CI
• paired Bothy: 0.1.3-pre.1

This is a debug-signed preview that updates 0.5.11 without clearing app data. The full Android verification and API 35 recovery-emulator jobs passed on PRs #38 and #39. The composed two-emulator product proof covers distinct NIP-55 personas, public-relay introduction, paired Bothy delivery, retained encrypted chat, process/server restart and two-phase route retirement.

Physical-phone continuity, background push, production signing and export/recovery for existing preview installs remain open release gates.

0.5.11 — shared projects on Android

Shared projects now follow your signed-in account onto Android. Open Projects to create or edit a project, choose its people and agents, and share persistent room invitations. Invited members explicitly join; opening a room checks its identity and preserves any room saved under another account.

Projects and pending updates are kept in an encrypted device vault. After restarting the app, Retry project updates sends the exact retained update. Valid relay settings survive restart too.

Version 0.5.11 (19) is a debug-signed preview using the existing preview certificate, so it can update 0.5.10 without uninstalling or clearing saved rooms. Android 8.0 or later is required.

Validation: 169 protocol tests, 229 app unit tests, debug/release lint and builds, and 23 local installed-app emulator checks, including separate-process project/outbox recovery. Hosted CI results are linked from PR #24.

Native conflict resolution, the cross-project decision inbox, live Oathrun pairing, physical-phone continuity and background push remain open. Shared work retains its existing standard-room and signing-device limits.

APK SHA-256: b12e1d5031e8a5f7500dc7acf7d2b13e54a4f09d3d9a1f7fe59356c4960805c2

Android 0.5.10 preview

Choose a KithMoot site you trust in the new Site settings screen. Room invitations, pairing links, contact cards and the browser sign-in return page use your saved choice, including after reopening an older room.

The setting requires HTTPS, rejects addresses containing credentials or extra paths, and keeps invitation payloads unchanged. Existing previews upgrade with the same signing certificate. Discovery checks and shared work remain available.

Validation: 154 protocol tests and 217 app tests pass. Full local and hosted emulator recovery checks pass, including choosing the site, refusing insecure input, a forced process restart, offline room reopening and pairing-link creation. This is a debug-signed preview, not a store release or physical-device acceptance claim.

APK SHA-256: daf129027d99a73eea2a687ab871778c74c36b31053f4b34e82778911819e753

0.5.9 — box discovery preview

Box-status checks now start only when you choose to check a box in your contact book. Stop checking and Forget close those reads, and saved consent is checked again when you return. An expired or retired claim cannot keep identifying a relay as a box of your circle.

This preview retains the shared-work features from 0.5.8 and fixes discovery losing a valid result when a relay finishes its claim lookup. Link transport addresses are never assumed to be message endpoints.

Debug-signed development preview. Android 8.0 or later. Version 0.5.9 (17), using the existing preview signing identity. This is not a store release; physical-device acceptance and some feature coverage remain incomplete. This release does not enable Bothy's public drop tier.

APK SHA-256: b421de59dd0bf312cf0e6e92915ab7012c78b238d18c431bbd3013eed7429483

Preview certificate SHA-256: 5a04a77faf9d747728b8d74175225aa1920add75371a9d566d801fe55e390874

KithMoot Android 0.5.8 - shared work preview (debug-signed)

Shared work is now a native tab beside Chat and Call. Choose an available agent action, answer questions, review the evidence and accept the exact result. Decisions appear before routine progress. Verified task history and uncertain sends are retained in an encrypted device journal; retries preserve the exact signed operation.

This is a debug-signed preview for Android 8.0 and later, version 0.5.8 (16). It retains the existing preview certificate so existing preview installations can update without discarding saved rooms.

Shared work currently supports standard rooms on the signing device. Quiet shared work, paired-device signing, cross-project attention, a live Oathrun pairing and physical-phone/store acceptance remain open.

Validation: 200 app and 147 protocol tests, debug/release lint and builds, and all 17 checks in the local API 35 emulator recovery suite passed. Synthetic peers exercise signed interoperability, exact retry, socket/vault recovery and actual app room entry/reopen. Both hosted verification and recovery-emulator jobs passed in CI run 34428897674. PR #21 merged as 23c88023e73c20574d2810769dd603ca7bab105c.

APK SHA-256: 38638bda17306207418ab688062e7875d2b44baf4097715e13a92ccac5696883

Preview certificate SHA-256: 5a04a77faf9d747728b8d74175225aa1920add75371a9d566d801fe55e390874