docs(android): record trusted-devices app implementation in PLAN §4.1.1 #33

wtclaude · 2026-07-22T05:43:31Z

wtclaude commented

2026-07-22 05:43:31 +00:00

What & why

Keeps docs/ in sync with the app implementation (code PR: RunicGateway/Android-app#23). Updates android/PLAN.md §4.1.1 from "backend ready, sequenced after" to implemented, and records two deliberate design decisions made during the build:

The trust token deliberately survives logout — the native analogue of the web rg_trust cookie. It's only consulted at a fresh login (exactly after a logout / dead-refresh sign-out), so clearing it on logout would make the feature a no-op. Kept in a separate, username-scoped encrypted store, untouched by session teardown; cleared only on a Settings → Server switch, untrust-all, or server-side revocation. This supersedes the earlier handoff note that said clear-on-logout.
The login-time trust cap is surfaced + resolved on the Trusted Devices screen rather than a blocking login modal, because native login already issued the session.

Also fills in the implemented specifics: device_name at login, the dedicated runic_trust store, the account-screen Security section with the two dedicated screens, and the show-once recovery-code display.

How it was tested

Markdown only — proofread; endpoint / field names cross-checked against the merged backend and the app PR.

Checklist

I have read CONTRIBUTING.md.
The change builds and existing checks pass locally.
I have added or updated docs where it makes sense.
My commits are reasonably scoped with clear messages.

AI-assisted contributions (required)

AI tools were used. Tool(s): Claude Code (Opus 4.8). I have reviewed and understand every change, and take responsibility for it. AI-authored commits carry a Co-Authored-By trailer.

License

I agree my contribution is licensed under this project's license (GNU GPL v3.0 or later).

🤖 Generated with Claude Code

https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

## What & why Keeps `docs/` in sync with the app implementation (code PR: RunicGateway/Android-app#23). Updates `android/PLAN.md §4.1.1` from "backend ready, sequenced after" to **implemented**, and records two deliberate design decisions made during the build: 1. **The trust token deliberately survives logout** — the native analogue of the web `rg_trust` cookie. It's only consulted at a fresh login (exactly after a logout / dead-refresh sign-out), so clearing it on logout would make the feature a no-op. Kept in a separate, username-scoped encrypted store, untouched by session teardown; cleared only on a Settings → Server switch, untrust-all, or server-side revocation. **This supersedes the earlier handoff note that said clear-on-logout.** 2. **The login-time trust cap** is surfaced + resolved on the Trusted Devices screen rather than a blocking login modal, because native login already issued the session. Also fills in the implemented specifics: `device_name` at login, the dedicated `runic_trust` store, the account-screen Security section with the two dedicated screens, and the show-once recovery-code display. ## How it was tested Markdown only — proofread; endpoint / field names cross-checked against the merged backend and the app PR. ## Checklist - [x] I have read CONTRIBUTING.md. - [x] The change builds and existing checks pass locally. - [x] I have added or updated docs where it makes sense. - [x] My commits are reasonably scoped with clear messages. ## AI-assisted contributions (required) - [x] AI tools were used. Tool(s): `Claude Code (Opus 4.8)`. I have reviewed and understand every change, and take responsibility for it. AI-authored commits carry a `Co-Authored-By` trailer. ## License - [x] I agree my contribution is licensed under this project's license (**GNU GPL v3.0 or later**). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

wtclaude added 1 commit 2026-07-22 05:43:33 +00:00

@ db983fbb8f

docs(android): record trusted-devices app implementation in PLAN §4.1.1

Marks §4.1.1 implemented (app PR RunicGateway/Android-app
feature/trusted-devices-mfa) and captures two deliberate design
decisions from the build:

- The trust token DELIBERATELY SURVIVES logout (native analogue of the
  rg_trust cookie): it is only consulted at a fresh login, so clearing
  it on logout would make the feature a no-op. Kept in a separate,
  username-scoped encrypted store; cleared only on Settings→Server
  switch, untrust-all, or server-side revocation. Supersedes the earlier
  handoff note.
- The login-time trust cap is surfaced + resolved on the Trusted Devices
  screen rather than a blocking login modal, since native login already
  issued the session.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr
@

whitlocktech approved these changes 2026-07-22 06:05:24 +00:00

whitlocktech merged commit b64b310d67 into main

2026-07-22 06:05:30 +00:00

whitlocktech deleted branch docs/trusted-devices-mfa-app

2026-07-22 06:05:30 +00:00

whitlocktech referenced this issue from a commit

2026-07-22 06:05:31 +00:00

Merge pull request 'docs(android): record trusted-devices app implementation in PLAN §4.1.1' (#33) from docs/trusted-devices-mfa-app into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/docs#33