Current release: v0.4.0

• AMT Action Journal (new opt-in feature) — new amt_action_event table (Room v7 → v8, strictly additive CREATE TABLE + 3 CREATE INDEX IF NOT EXISTS). Records every destructive / state-changing action AMT itself dispatches (uninstall, force-stop, disable/enable, clear cache/data, move-to-trash, restore, quarantine HARD/SOFT). Distinct boundary from app_lifecycle_event which logs OS broadcasts from ANY installer ; this surface answers "what did AMT do on my behalf" for forensic post-mortems.
• Privacy model: opt-in default OFF, retention 30–365 days (clamped on read AND write), Room private DB excluded from cloud backup. Never leaves the device, no INTERNET permission, no GMS, no proprietary dependency. The AmtActionLogger shims every call site through a single AtomicBoolean gate fed by a distinctUntilChanged collector — zero DataStore IPC at hot path when the journal is OFF.
• Defence-in-depth on the journal write path — validation isValidPackageName() at both the RecordAmtActionUseCase entrance AND the AmtActionRepositoryImpl.insert entrance (double-gate). toDomainOrNull mapping silently drops rows whose enum values the running build does not recognise (downgrade tolerance ; the row stays on disk for a future re-upgrade — never silently mutated). Append-only by design : the DAO exposes only insert, purgeOlderThan, count, deleteAll — no UPDATE path whatsoever, audit trail stays monotonic.
• Defence-in-depth on the worker scheduling — AmtActionJournalPurgeWorker mirrors LifecyclePurgeWorker exactly : 2-min withTimeout cap, if (!enabled) Result.success() guard re-read from DataStore on every tick (so a stale scheduled instance cannot leak rows after the user opts out). applyAmtActionJournalScheduling(enabled = false) cancels the unique work outright. Cold-start re-sync from MainApplication.syncBackgroundWorkers recovers from device reboot / OEM aggressive killer.
• Audit fixes shipped together (v0.3.4 deferred + v0.4.0 audit) :
  • HashUtils.kt extracted (core/ext/) — single source of truth for SHA-256 digest helpers (cert fingerprint format + content-hash format + APK streamed file hash). Two prior private implementations now delegate ; the APK policy (canonical resolve + install-root whitelist + 500 MB cap) stays at the call site.
  • @IoDispatcher injected across 9 ViewModels + 2 data-layer classes that previously used Dispatchers.IO hardcoded (StorageVM, ExpertVM, AppDetailVM, AppListVM, RarelyUsedVM, ZombiesVM, SmartCleanerVM, TrashRepositoryImpl, ApkBackupManager). Zero Dispatchers.IO hardcoded remain in the codebase — uniform testability + dispatcher discipline.
  • Every hasUsageStatsAccess() AppOps IPC call is now off the main thread (4 ViewModels migrated from synchronous constructor call → viewModelScope.launch { withContext(io) { … } }). No more jank potential on slow OEM AppOps binder.
  • FilterChip parity across every filter-row surface (LifecycleHistory + PermissionDrift WindowPickers switched from semantically-wrong AssistChip).
  • Smart Cleaner + Security Audit uninstall paths now feed the Action Journal (audit D2 — coverage was incomplete).
  • applyLifecyclePurgeScheduling added to syncBackgroundWorkers cold-start path (audit D3 — symmetry with the new action journal scheduling).
• No new permission, no new dependency, no INTERNET, no GMS.
• Room schema v7 → v8 (single ALTER + 3 indices, strict additive).
• Cert SHA-256 stable (76:E8:77...60FF1CF) since v0.1.0.

• Multi-tag refactor (DataStore wire format) — AppSettings.appTags widens from Map<String, AppTag> to Map<String, Set<AppTag>>. Encoded as a stringSetPreferencesKey of pkg=TAG1|TAG2|… entries (the | separator is invalid inside an AppTag.name, so the encoding is unambiguous). Decoder is tolerant + defence-in-depth : malformed entries are silently dropped, unknown enum names are skipped, the per-entry tag arity is capped at MAX_TAG_ARITY_PER_ENTRY = 8 (a tampered DataStore feeding pkg=WORK|WORK|…|WORK × 10 000 is bounded), and the pkg key is validated via isValidPackageName() for read-path symmetry with the existing setAppTags(pkg, Set) write-path. Backward-compatible with the v0.3.3 single-tag format (a suffix without | deserialises as a one-element Set), so an upgrade preserves every existing tag.
• APK SHA-256 forensics on Lifecycle events — new apk_sha256 column on app_lifecycle_event (Room v7, ALTER TABLE ADD COLUMN TEXT NULLable). RecordLifecycleEventUseCase.computeApkSha256 reads the base APK at ApplicationInfo.sourceDir, hashes it with MessageDigest.getInstance("SHA-256") streamed at 64 KB, and stores the hex digest on INSTALLED / REPLACED / BASELINE rows. UNINSTALLED rows leave the hash NULL (the APK is gone by the time the broadcast fires). Defence-in-depth on every failure path :
  • canonicalFile resolves symlinks BEFORE the read so a hostile link is caught by the prefix check rather than being followed.
  • Whitelist of canonical install roots (/data/app/, /system/app/, /system/priv-app/, /product/app/, /vendor/app/) — stock AOSP sourceDir is trustworthy, but root/MOD ROMs can lie; the prefix check fences off the worst cases (/dev/urandom via symlink).
  • 500 MB hard cap on the APK size we hash — above this we log + skip the hash rather than monopolise the IO pool for tens of seconds. The lifecycle row still inserts with apkSha256 = null so the audit trail is never lost.
  • IO / Security exceptions swallowed + Timber-logged (no PII in the log message — only the canonical path). Tamper detection lives entirely in the UI layer (computeTamperedIds, pure O(n log n) remember(events)) — no extra Room query, no background work, no IPC.
• Tag filter on AppList — AppListViewModel injects the existing SettingsRepository (no new permission, no new IPC). Filter is a pure in-memory post-filter on the existing getInstalledApps flow ; chip toggles do NOT re-subscribe to the heavy Room query.
• TagPickerDialog double-toggle hardening — Checkbox now passes onCheckedChange = null so the parent Row.toggleable is the single source of click handling. role = Role.Checkbox set on the Row for TalkBack semantics. Prevents the double-toggle no-op that could surface on some Compose versions.
• No new permission, no new dependency, no INTERNET, no GMS.
• Room schema v6 → v7 (single ALTER TABLE ADD COLUMN, NULLable).
• Cert SHA-256 stable (76:E8:77...60FF1CF) since v0.1.0.

• Signature clusters : reuses the existing getSignatureSha256(pkg) PM call already shipped since v0.1.0 — no new permission, no new IPC surface. Renders read-only — tapping an app drills down to AppDetail (no destructive action accessible from the new screen).
• Custom user tags : new AppSettings.appTags Map<pkg, AppTag> persisted in DataStore as a Set<String> of pkg=ENUM_NAME entries. Decoding is tolerant — malformed / unknown entries silently dropped. Tags are device-local only ; no network, no GMS.
• No new permission, no new dependency, no INTERNET, no GMS.
• Room schema unchanged (still v6).
• Cert SHA-256 stable (76:E8:77...60FF1CF) since v0.1.0.

• OS hibernation read — UsageStatsManager.isAppInactive(pkg) (API 23+). Requires PACKAGE_USAGE_STATS (already declared since v0.1.0 for the storage / usage features). Defensive against SecurityException and IllegalArgumentException — both fall back to false rather than poisoning the scan.
• Permission delta on REPLACED events — DetectPermissionDeltaUseCase compares the granted-dangerous-perms snapshot of a REPLACED lifecycle event against the closest preceding baseline (BASELINE/INSTALLED/ earlier REPLACED). Surfaces supply-chain creep signal in the LifecycleHistoryScreen row. Pure domain — no Android dep, no new I/O.
• Lifecycle journal in PDF — capped to 200 entries (defensive PDF size cap). The full history stays in-app via LifecycleHistoryScreen. Same SAF destination as the v0.2.2 PDF export — no MANAGE_EXTERNAL_STORAGE.
• Room schema v6 — strict-additive ALTER TABLE ADD COLUMN is_hibernated INTEGER NOT NULL DEFAULT 0. Pre-existing rows read 0 (false) via DEFAULT; the next scan repopulates the real OS state. MigrationTest_v5_v6 ships.
• No new permission, no new dependency, no INTERNET, no GMS.
• Cert SHA-256 stable (76:E8:77...60FF1CF) since v0.1.0.

• Safety Guardrails extended — the hold-3s CriticalWarningDialog now also gates disable (AppDetail), uninstallNow + emptyTrash (Trash), and uninstall (SmartCleaner). Same threat model as v0.2.0 Phase A (uninstall + quarantine HARD) — protection against accidental destructive action on a 2FA / banking / password-manager app.
• User-customisable whitelist — safety.userProtectedPackages set persisted in DataStore + reactive AtomicReference cache in CriticalAppDetector so classify(packageName) stays synchronous on the ViewModel hot path. Capped at 200 entries (defensive — same intent as the ignore-list cap).
• ProtectedAppsScreen + companion picker — read-only sections per built-in CriticalCategory (full transparency: the user sees exactly which apps AMT ships hardcoded) + editable user-added list with explicit-tap removal (no swipe, dialog confirmation).
• No new permission, no new dependency. The picker reuses appInfoRepository.observeApps(includeSystemApps=false) — the same authorised reads as the rest of the app.
• Cert SHA-256 stable (76:E8:77...60FF1CF) since v0.1.0.

• PackageMonitor BroadcastReceiver — runtime-registered (NOT manifest), gated by lifecycle.enabled. Idempotent register/unregister via AtomicBoolean. The receiver is registered with RECEIVER_NOT_EXPORTED (broadcasts are system-only on Android 8+, the flag is required on API 33+). Defence-in-depth: isValidPackageName() validation of the broadcast's data.schemeSpecificPart before any DB write.
• Append-only Room v5 log — app_lifecycle_event table. Insert is the only mutation, except setReasonForId(id, reason) which carries an explicit narrow WHERE id = :id to keep the audit trail monotonic.
• No data egress — no new INTERNET permission, no GMS, no FCM. The Lifecycle History DB lives in the app's private files dir and is excluded from cloud backup via the existing backup_rules.xml.
• Retention — clamped [30, 365] days in the picker; the LifecyclePurgeWorker cancels itself when the master toggle is OFF so no background work survives the feature being disabled.
• Self-exclusion — the receiver ignores events for App Manager Tech itself (self-updates would otherwise pollute the timeline).
• Cert SHA-256 stable (76:E8:77...60FF1CF) since v0.1.0.

• Mode Expert: read-only inspection of internal components (activities, services, receivers, providers + exported flag, declared permissions + grant state + dangerous-protection flag, signature SHA-256
  • debug-keystore detection via X.509 Subject DN, UID, SDK envelope, ABI, APK paths / splits, curated AppOps probed via AppOpsManager.unsafeCheckOpNoThrow). Strictly read-only — no PackageManager mutation, no app-op rewrite, no component enable/disable (those require ADB, Shizuku or root and are intentionally out of scope for an F-Droid release).
• PDF diagnostic export: built via android.graphics.pdf.PdfDocument (native AOSP, API 19+), 0 external dependency. Output stream is the user-picked SAF Uri — no MANAGE_EXTERNAL_STORAGE. Report contents never include APK Manager's own runtime state, only what we read from the OS surface (PackageManager, StorageStatsManager, UsageStatsManager, DevicePolicyManager, AccessibilityManager).
• No new permission declared in the manifest. No new dependency added.
• Same threat-model envelope as v0.2.1.

This fingerprint must remain stable across releases — verify before publishing each new GitHub release that the SHA-256 matches the previous one. F-Droid's reproducible-build pipeline pins to this fingerprint via the AllowedAPKSigningKeys field of the metadata yml.

App Manager Tech reads installed package metadata, storage statistics and usage timestamps from the Android OS. It does not transmit any data off-device — no INTERNET permission is declared, the OS itself enforces this.

Primary threats and mitigations:

None. App Manager Tech performs no cryptographic operations: no encrypted storage (the Room DB is private app-data, protected by Android sandboxing), no PIN-lock, no message signing, no network = no TLS.

If a future release adds a PIN-locked view, it will use Android Keystore + Tink AEAD (AES-256-GCM). No home-grown crypto.

• System-partition modification
• Root / ADB operations
• Network access (no internet permission, not planned)
• Access to other apps' private data directories

Security disclosure: contact@files-tech.com

Please include:

• Android version and device model
• App version (shown in Settings > About)
• Reproducible steps
• Perceived impact

We target a 72-hour initial response for credible vulnerability reports.