# Vuln Signal Android QA Checklist

Use this after changing the Android wrapper or after a major site navigation change.

## Build

- Open `android-vuln-signal` in Android Studio.
- Sync Gradle.
- Build the debug APK.
- If preparing release, build a signed release APK or app bundle.

## WebView Routing

- App opens `https://main-9et.pages.dev`.
- Internal Vuln Signal links stay inside the app.
- Internal `http://main-9et.pages.dev` links upgrade to HTTPS.
- External `https` links open outside the app.
- `mailto:` links open the user's mail app.
- `tel:` links open the user's dialer.
- Android `intent:` links use a browser fallback or installed handler.

## Runtime Behavior

- Native practice rail opens Home, Coach, Report, Packs, Arcade, Daily, Progress, and Scenarios pages inside the app.
- App launches into `/pages/mini-game-app-home.html`, not the generic site home.
- App Home Preview shows a Coach recommendation section from `/api/app-home`.
- App Home Preview shows a Training Report card with local game and pack counts.
- App Home Preview shows `android-webview` in the App Shell card when opened
  through the Android wrapper.
- App Home Preview shows Network and Last Seen cards after a completed WebView
  page load.
- App Home Preview shows App Build and Launch Source cards when opened through
  Android.
- WebView local storage contains `vuln-signal-device-id`,
  `vuln-signal-app-shell`, `vuln-signal-app-start-url`,
  `vuln-signal-app-last-url`, `vuln-signal-network-state`, and
  `vuln-signal-app-last-seen`, `vuln-signal-app-version`,
  `vuln-signal-app-build-channel`, and `vuln-signal-app-launch-source` after
  first page load.
- WebView local storage also contains `vuln-signal-app-browser-supported`,
  `vuln-signal-app-refresh-supported`, `vuln-signal-app-restore-supported`,
  `vuln-signal-app-rail-model`, `vuln-signal-app-last-status`, and
  `vuln-signal-app-last-error` after refresh, restore, and offline tests.
- Diagnostics reports the `VulnSignalAndroidWebView/<version>` user-agent
  suffix as present in Android WebView.
- App Home and Diagnostics show native share and copy support when opened through
  Android.
- Training Coach opens from the Games menu and native practice rail, loads `/api/games/coach`,
  and recommends daily, pack, role, and milestone routes.
- Android launcher shortcuts open Training Coach, Daily Challenge, Practice
  Progress, and Training Report inside the WebView activity.
- Native review/action rail opens Status and Diagnostics inside the WebView so app
  contract checks are reachable from the app itself.
- Native Share opens the Android share sheet with the current WebView URL.
- Native Copy copies the current WebView URL and shows feedback.
- Native Browser opens the current WebView URL in the external browser.
- Training Coach role, time, and goal preferences save locally in the WebView and
  change the top recommendation after saving.
- Training Coach Continue section shows recent pack or game progress after a completed run.
- Training Coach Focus section shows thin practice lanes before covered lanes.
- Copy coach plan works in WebView when clipboard permission is available and
  includes profile, recommendation, progress counts, weak lanes, and next URL.
- Training Report opens from the Games menu, Coach, and Progress.
- Training Report summarizes local games, packs, daily state, focus lanes, and
  the next recommendation.
- Training Report copy report and copy JSON actions work when clipboard access
  is available in the WebView.
- Training Report print action opens the platform print sheet when available.
- Training Report trust boundary explains local activity, non-certification, and local-first privacy.
- Mini-Game Arcade opens from the Games page and shows the shared backend catalog
  panel when `/api/games` is available.
- Mini-Game Scenario Library opens from the Games menu and shows scenario cards
  when `/api/games/scenarios` is available.
- Mini-Game Practice Packs opens from the Games menu and shows guided role/time
  packs when `/api/games/packs` is available.
- Scenario Library and Practice Packs can start the player at a selected
  scenario using the `scenario` query parameter.
- Practice Packs launch the player with a `pack` query parameter, and Progress
  shows pack history after a completed guided run.
- Progress opens from the native practice rail and shows local scores, badges, and
  the daily challenge.
- Daily opens the dedicated Daily Challenge page, then routes into the current
  recommended mini-game.
- Mini-game result screens link back to Arcade, Progress, and Daily.
- Pull-to-refresh reloads the visible page.
- Back navigates WebView history before closing the app.
- Deep links to `https://main-9et.pages.dev/pages/mini-game-coach.html`,
  `mini-game-daily.html`, `mini-game-progress.html`, and `mini-game-report.html`
  open inside the app.
- Progress bar appears during page load and hides after load.
- Native status strip changes between opening, loading, ready, refreshing,
  offline, retry, and restore states.
- Turning off networking shows the retry screen.
- Retry loads the site after networking returns.
- Restore last page opens the most recent successful Vuln Signal page after
  networking returns.
- Close and reopen the app, then confirm Restore last page still uses the most
  recent successful internal URL saved in Android preferences.
- Open in browser launches the public site externally.
- Downloads or exported files hand off to an external handler.
- File upload prompts open Android file picker and return the selected file.

## Security Posture

- Cleartext traffic is blocked.
- Mixed content is blocked.
- File and content access are disabled for WebView.
- Third-party cookies are disabled.
- JavaScript popups and multiple windows are disabled.
- Safe Browsing is enabled on supported Android versions.

## Visual Checks

- Launcher icon appears.
- Android 12+ splash screen uses Vuln Signal colors and icon.
- Offline screen text is readable.
- Retry and browser buttons are tappable on small screens.
- Restore last page is tappable on small screens.
- Home, Coach, Report, Packs, Arcade, Daily, Progress, and Scenarios buttons
  are tappable on the practice rail at small screen sizes.
- Status and Diagnostics buttons are tappable on the review/action rail at
  small screen sizes.
- Share, Copy, and Browser buttons are tappable on small screens and use the
  current page, not only App Home.
- Both native rails scroll horizontally when the screen is narrow.
- Long-press launcher shortcuts show readable labels for Coach, Daily, Progress,
  and Report.
- Launch Source changes when opening from the normal launcher versus a shortcut
  or deep link.
- The native status strip remains readable above the two native rails.
- App Home and Diagnostics show the rail model, native recovery support, last
  native status, and last native error without opening Android Studio logs.
- Mini-Game Arcade cards and API status text are readable in the WebView.
- Status and navigation bar colors match the site shell.