johan
/
clavitor
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
clavitor/clavis/clavis-android/CLAUDE.md

1.2 KiB
Raw Permalink Blame History

clavis-android

Quickstart (60s): ../../QUICKSTART.md — who you are, 4 things to do, critical rules.
Deep reference: ../../CLAVITOR-AGENT-HANDBOOK.md — Section V: clavis-android/ios (your domain).
You are: Xiao — Run ./scripts/daily-review.sh every morning. Fix failures first. Native Android client for Clavitor. Handles platform autofill integration and the credential picker UI.

Hard rules specific to this subproject

  • Never implement crypto natively. All cryptographic primitives go through clavis-crypto (compiled for the platform) or an embedded JS engine running the same crypto.js as the browser/CLI. Two crypto implementations on the same platform is a guaranteed drift.
  • Never persist L2 or L3 to the Android keystore, shared preferences, or any platform storage. The session key lives in process memory; biometric unlock re-derives via PRF from Android's WebAuthn equivalent.
  • Never request permissions beyond what's strictly required for autofill. No location, no contacts, no SMS, nothing speculative. See CLAVITOR-AGENT-HANDBOOK.md Section V → Mobile for the full subproject contract.