build: add reproducible Android release verification

Pin Gradle inputs and dependency metadata, then enforce analyze, lint, build, R8, immutability, and regression gates in CI.

.github/workflows/android-ci.yml

@@ -0,0 +1,134 @@
+name: Android CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  android:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Set up Java 17
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: Verify Gradle supply chain
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -x android/gradlew
+          test -f android/gradlew.bat
+          test -f android/gradle/wrapper/gradle-wrapper.jar
+          test -s android/gradle/verification-metadata.xml
+          test "$(sha256sum android/gradle/wrapper/gradle-wrapper.jar | awk '{print $1}')" = '7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172'
+          grep -qx 'distributionSha256Sum=efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1' android/gradle/wrapper/gradle-wrapper.properties
+          grep -q '<verify-metadata>true</verify-metadata>' android/gradle/verification-metadata.xml
+          ./android/gradlew --version
+
+      - name: Set up Flutter
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
+        with:
+          flutter-version: '3.47.2'
+          channel: stable
+          cache: false
+
+      - name: Create CI app config
+        run: cp lib/logic/app_config.example.dart lib/logic/app_config.dart
+
+      - name: Resolve dependencies
+        run: flutter pub get
+
+      - name: Verify dependency lock is committed
+        run: git diff --exit-code -- pubspec.lock
+
+      - name: Verify vendored runtime provenance
+        shell: bash
+        run: |
+          set -euo pipefail
+          PKG='local_packages/flutter_vless_android-1.1.5'
+          test -f "$PKG/UPSTREAM"
+          grep -q 'Tag: v1.1.5' "$PKG/UPSTREAM"
+          grep -q 'path: local_packages/flutter_vless_android-1.1.5' pubspec.yaml
+          ! grep -q 'patchFlutterVless' android/app/build.gradle.kts
+
+      - name: Analyze
+        run: flutter analyze
+
+      - name: Test
+        run: flutter test
+
+      - name: Android lint
+        working-directory: android
+        run: ./gradlew :app:lintDebug --no-daemon
+
+      - name: Verify production release config fails closed
+        shell: bash
+        working-directory: android
+        run: |
+          set -euo pipefail
+          set +e
+          output="$(./gradlew :app:verifyReleaseAppConfig --no-daemon 2>&1)"
+          status=$?
+          set -e
+          printf '%s\n' "$output"
+          test "$status" -ne 0
+          grep -Fq 'REVOLT_APP_CONFIG_SHA256 is required for production release builds' <<<"$output"
+
+      - name: Cold APK build
+        run: flutter build apk --debug
+
+      - name: Verify vendored native source stayed immutable
+        run: git diff --exit-code -- local_packages/flutter_vless_android-1.1.5
+
+      - name: Warm APK build
+        run: flutter build apk --debug
+
+      - name: Release R8 smoke build
+        env:
+          REVOLT_CI_RELEASE_SMOKE: 'true'
+        run: |
+          flutter build apk --release
+          test -f build/app/outputs/flutter-apk/app-release.apk
+          test -f build/app/outputs/mapping/release/mapping.txt
+
+      - name: Verify tracked build inputs stayed immutable
+        run: |
+          git diff --exit-code -- \
+            pubspec.yaml \
+            pubspec.lock \
+            local_packages/flutter_vless_android-1.1.5 \
+            android/app/build.gradle.kts \
+            android/app/proguard-rules.pro \
+            android/gradle/verification-metadata.xml \
+            android/gradle/wrapper/gradle-wrapper.properties \
+            android/gradle/wrapper/gradle-wrapper.jar \
+            android/gradlew \
+            android/gradlew.bat
+
+      - name: Upload APK
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: revoltvpn-debug-apk
+          if-no-files-found: error
+          path: build/app/outputs/flutter-apk/app-debug.apk
+
+      - name: Upload resolved lockfile
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: revoltvpn-resolved-lockfile
+          if-no-files-found: error
+          path: pubspec.lock

analysis_options.yaml

@@ -2,6 +2,8 @@ include: package:flutter_lints/flutter.yaml
 
 analyzer:
   exclude:
+    - build/**
+    - android/**
     - local_packages/**
     - whatsthis/**
 

android/app/build.gradle.kts

@@ -1,11 +1,18 @@
 import java.util.Properties
+import java.io.File
 import java.io.FileInputStream
+import java.security.MessageDigest
 
 plugins {
     id("com.android.application")
     id("dev.flutter.flutter-gradle-plugin")
 }
 
+fun sha256Hex(file: File): String {
+    val digest = MessageDigest.getInstance("SHA-256").digest(file.readBytes())
+    return digest.joinToString("") { "%02x".format(it.toInt() and 0xff) }
+}
+
 android {
     namespace = "com.paladinvpn.app"
     compileSdk = flutter.compileSdkVersion
@@ -17,10 +24,6 @@ android {
         targetCompatibility = JavaVersion.VERSION_17
     }
 
-    packaging {
-        resources.excludes.add("META-INF/**")
-    }
-
     val keystorePropertiesFile = rootProject.file("key.properties")
     val keystoreProperties = Properties()
     if (keystorePropertiesFile.exists()) {
@@ -33,6 +36,68 @@ android {
         admobProperties.load(FileInputStream(admobPropertiesFile))
     }
 
+    // Explicit opt-in used only by GitHub Actions to exercise the real
+    // release/R8 graph. Production release signing and config pinning remain
+    // fail-closed outside that CI smoke path.
+    val ciReleaseSmoke =
+        System.getenv("GITHUB_ACTIONS") == "true" &&
+            System.getenv("REVOLT_CI_RELEASE_SMOKE") == "true"
+
+    val appConfigFile = rootProject.file("../lib/logic/app_config.dart")
+    val verifyReleaseAppConfig = tasks.register("verifyReleaseAppConfig") {
+        group = "verification"
+        description = "Verify the production Dart app config against REVOLT_APP_CONFIG_SHA256."
+        doLast {
+            if (ciReleaseSmoke) {
+                logger.lifecycle("Skipping production app-config pin for CI release smoke build")
+                return@doLast
+            }
+
+            val expected = System.getenv("REVOLT_APP_CONFIG_SHA256")?.trim()?.lowercase()
+            if (expected.isNullOrEmpty()) {
+                throw org.gradle.api.GradleException(
+                    "REVOLT_APP_CONFIG_SHA256 is required for production release builds"
+                )
+            }
+            if (!Regex("[0-9a-f]{64}").matches(expected)) {
+                throw org.gradle.api.GradleException(
+                    "REVOLT_APP_CONFIG_SHA256 must be exactly 64 lowercase hexadecimal characters"
+                )
+            }
+            if (!appConfigFile.isFile) {
+                throw org.gradle.api.GradleException(
+                    "Production app config is missing: ${appConfigFile.absolutePath}"
+                )
+            }
+
+            val configText = appConfigFile.readText()
+            val templateMarkers = listOf(
+                "'0.0.0.0'",
+                "YOUR_DOMAIN",
+                "YOUR_GITHUB_USERNAME",
+                "YOUR_REPO_NAME",
+                "ca-app-pub-0000000000000000/0000000000",
+            )
+            val remainingMarker = templateMarkers.firstOrNull(configText::contains)
+            if (remainingMarker != null) {
+                throw org.gradle.api.GradleException(
+                    "Production app config still contains template marker: $remainingMarker"
+                )
+            }
+
+            val actual = sha256Hex(appConfigFile)
+            if (actual != expected) {
+                throw org.gradle.api.GradleException(
+                    "Production app config SHA-256 mismatch: expected $expected, got $actual"
+                )
+            }
+        }
+    }
+
+    tasks.matching { it.name == "preReleaseBuild" }.configureEach {
+        dependsOn(verifyReleaseAppConfig)
+    }
+
     defaultConfig {
         applicationId = "com.paladinvpn.app"
         minSdk = flutter.minSdkVersion
@@ -53,7 +118,11 @@ android {
 
     buildTypes {
         release {
-            signingConfig = signingConfigs.getByName("release")
+            signingConfig = if (ciReleaseSmoke) {
+                signingConfigs.getByName("debug")
+            } else {
+                signingConfigs.getByName("release")
+            }
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(

android/app/proguard-rules.pro

@@ -1,4 +1,4 @@
-# PaladinVPN ProGuard / R8 Rules
+# ReVoltVPN ProGuard / R8 Rules
 # ==============================================================================
 # These rules prevent R8 from stripping classes and methods that are accessed
 # via JNI (Java Native Interface) or reflection, which would cause
@@ -11,9 +11,8 @@
 -keep class xray.** { *; }
 
 # ── Flutter / Platform Channels ───────────────────────────────────────────────
+# io.flutter.** already includes embedding and plugin subpackages.
 -keep class io.flutter.** { *; }
--keep class io.flutter.embedding.** { *; }
--keep class io.flutter.plugin.** { *; }
 
 # ── Google Mobile Ads (AdMob) ─────────────────────────────────────────────────
 -keep class com.google.android.gms.ads.** { *; }

android/gradlew

@@ -0,0 +1,251 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH="\\\"\\\""
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"

android/gradlew.bat

@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS=-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

test/native_runtime_state_regression_test.dart

@@ -0,0 +1,98 @@
+import 'dart:io';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('native runtime is generation-scoped, readiness-gated and deadline-bound', () {
+    const root = 'local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless';
+    final plugin = File('$root/FlutterVlessPlugin.kt').readAsStringSync();
+    final config = File('$root/xray/dto/XrayConfig.kt').readAsStringSync();
+    final service = File('$root/xray/service/XrayVPNService.kt').readAsStringSync();
+    final core = File('$root/xray/core/XrayCoreManager.kt').readAsStringSync();
+    final timer = File('lib/logic/session_timer.dart').readAsStringSync();
+    final vpn = File('lib/logic/vpn_connection.dart').readAsStringSync();
+    final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync();
+    final main = File('lib/main.dart').readAsStringSync();
+    final mainActivity = File(
+      'android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt',
+    ).readAsStringSync();
+    final support = File('lib/components/support_button.dart').readAsStringSync();
+    final connectionSettings =
+        File('lib/logic/connection_settings.dart').readAsStringSync();
+
+    expect(config, contains('var RUNTIME_TOKEN: String = ""'));
+    expect(plugin, contains('expectedRuntimeToken'));
+    expect(plugin, contains('runtimeToken != currentToken'));
+    expect(plugin, contains('runtimeReady'));
+    expect(plugin, contains('STOP_TIMEOUT'));
+    expect(plugin, contains('setSessionDeadline'));
+    expect(plugin, contains('result.error("NO_ACTIVITY"'));
+    expect(plugin, isNot(contains('activity!!')));
+
+    expect(plugin, contains('if (token == null) {'));
+    expect(plugin, contains('intent.putExtra("RUNTIME_TOKEN", token)'));
+    expect(
+      plugin,
+      isNot(contains('if (token != null) intent.putExtra("RUNTIME_TOKEN", token)')),
+    );
+    expect(plugin, isNot(contains('"getServerDelay" ->')));
+    expect(plugin, isNot(contains('"getConnectedServerDelay" ->')));
+
+    expect(
+      service,
+      contains('val requestedToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()'),
+    );
+    expect(service, contains('requestedToken.isEmpty() ||'));
+    expect(service, contains('requestedToken != activeToken'));
+    expect(service, contains('stopAll(requestedToken)'));
+
+    expect(hivemind, contains('..followRedirects = false;'));
+
+    expect(plugin, contains('failPendingPermission("ENGINE_DETACHED"'));
+    expect(plugin, contains('failPendingPermission("NO_ACTIVITY"'));
+
+    expect(service, contains('BOOTSTRAP_SESSION_SECONDS = 120L'));
+    expect(service, contains('UPDATE_SESSION_DEADLINE'));
+    expect(service, contains('SystemClock.elapsedRealtime()'));
+    expect(service, contains('AlarmManager.RTC_WAKEUP'));
+    expect(service, contains('setExactAndAllowWhileIdle'));
+    expect(service, contains('setAndAllowWhileIdle'));
+    expect(service, contains('PREF_EXPIRES_AT_MS'));
+    expect(service, contains('PREF_RUNTIME_TOKEN'));
+    expect(service, contains('markRuntimeReady(this, config)'));
+    expect(service, contains('if (currentConfig == null) stopSelf()'));
+    expect(service, isNot(contains('sessionDeadlineEpochMs')));
+    expect(service, isNot(contains('active_session.bin')));
+    expect(service, isNot(contains('ObjectOutputStream')));
+
+    expect(core, contains('AppConfigs.RUNTIME_READY = false'));
+    expect(core, contains('fun markRuntimeReady'));
+    expect(timer, contains('setNativeSessionDeadline(_remainingAtLastSync)'));
+    expect(timer, contains('Future.microtask(_onVpnConnectionChanged)'));
+    expect(timer, contains('Completer<void>? _syncCompletion'));
+    expect(timer, contains('await active.future;'));
+    expect(timer, contains('_sessionEpoch++;'));
+    expect(timer, contains('_supportStateEpoch++;'));
+    expect(timer, contains('_isDisconnecting = true;'));
+
+    expect(vpn, contains('bool _disposed = false;'));
+    expect(vpn, contains('if (_disposed) return;'));
+    expect(vpn, contains('_connectEpoch++;'));
+    expect(vpn, contains('HivemindService.cancel();'));
+
+    expect(main, contains('ChangeNotifierProxyProvider<VpnConnection, SessionTimer>('));
+    expect(main, contains('lazy: false'));
+    expect(support, contains('await timer.syncNow();'));
+    expect(vpn, contains("MethodChannel('flutter_vless')"));
+
+    expect(mainActivity, contains('manager.activeNotifications'));
+    expect(mainActivity, contains('serviceStopAction'));
+    expect(mainActivity, isNot(contains('V2RAY_SERVICE_COMMANDS.STOP_SERVICE')));
+    expect(mainActivity, isNot(contains('XrayVPNService::class.java')));
+
+    expect(
+      connectionSettings,
+      contains('storedMode == ConnectionMode.proxy.name'),
+    );
+    expect(connectionSettings, isNot(contains("storedMode == 'ass'")));
+  });
+}

test/runtime_boundary_regression_test.dart

@@ -0,0 +1,58 @@
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  test('notification updates do not trust ActivityManager process visibility', () {
+    final source = File(
+      'android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt',
+    ).readAsStringSync();
+
+    expect(source, isNot(contains('ActivityManager')));
+    expect(source, isNot(contains('isVpnServiceProcessAlive')));
+    expect(source, isNot(contains('VPN_PROCESS_SUFFIX')));
+    expect(source, contains('NotificationManagerCompat.from(this).notify'));
+  });
+
+  test('SOCKS reads use one total deadline instead of per-chunk timeout', () {
+    final source = File('lib/logic/local_socks_tester.dart').readAsStringSync();
+
+    expect(
+      source,
+      contains('timeout.inMicroseconds - elapsed.elapsedMicroseconds'),
+    );
+    expect(
+      source,
+      contains("throw TimeoutException('Socket read timed out', timeout);"),
+    );
+  });
+
+  test('Hivemind captures cancellation generation before first async lookup', () {
+    final source = File('lib/logic/hivemind_service.dart').readAsStringSync();
+    final callIdIndex = source.indexOf('final callId = ++_currentCallId;');
+    final deviceIdIndex =
+        source.indexOf('final deviceId = await CryptoService.getDeviceId();');
+
+    expect(callIdIndex, greaterThanOrEqualTo(0));
+    expect(deviceIdIndex, greaterThan(callIdIndex));
+    expect(
+      source.substring(deviceIdIndex),
+      contains('_throwIfCancelled(callId);'),
+    );
+    expect(
+      source,
+      contains('_currentCallId++;\n    _expectedNonce = null;'),
+    );
+  });
+
+  test('notification text is cached only after native update succeeds', () {
+    final source =
+        File('lib/logic/notification_service.dart').readAsStringSync();
+    final invokeIndex =
+        source.indexOf("await _channel.invokeMethod<void>('updateNotificationText'");
+    final cacheIndex = source.indexOf('_lastText = text;');
+
+    expect(invokeIndex, greaterThanOrEqualTo(0));
+    expect(cacheIndex, greaterThan(invokeIndex));
+  });
+}

test/security_regression_test.dart

@@ -0,0 +1,230 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:revoltvpn/logic/secure_socks_session.dart';
+
+void main() {
+  test('secure SOCKS session owns the entire inbound surface', () async {
+    final session = await SecureSocksSession.create(jsonEncode({
+      'inbounds': [
+        {
+          'tag': 'remote-listener',
+          'listen': '0.0.0.0',
+          'port': 9999,
+          'protocol': 'dokodemo-door',
+        },
+        {
+          'tag': 'old-http',
+          'listen': '127.0.0.1',
+          'port': 8080,
+          'protocol': 'http',
+        },
+      ],
+      'outbounds': [
+        {'tag': 'proxy', 'protocol': 'freedom'}
+      ],
+    }));
+
+    final decoded = jsonDecode(session.configJson) as Map<String, dynamic>;
+    final inbounds = decoded['inbounds'] as List<dynamic>;
+    expect(inbounds, hasLength(1));
+
+    final inbound = inbounds.single as Map<String, dynamic>;
+    expect(inbound['tag'], SecureSocksSession.inboundTag);
+    expect(inbound['listen'], '127.0.0.1');
+    expect(inbound['protocol'], 'socks');
+    expect(inbound['port'], session.port);
+
+    final settings = inbound['settings'] as Map<String, dynamic>;
+    expect(settings['auth'], 'password');
+    final users = settings['users'] as List<dynamic>;
+    expect(users, hasLength(1));
+    final account = users.single as Map<String, dynamic>;
+    expect(account['user'], session.username);
+    expect(account['pass'], session.password);
+  });
+
+  test('vendored native source keeps full-tunnel and private IPC invariants', () {
+    const root =
+        'local_packages/flutter_vless_android-1.1.5/android/src/main';
+    final service = File(
+      '$root/kotlin/com/github/tfox/flutter_vless/xray/service/XrayVPNService.kt',
+    ).readAsStringSync();
+    final core = File(
+      '$root/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManager.kt',
+    ).readAsStringSync();
+    final plugin = File(
+      '$root/kotlin/com/github/tfox/flutter_vless/FlutterVlessPlugin.kt',
+    ).readAsStringSync();
+    final manifest = File('$root/AndroidManifest.xml').readAsStringSync();
+
+    expect(service, contains('builder.addRoute("0.0.0.0", 0)'));
+    expect(service, contains('builder.addRoute("::", 0)'));
+    expect(service, contains('Android refused to establish VPN interface'));
+    expect(service, contains('Per-app VPN bypass is disabled in ReVolt'));
+    expect(service, contains('Failed to configure VPN DNS'));
+    expect(service, contains('reader.forEachLine { _ -> }'));
+
+    expect(plugin, contains('ContextCompat.RECEIVER_NOT_EXPORTED'));
+    expect(core, contains('.setPackage(context.packageName)'));
+    expect(core, contains('REVOLT_VPN_SERVICE'));
+    expect(core, contains('NotificationManager.IMPORTANCE_LOW'));
+    expect(core, contains('deleteEphemeralConfigOnFailure'));
+    expect(core, contains('reader.forEachLine { _ -> }'));
+
+    expect(manifest, contains('android:exported="false"'));
+    expect(manifest, contains('android:permission="android.permission.BIND_VPN_SERVICE"'));
+    expect(manifest, contains('android.net.VpnService.SUPPORTS_ALWAYS_ON'));
+    expect(manifest, contains('android:value="false"'));
+    expect(manifest, isNot(contains('android.permission.CHANGE_NETWORK_STATE')));
+    expect(manifest, isNot(contains('android.permission.READ_EXTERNAL_STORAGE')));
+  });
+
+  test('native app bridge keeps runtime adoption on private heartbeat only', () {
+    final source = File(
+      'android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt',
+    ).readAsStringSync();
+    final vpnSource = File('lib/logic/vpn_connection.dart').readAsStringSync();
+    final powerSource = File('lib/logic/power_settings.dart').readAsStringSync();
+
+    expect(source, isNot(contains('openVpnSettings')));
+    expect(source, isNot(contains('ACTION_VPN_SETTINGS')));
+    expect(source, isNot(contains('FROM_DISCONNECT_BTN')));
+    expect(source, isNot(contains('isVpnRuntimeAlive')));
+    expect(source, isNot(contains('isVpnServiceProcessAlive')));
+    expect(source, contains('REVOLT_VPN_SERVICE'));
+
+    expect(vpnSource, contains('if (_connectEpoch == 0) _adoptedRunningRuntime = true;'));
+    expect(vpnSource, isNot(contains('PowerSettings.runtimeState')));
+    expect(vpnSource, isNot(contains('_adoptRunningRuntime')));
+    expect(powerSource, isNot(contains('runtimeState')));
+    expect(powerSource, isNot(contains('VpnRuntimeState')));
+  });
+
+  test('configured AdMob bypass contract remains intact', () {
+    final source = File('lib/logic/hivemind_service.dart').readAsStringSync();
+
+    expect(source, contains('await _runConfiguredBypass(deviceId, nonce);'));
+    expect(
+      source,
+      contains('/admob/callback?signature=test&key_id=test&custom_data='),
+    );
+  });
+
+  test('local SOCKS diagnostics cannot fall back to unauthenticated legacy mode', () {
+    final source = File('lib/logic/local_socks_tester.dart').readAsStringSync();
+
+    expect(source, contains('required int port'));
+    expect(source, contains('required String username'));
+    expect(source, contains('required String password'));
+    expect(source, contains('const <int>[0x05, 0x01, 0x02]'));
+    expect(source, isNot(contains('const <int>[0x05, 0x01, 0x00]')));
+    expect(source, isNot(contains('int port = 10807')));
+    expect(source, isNot(contains('paladinvpn.duckdns.org')));
+    expect(source, contains("String targetHost = 'example.com'"));
+    expect(source, contains('const totalTimeout = Duration(seconds: 8);'));
+  });
+
+  test('hivemind rejects missing nonce and stale session responses', () {
+    final source = File('lib/logic/hivemind_service.dart').readAsStringSync();
+
+    expect(source, contains('_expectedNonce != nonce ||'));
+    expect(source, contains('serverNonce is! String ||'));
+    expect(
+      source,
+      contains(
+        'final session = await _fetchActiveSession(deviceId, nonce);\n'
+        '        _throwIfCancelled(callId);',
+      ),
+    );
+  });
+
+  test('hivemind validates and pins session fields before constructing VLESS', () {
+    final source = File('lib/logic/hivemind_service.dart').readAsStringSync();
+
+    expect(source, contains('_uuidPattern'));
+    expect(source, contains('_maxControlResponseBytes = 256 * 1024'));
+    expect(source, contains('controlGet('));
+    expect(source, contains('_validatedPublicIp(AppConfig.serverIp'));
+    expect(source, contains('const port = 443;'));
+    expect(source, contains("_requiredString(json, 'reality_pbk', maxLength: 128)"));
+    expect(source, contains('_validatedHost('));
+    expect(
+      source,
+      contains("final pinnedHost = _validatedPublicIp(AppConfig.serverIp, 'serverIp');"),
+    );
+    expect(source, contains('advertisedHost.trim() != pinnedHost'));
+    expect(
+      source,
+      isNot(contains("_stringOr(json['vless_ip'], AppConfig.serverIp)")),
+    );
+    expect(source, contains('return Uri('));
+    expect(source, contains('queryParameters: <String, String>{'));
+    expect(source, isNot(contains("return 'vless://\$uuid@\$host:\$port'")));
+  });
+
+  test('VPN connect work cannot outlive its generation', () {
+    final source = File('lib/logic/vpn_connection.dart').readAsStringSync();
+
+    expect(source, contains('int _connectEpoch = 0;'));
+    expect(source, contains('final connectEpoch = ++_connectEpoch;'));
+    expect(source, contains('epoch == _connectEpoch && !_userDisconnecting'));
+    expect(source, contains('_connectEpoch++;\n    _suppressNativeConnect = true;'));
+    expect(source, contains('if (_suppressNativeConnect || _userDisconnecting) return;'));
+    expect(source, isNot(contains('bool _cancelled = false;')));
+  });
+
+  test('native recovery is fail-closed without hot process restart loops', () {
+    const root =
+        'local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless';
+    final service =
+        File('$root/xray/service/XrayVPNService.kt').readAsStringSync();
+    final core = File('$root/xray/core/XrayCoreManager.kt').readAsStringSync();
+
+    expect(service, contains('scheduleTun2socksRecovery'));
+    expect(service, contains('tun2socksRecoveryAttempt'));
+    expect(service, contains('coerceAtMost(30_000L)'));
+    expect(service, contains('recoveringTun2socks = false'));
+    expect(service, contains('tun2socksRecoveryAttempt = 0'));
+    expect(service, contains('XrayCoreManager.markRuntimeConnecting(this, config)'));
+    expect(service, isNot(contains('Thread.sleep(350)')));
+    expect(service, isNot(contains('Thread.sleep(600)')));
+    expect(
+      service,
+      isNot(contains('attempt = 0\n                        Thread.sleep(3000)')),
+    );
+
+    expect(core, contains('context.handleXrayCoreExit(config)'));
+    expect(core, contains('AppConfigs.RUNTIME_READY = false'));
+  });
+
+  test('data disclosure only persists an explicit acknowledged action', () {
+    final source =
+        File('lib/components/data_disclosure_dialog.dart').readAsStringSync();
+
+    expect(source, contains('final accepted = await showDialog<bool>('));
+    expect(source, contains('if (accepted != true) return;'));
+    expect(source, contains('final saved = await prefs.setBool(_key, true);'));
+    expect(source, contains('if (!saved)'));
+    expect(source, contains('Navigator.of(context).pop(true)'));
+    expect(source, isNot(contains('prefs.setBool(_key, true);\n          Navigator')));
+  });
+
+  test('unsupported server picker is not wired into app state', () {
+    final mainSource = File('lib/main.dart').readAsStringSync();
+    final statusBar = File('lib/components/status_bar.dart').readAsStringSync();
+
+    expect(mainSource, isNot(contains('ServerList')));
+    expect(statusBar, isNot(contains('SelectionScreen')));
+  });
+
+  test('session timer rejects stale session work by generation', () {
+    final source = File('lib/logic/session_timer.dart').readAsStringSync();
+
+    expect(source, contains('_sessionEpoch'));
+    expect(source, contains('Stopwatch'));
+    expect(source, contains("_doDisconnect('VPN entered error state')"));
+    expect(source, isNot(contains('_stopForVpnFailure')));
+  });
+}