android: a Kotlin/Compose app that drives the Rust core (M12 step 5)

The skeleton, and the lane that builds it. Gradle invokes cargo-ndk to
cross-compile thoughtsync-ffi for four ABIs, generates the Kotlin bindings from
the resulting .so, and packages both.

BUILT ON MINSTREL'S TOOLCHAIN, not a fresh guess. Gradle 9.1.0 / AGP 9.0.1 /
Kotlin 2.3.21 on JDK 25 is the combination already proven in this family on
ci-android, including the JDK 22+ native-access opt-in the launcher JVM needs
and the artifact-upload action pinned by SHA (issues 2255 / 2270). It also
independently confirms the JDK 25 call made on ci-rust-android in step 3.

Gradle wiring worth noting:

  * ExecOperations, not project.exec — the latter was REMOVED in Gradle 9, and
    touching `project` at execution time is also what breaks the configuration
    cache this build enables.
  * The cargo task's inputs are the Rust SOURCES, not the workspace directory.
    Declaring the directory would make Gradle hash target/, which is gigabytes.
  * Bindings are generated with `--library` against the built .so, so they can
    never describe a different version of the Rust than the one being packaged.
  * cargo runs --locked, so an Android build cannot silently re-resolve the
    lockfile the desktop lanes are gated on.

JNA is a real dependency, with the @aar classifier. The plain jar builds fine
and fails at runtime with UnsatisfiedLinkError, which is the worst way to learn
it. R8 keep rules for JNA and the bindings are in for the same reason — that
failure would otherwise appear only in a minified release.

The UI is a working board, not a debug screen: capture field, note list, empty
state, error banner, and an honest failure screen for a store that won't open.
Rules 23/24 — a surface ships at quality from the first commit. Capture uses the
IME action key because the north star is a thought captured in under a second,
and leaves the title empty so the core derives it from the first body line.

Every core call runs on Dispatchers.IO: they are blocking FFI into synchronous
SQLite, and running them on the main thread is exactly the jank going native was
meant to avoid.

The launcher icon reuses frontend/public/icon-maskable-512.png as an adaptive
foreground on the brand #F5C518 — the same asset and colour the web app already
ships, so the three surfaces wear one face.

No signing config. A release keystore that has passed through an agent session
or shell history is compromised by construction (task 2136); it has to be
generated by the operator and reach CI only as a secret. CI builds debug.

CI can only prove this BUILDS — a Linux runner cannot execute an APK, so feel
and on-device correctness remain an operator pass on an emulator.

Scribe #2739.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

android/app/build.gradle.kts

@@ -0,0 +1,243 @@
+import javax.inject.Inject
+
+plugins {
+    alias(libs.plugins.android.application)
+    alias(libs.plugins.compose.compiler)
+    alias(libs.plugins.ktlint)
+    alias(libs.plugins.detekt)
+}
+
+// The Cargo workspace root — two levels up from android/app.
+val workspaceRoot: Directory = layout.projectDirectory.dir("../..")
+
+// The ABIs a release APK carries. arm64 is essentially every real device; armv7
+// covers older 32-bit hardware; the two x86 targets are what emulators run on, and
+// dropping them would make the app untestable on a desktop emulator (the reason
+// x86_64 was added to the old Tauri lane in task 1864).
+val androidAbis = listOf("arm64-v8a", "armeabi-v7a", "x86", "x86_64")
+
+/**
+ * Cross-compile `thoughtsync-ffi` for each Android ABI and drop the resulting
+ * `.so` into jniLibs, where AGP packages it.
+ *
+ * `ExecOperations` injected rather than `project.exec`: the latter was REMOVED in
+ * Gradle 9, and reaching for `project` at execution time is also what breaks the
+ * configuration cache this build has enabled.
+ */
+abstract class CargoNdkBuild : DefaultTask() {
+    @get:Inject
+    abstract val execOps: ExecOperations
+
+    @get:InputFiles
+    abstract val rustSources: ConfigurableFileCollection
+
+    @get:Input
+    abstract val abis: ListProperty<String>
+
+    @get:Input
+    abstract val cargoProfile: Property<String>
+
+    @get:Internal
+    abstract val workspaceDir: DirectoryProperty
+
+    @get:OutputDirectory
+    abstract val jniLibsDir: DirectoryProperty
+
+    @TaskAction
+    fun build() {
+        val args = mutableListOf("ndk")
+        abis.get().forEach { abi ->
+            args += "-t"
+            args += abi
+        }
+        args += listOf("-o", jniLibsDir.get().asFile.absolutePath, "build", "-p", "thoughtsync-ffi")
+        // --locked so an Android build cannot silently re-resolve the workspace
+        // lockfile the desktop lanes are gated on.
+        args += "--locked"
+        if (cargoProfile.get() == "release") args += "--release"
+
+        execOps.exec {
+            commandLine(listOf("cargo") + args)
+            workingDir = workspaceDir.get().asFile
+        }
+    }
+}
+
+/**
+ * Generate the Kotlin bindings FROM the freshly built `.so`.
+ *
+ * `--library` mode reads uniffi's metadata straight out of the compiled artifact,
+ * so the bindings can never describe a different version of the Rust than the one
+ * being packaged — which is the failure the whole in-workspace generator setup
+ * exists to prevent.
+ */
+abstract class UniffiBindgen : DefaultTask() {
+    @get:Inject
+    abstract val execOps: ExecOperations
+
+    @get:InputFile
+    abstract val libraryFile: RegularFileProperty
+
+    @get:Internal
+    abstract val workspaceDir: DirectoryProperty
+
+    @get:OutputDirectory
+    abstract val outputDir: DirectoryProperty
+
+    @TaskAction
+    fun generate() {
+        val out = outputDir.get().asFile
+        out.deleteRecursively()
+        out.mkdirs()
+        execOps.exec {
+            commandLine(
+                "cargo",
+                "run",
+                "--locked",
+                "--features",
+                "bindgen",
+                "--bin",
+                "uniffi-bindgen",
+                "--",
+                "generate",
+                "--library",
+                libraryFile.get().asFile.absolutePath,
+                "--language",
+                "kotlin",
+                "--out-dir",
+                out.absolutePath,
+            )
+            workingDir = workspaceDir.get().asFile
+        }
+    }
+}
+
+// Only the Rust that actually affects the .so. Deliberately NOT the workspace
+// directory: that would make Gradle hash target/, which is gigabytes.
+val rustInputs =
+    files(
+        workspaceRoot.dir("core/src"),
+        workspaceRoot.dir("android/ffi/src"),
+        workspaceRoot.file("core/Cargo.toml"),
+        workspaceRoot.file("android/ffi/Cargo.toml"),
+        workspaceRoot.file("Cargo.toml"),
+        workspaceRoot.file("Cargo.lock"),
+    )
+
+val jniLibsOut = layout.buildDirectory.dir("rustJniLibs")
+val bindingsOut = layout.buildDirectory.dir("generated/uniffi")
+
+val cargoNdkDebug =
+    tasks.register<CargoNdkBuild>("cargoNdkDebug") {
+        description = "Cross-compile thoughtsync-ffi for the Android ABIs (debug)."
+        rustSources.from(rustInputs)
+        abis.set(androidAbis)
+        cargoProfile.set("debug")
+        workspaceDir.set(workspaceRoot)
+        jniLibsDir.set(jniLibsOut)
+    }
+
+val generateBindings =
+    tasks.register<UniffiBindgen>("generateUniffiBindings") {
+        description = "Generate the Kotlin bindings from the compiled .so."
+        dependsOn(cargoNdkDebug)
+        // arm64 is arbitrary — every ABI carries the same uniffi metadata, and
+        // reading one is cheaper than reading four.
+        libraryFile.set(jniLibsOut.map { it.file("arm64-v8a/libthoughtsync_ffi.so") })
+        workspaceDir.set(workspaceRoot)
+        outputDir.set(bindingsOut)
+    }
+
+android {
+    namespace = "com.fabledsword.thoughtsync"
+    compileSdk = 36
+
+    defaultConfig {
+        applicationId = "com.fabledsword.thoughtsync"
+        // 26 (Android 8, 2017) matches Minstrel and clears the NDK's floor with
+        // room to spare.
+        minSdk = 26
+        targetSdk = 36
+        // Injected by CI from the git tag + commit count for a release; "dev"
+        // locally so the About screen reads honestly rather than claiming 1.0.
+        val nameOverride =
+            (project.findProperty("THOUGHTSYNC_VERSION_NAME") as String?)?.takeIf { it.isNotBlank() }
+        val codeOverride =
+            (project.findProperty("THOUGHTSYNC_VERSION_CODE") as String?)?.toIntOrNull()
+        versionCode = codeOverride ?: 1
+        versionName = nameOverride ?: "dev"
+    }
+
+    buildTypes {
+        release {
+            isMinifyEnabled = false
+            proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
+            // Signing is deliberately absent. A release keystore that has passed
+            // through an agent session or shell history is compromised by
+            // construction (Scribe task 2136) — it has to be generated by the
+            // operator and reach CI only as a secret. Until then a release build
+            // is unsigned and CI builds debug.
+        }
+    }
+
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+
+    buildFeatures {
+        compose = true
+    }
+
+    sourceSets {
+        getByName("main") {
+            // The .so and the bindings are build outputs, not checked-in sources.
+            jniLibs.srcDir(jniLibsOut)
+            java.srcDir(bindingsOut)
+        }
+    }
+
+    packaging {
+        resources.excludes += "/META-INF/{AL2.0,LGPL2.1}"
+    }
+}
+
+// Kotlin compilation needs the generated bindings to exist first.
+tasks.withType<org.jetbrains.kotlin.gradle.tasks.KotlinCompile>().configureEach {
+    dependsOn(generateBindings)
+}
+tasks.named("preBuild") { dependsOn(generateBindings) }
+
+// ktlint must not police generated code — it is uniffi's output, not ours, and
+// there is no edit that would fix a complaint about it.
+ktlint {
+    filter {
+        exclude { it.file.path.contains("generated") }
+    }
+}
+
+detekt {
+    buildUponDefaultConfig = true
+    config.setFrom(files("$rootDir/config/detekt.yml"))
+}
+
+dependencies {
+    implementation(libs.androidx.core.ktx)
+    implementation(libs.androidx.activity.compose)
+    implementation(libs.androidx.lifecycle.viewmodel.compose)
+    implementation(libs.androidx.lifecycle.runtime.compose)
+    implementation(libs.kotlinx.coroutines.android)
+
+    // Required by the uniffi bindings — see the catalog note on the @aar
+    // classifier; the plain jar builds fine and fails at runtime.
+    implementation(variantOf(libs.jna) { artifactType("aar") })
+
+    implementation(platform(libs.compose.bom))
+    implementation(libs.compose.ui)
+    implementation(libs.compose.ui.graphics)
+    implementation(libs.compose.material3)
+    implementation(libs.compose.ui.tooling.preview)
+    debugImplementation(libs.compose.ui.tooling)
+
+    testImplementation(libs.junit)
+}