Native Android client for Sheaf, the open-source plural system tracker. Built with Kotlin and Jetpack Compose; targets Android 8.0+ (API 26) and includes a Wear OS companion.
Status: in active development. Use the dev build to try it; report issues on the main repo's issue tracker.
- Members, groups, tags, custom fields with the same privacy model as the backend.
- Front tracking with switch entry, cofronters, custom fronts, and an infinite-scroll history view.
- Member bio history with per-revision diff view.
- Journals (read/write).
- System Safety settings, including the grace-period and auth-tier controls.
- Wear OS companion: glanceable fronting tile, quick switch, member browse, credential sync from the phone.
- Home-screen widget (Glance) showing current fronters.
- Self-hosting first. Point the app at any Sheaf API base URL via Settings; the URL is dynamic and takes effect on the next request without a restart.
- 2FA / TOTP supported on login.
Latest dev build: https://github.com/sheaf-project/android/releases/tag/dev.
The release contains:
app-release.apk(phone)wear-release.apk(watch, sideload via ADB)*.sigand*.pemfiles: cosign keyless OIDC signatures, see Verifying.
Stable releases (v* tags) and store-distributed builds (Play Store, F-Droid) are not yet available; see docs/PUBLISHING.md for the readiness plan.
Every APK is signed twice: by the project's release keystore (Android's standard signing, enforced by the OS at install/update time), and by Sheaf's CI workflow via cosign keyless OIDC. The cosign signature ties the APK to the exact GitHub Actions run that produced it and is recorded in the public Sigstore transparency log.
Quick check (cosign + gh required):
./scripts/verify-release.sh --tag devRelease-key SHA-256 fingerprint:
4a:9b:b3:0c:d2:c3:bd:74:7b:98:17:b1:66:c2:1d:94:b2:3a:46:c0:45:44:fc:8c:32:74:ea:49:d7:a4:34:e6
This is the fingerprint Android pins on first install. Every future update has to be signed with the same key, and apksigner verify --print-certs <apk> should print this same digest. If a build ever shows a different fingerprint, do not install it.
Step-by-step verification: docs/VERIFYING.md.
- Android Studio Ladybug (2024.2.1) or newer (or the standalone Android SDK + a JDK 17 install).
- JDK 17. Android Studio bundles one; on Linux,
openjdk17from your distro works. - Android SDK platform 35.
git clone https://github.com/sheaf-project/android
cd android/sheaf
./gradlew :app:assembleDebug
adb install app/build/outputs/apk/debug/app-debug.apkFor the wear module: ./gradlew :wear:assembleDebug and install via adb -s <watch-serial> install ....
The first build downloads the Gradle wrapper JAR and a couple of GB of Android SDK / dependencies, so be patient.
cd sheaf && ./gradlew :app:testSee docs/TESTING.md for what's covered today and the layers that are mapped out for later.
Single-activity, Compose-only UI with Hilt for DI, Retrofit + Moshi (KSP codegen) for the API client, DataStore for token / settings persistence, Room for local caching, and WorkManager for background sync. Wear OS uses the Wearable Data Layer for credential transfer from the phone.
For module layout, ViewModel conventions, and the auth/Wear flows, see CONTRIBUTING.md. The inner sheaf/README.md has a more detailed package-level breakdown.
PRs welcome. Read CONTRIBUTING.md for conventions (state management, error handling, Wear OS sync, naming) before opening one. CI runs unit tests on every push; please add tests for new ViewModels and parsers.
Bug reports, feature requests, and broader product discussion happen on the main Sheaf repo. Android-specific bugs go here.