@dailephd/my-dev-kit-lab 0.3.4 → 0.4.1

package/dist/src/mobile/android/validate/detectionAndImmutabilityCheckResults.js

@@ -0,0 +1,177 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 5 — the three required check families that no prior batch
+// produced an AndroidCheckResult for: project detection, manifest parsing
+// (as distinct from the audits that consume parsed manifests), and target
+// immutability evidence (agents.txt Batch 5 section 10.1).
+// ---------------------------------------------------------------------------
+export function buildAndroidDetectionCheckResult(detection) {
+    const sourcePaths = [...detection.gradleSettingsFiles, ...detection.rootBuildFiles].sort((a, b) => a.localeCompare(b));
+    if (detection.projectKind === "non-android") {
+        return {
+            id: "android-project-detection",
+            category: "android-detection",
+            title: "Android project detection",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: true,
+            skipInfo: {
+                checkId: "android-project-detection",
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-evidence",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Confirm the target is an Android Gradle project.",
+            },
+            evidence: detection.evidence,
+            findings: [],
+            warnings: detection.warnings,
+            errors: [],
+            sourcePaths,
+            confidence: detection.confidence,
+            environmentRequirements: [],
+        };
+    }
+    const isPartial = detection.projectKind === "partial" || detection.projectKind === "unknown" || detection.partialOrUnsupportedStructure;
+    return {
+        id: "android-project-detection",
+        category: "android-detection",
+        title: "Android project detection",
+        status: isPartial ? "inconclusive" : "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: detection.evidence,
+        findings: [],
+        warnings: detection.warnings,
+        errors: [],
+        sourcePaths,
+        confidence: detection.confidence,
+        environmentRequirements: [],
+    };
+}
+const MALFORMED_PREFIX = "Malformed XML:";
+export function buildAndroidManifestParsingCheckResult(detection, manifests) {
+    const sourcePaths = manifests.map((m) => m.manifestPath);
+    if (detection.projectKind === "non-android") {
+        return {
+            id: "android-manifest-parsing",
+            category: "android-manifest",
+            title: "Android manifest parsing",
+            status: "unsupported",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: true,
+            skipInfo: {
+                checkId: "android-manifest-parsing",
+                reason: "Target was not detected as an Android project.",
+                requirementLevel: "optional",
+                missingCapability: "android-detection",
+                verdictImpact: "does not apply to a non-Android target",
+                recommendedNextAction: "Confirm the target is an Android Gradle project.",
+            },
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    if (manifests.length === 0) {
+        return {
+            id: "android-manifest-parsing",
+            category: "android-manifest",
+            title: "Android manifest parsing",
+            status: "inconclusive",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence: [],
+            findings: [],
+            warnings: ["No AndroidManifest.xml was found for this target."],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const malformed = manifests.filter((m) => m.manifest.parseWarnings.some((w) => w.startsWith(MALFORMED_PREFIX)));
+    const allMalformed = malformed.length === manifests.length;
+    const warnings = manifests.flatMap((m) => m.manifest.parseWarnings);
+    if (allMalformed) {
+        return {
+            id: "android-manifest-parsing",
+            category: "android-manifest",
+            title: "Android manifest parsing",
+            status: "error",
+            requirementLevel: "required",
+            ran: true,
+            skipped: false,
+            evidence: [],
+            findings: [],
+            warnings,
+            errors: malformed.flatMap((m) => m.manifest.parseWarnings.filter((w) => w.startsWith(MALFORMED_PREFIX))),
+            sourcePaths,
+            confidence: "unknown",
+            environmentRequirements: [],
+        };
+    }
+    const confidence = malformed.length > 0 ? "medium" : "high";
+    return {
+        id: "android-manifest-parsing",
+        category: "android-manifest",
+        title: "Android manifest parsing",
+        status: "passed",
+        requirementLevel: "required",
+        ran: true,
+        skipped: false,
+        evidence: [`${manifests.length} manifest(s) parsed independently (not merged)`],
+        findings: [],
+        warnings,
+        errors: [],
+        sourcePaths,
+        confidence,
+        environmentRequirements: [],
+    };
+}
+export function buildAndroidTargetImmutabilityCheckResult(mutation) {
+    if (!mutation.comparable) {
+        return {
+            id: "android-target-immutability",
+            category: "android-target-immutability",
+            title: "Android target immutability",
+            status: "inconclusive",
+            requirementLevel: "optional",
+            ran: true,
+            skipped: false,
+            evidence: [],
+            findings: [],
+            warnings: [`Target mutation evidence unavailable: ${mutation.reason ?? "unknown reason"}`],
+            errors: [],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            targetModificationObserved: undefined,
+        };
+    }
+    const unexpected = mutation.unexpectedChanges.length > 0;
+    return {
+        id: "android-target-immutability",
+        category: "android-target-immutability",
+        title: "Android target immutability",
+        status: unexpected ? "failed" : "passed",
+        requirementLevel: "optional",
+        ran: true,
+        skipped: false,
+        evidence: mutation.expectedGeneratedChanges.map((p) => `generatedOutput=${p}`),
+        findings: [],
+        warnings: unexpected ? [`Unexpected target change(s): ${mutation.unexpectedChanges.join(", ")}`] : [],
+        errors: [],
+        sourcePaths: [],
+        confidence: "high",
+        environmentRequirements: [],
+        targetModificationObserved: unexpected,
+    };
+}

package/dist/src/mobile/android/validate/playReadinessChecklist.js

@@ -0,0 +1,145 @@
+// ---------------------------------------------------------------------------
+// v0.4.0 Batch 5 — bounded Play-readiness checklist placeholders (agents.txt
+// Batch 5 section 14).
+//
+// Informational and planning-oriented only. Never claims Google Play
+// approval, compliance, upload readiness, or publication readiness — no
+// network access, no live policy lookup. Manual/policy placeholder items are
+// always "manual-check-required" regardless of local evidence.
+// ---------------------------------------------------------------------------
+export const ANDROID_PLAY_READINESS_ITEM_STATUSES = [
+    "confirmed",
+    "missing",
+    "unresolved",
+    "manual-check-required",
+    "not-applicable",
+];
+const MANUAL_POLICY_ITEMS = [
+    { id: "privacy-policy-required", title: "Privacy policy", detail: "Privacy policy requirement must be assessed manually." },
+    { id: "play-data-safety-declaration", title: "Data Safety declaration", detail: "Google Play Data Safety declaration must be completed manually." },
+    {
+        id: "sensitive-permission-justification",
+        title: "Sensitive permission justification",
+        detail: "Sensitive or restricted permission declarations may require additional forms or justification.",
+    },
+    { id: "store-listing-content", title: "Store listing content", detail: "Store listing content must be prepared manually." },
+    { id: "release-notes", title: "Release notes", detail: "Release notes must be prepared." },
+    { id: "app-access-instructions", title: "App access instructions", detail: "App access instructions may be required." },
+    { id: "content-rating", title: "Content rating", detail: "Content rating must be completed." },
+    {
+        id: "target-audience-content-declarations",
+        title: "Target audience and content",
+        detail: "Target audience and content declarations must be completed.",
+    },
+    { id: "ads-declaration", title: "Ads declaration", detail: "Ads declaration may be required." },
+    {
+        id: "testing-track-account-requirements",
+        title: "Testing track and account requirements",
+        detail: "Testing-track and account requirements must be checked separately.",
+    },
+    {
+        id: "current-play-policy-review",
+        title: "Current Google Play policy review",
+        detail: "Current Google Play policies must be reviewed at publication time. This tool performs no live policy lookup.",
+    },
+];
+function itemsForLibrary() {
+    const applicationItemIds = [
+        "app-module-identified",
+        "application-id-resolved",
+        "namespace-resolved",
+        "version-code-resolved",
+        "version-name-resolved",
+        "min-sdk-resolved",
+        "target-sdk-resolved",
+        "compile-sdk-resolved",
+        "target-sdk-policy-check",
+        "launcher-activity-identified",
+        "application-label-present",
+        "application-icon-present",
+        "adaptive-round-icon-evidence",
+        "permissions-summary-available",
+    ];
+    const items = applicationItemIds.map((id) => ({
+        id,
+        title: id,
+        status: "not-applicable",
+        detail: "Google Play application readiness does not apply directly to a library artifact.",
+    }));
+    for (const policyItem of MANUAL_POLICY_ITEMS) {
+        items.push({ ...policyItem, status: "not-applicable" });
+    }
+    return items;
+}
+export function buildAndroidPlayReadinessChecklist(input) {
+    if (input.isNonAndroid) {
+        return {
+            applicable: false,
+            note: "This target was not detected as an Android project. Play-readiness checklist items are not applicable.",
+            items: itemsForLibrary().map((item) => ({ ...item, detail: "Target was not detected as an Android project." })),
+        };
+    }
+    if (input.isLibraryOnly) {
+        return {
+            applicable: false,
+            note: "This target is a pure Android library. Play-readiness checklist items are not applicable to a library artifact.",
+            items: itemsForLibrary(),
+        };
+    }
+    const { releaseMetadata, manifests } = input;
+    const hasLauncher = manifests.some((m) => Boolean(m.launcherActivityName));
+    const hasLabel = manifests.some((m) => Boolean(m.application.label));
+    const hasIcon = manifests.some((m) => Boolean(m.application.iconRef));
+    const hasAdaptiveIconEvidence = manifests.some((m) => Boolean(m.application.adaptiveIconEvidence));
+    const permissionsAvailable = manifests.length > 0;
+    const resolvedOrManual = (value, unresolvedFieldName) => {
+        if (value !== undefined && value !== null && value !== "")
+            return "confirmed";
+        const wasAttempted = releaseMetadata.unresolvedFields.some((f) => f.startsWith(`${unresolvedFieldName}:`));
+        return wasAttempted ? "unresolved" : "missing";
+    };
+    const items = [
+        {
+            id: "app-module-identified",
+            title: "Application module identified",
+            status: releaseMetadata.applicationModulePath ? "confirmed" : "missing",
+            detail: releaseMetadata.applicationModuleSelectionNote,
+        },
+        { id: "application-id-resolved", title: "applicationId resolved", status: resolvedOrManual(releaseMetadata.applicationId, "applicationId"), detail: releaseMetadata.applicationId ?? "Not statically resolved." },
+        { id: "namespace-resolved", title: "namespace resolved", status: resolvedOrManual(releaseMetadata.namespace, "namespace"), detail: releaseMetadata.namespace ?? "Not statically resolved." },
+        { id: "version-code-resolved", title: "versionCode resolved", status: resolvedOrManual(releaseMetadata.versionCode, "versionCode"), detail: String(releaseMetadata.versionCode ?? "Not statically resolved.") },
+        { id: "version-name-resolved", title: "versionName resolved", status: resolvedOrManual(releaseMetadata.versionName, "versionName"), detail: releaseMetadata.versionName ?? "Not statically resolved." },
+        { id: "min-sdk-resolved", title: "minSdk resolved", status: resolvedOrManual(releaseMetadata.minSdk, "minSdk"), detail: String(releaseMetadata.minSdk ?? "Not statically resolved.") },
+        { id: "target-sdk-resolved", title: "targetSdk resolved", status: resolvedOrManual(releaseMetadata.targetSdk, "targetSdk"), detail: String(releaseMetadata.targetSdk ?? "Not statically resolved.") },
+        { id: "compile-sdk-resolved", title: "compileSdk resolved", status: resolvedOrManual(releaseMetadata.compileSdk, "compileSdk"), detail: String(releaseMetadata.compileSdk ?? "Not statically resolved.") },
+        {
+            id: "target-sdk-policy-check",
+            title: "Current Google Play target SDK policy",
+            status: "manual-check-required",
+            detail: "Current Google Play target SDK policy must be checked separately — not evaluated by this tool.",
+        },
+        { id: "launcher-activity-identified", title: "Launcher activity identified", status: hasLauncher ? "confirmed" : "missing", detail: hasLauncher ? "Launcher activity found in a parsed manifest." : "No launcher activity evidence found." },
+        { id: "application-label-present", title: "Application label reference present", status: hasLabel ? "confirmed" : "missing", detail: hasLabel ? "android:label present." : "No android:label found on <application>." },
+        { id: "application-icon-present", title: "Application icon reference present", status: hasIcon ? "confirmed" : "missing", detail: hasIcon ? "android:icon present." : "No android:icon found on <application>." },
+        {
+            id: "adaptive-round-icon-evidence",
+            title: "Round/adaptive icon evidence",
+            status: hasAdaptiveIconEvidence ? "confirmed" : "unresolved",
+            detail: "Adaptive/round icon resources are not resolved by this tool; only direct manifest evidence, if any, is reflected here.",
+        },
+        {
+            id: "permissions-summary-available",
+            title: "Permissions summary available",
+            status: permissionsAvailable ? "confirmed" : "missing",
+            detail: "See the permissions audit section for the full declared-permission summary.",
+        },
+    ];
+    for (const policyItem of MANUAL_POLICY_ITEMS) {
+        items.push({ ...policyItem, status: "manual-check-required" });
+    }
+    return {
+        applicable: true,
+        note: "Bounded, local-evidence-only checklist. Confirms what static analysis found; every policy/manual item still requires human review before a Play Store submission. No live Google Play policy lookup was performed.",
+        items,
+    };
+}

package/dist/src/mobile/android/validate/validateAndroidTarget.js

@@ -0,0 +1,315 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveLocalProjectTarget } from "../../../core/localProjectTarget.js";
+import { detectAndroidProject } from "../detect/detectAndroidProject.js";
+import { createAndroidProfile } from "../profile.js";
+import { createAndroidTargetMetadata } from "../targetMetadata.js";
+import { parseAllAndroidManifests } from "../manifest/parseAndroidManifest.js";
+import { auditAndroidPermissions } from "../audit/permissionAudit.js";
+import { auditAndroidExportedComponents } from "../audit/exportedComponentAudit.js";
+import { auditAndroidIntentFilters } from "../audit/intentFilterAudit.js";
+import { auditAndroidDeepLinks } from "../audit/deepLinkAudit.js";
+import { readAndroidGradleMetadata } from "../gradle/readAndroidGradleMetadata.js";
+import { buildAndroidGradleMetadataCheckResult } from "../gradle/gradleMetadataCheckResult.js";
+import { buildAndroidReleaseMetadataSummary } from "../gradle/releaseMetadataSummary.js";
+import { runOptionalGradleValidation } from "../gradle/validate/runOptionalGradleValidation.js";
+import { captureTargetSnapshot, buildTargetMutationReport } from "../gradle/validate/targetMutation.js";
+import { buildAndroidPlayReadinessChecklist } from "./playReadinessChecklist.js";
+import { calculateAndroidVerdict } from "./androidVerdict.js";
+import { buildAndroidDetectionCheckResult, buildAndroidManifestParsingCheckResult, buildAndroidTargetImmutabilityCheckResult, } from "./detectionAndImmutabilityCheckResults.js";
+import { ANDROID_VALIDATION_ARTIFACT_TYPE, ANDROID_VALIDATION_SCHEMA_VERSION, } from "../validation/result.js";
+import { auditAndroidNetworkSecurity } from "../advancedSecurity/networkSecurity/checkResult.js";
+import { auditAndroidBackupConfiguration } from "../advancedSecurity/backupConfiguration/checkResult.js";
+import { auditAndroidReleaseConfiguration } from "../advancedSecurity/releaseConfiguration/checkResult.js";
+import { auditAndroidSecretCandidates } from "../advancedSecurity/secretCandidates/checkResult.js";
+import { auditAndroidSigningConfiguration } from "../advancedSecurity/signingConfiguration/checkResult.js";
+import { auditAndroidWebViewSecurity } from "../advancedSecurity/webview/checkResult.js";
+import { auditAndroidFileProviders } from "../advancedSecurity/fileProvider/checkResult.js";
+import { auditAndroidSensitiveStorage } from "../advancedSecurity/sensitiveStorage/checkResult.js";
+import { auditAndroidSensitiveLogging } from "../advancedSecurity/sensitiveLogging/checkResult.js";
+import { auditAndroidClipboardSecurity } from "../advancedSecurity/clipboard/checkResult.js";
+import { auditAndroidFirebaseGoogleServices } from "../advancedSecurity/firebaseGoogle/checkResult.js";
+import { runRequestedAndroidExternalTools } from "../advancedSecurity/externalTools/runRequestedAndroidExternalTools.js";
+import { createRealExternalToolExecutor } from "../advancedSecurity/externalTools/runBoundedExternalTool.js";
+import { createRealGradleCommandExecutor } from "../gradle/validate/executor.js";
+function runIsolatedCheck(descriptor) {
+    try {
+        return descriptor.run();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            id: descriptor.id,
+            category: descriptor.category,
+            title: descriptor.title,
+            status: "error",
+            requirementLevel: "optional",
+            ran: false,
+            skipped: false,
+            evidence: [],
+            findings: [],
+            warnings: [],
+            errors: [`Advanced check raised an unexpected error: ${message}`],
+            sourcePaths: [],
+            confidence: "unknown",
+            environmentRequirements: [],
+            candidateEvidence: [],
+        };
+    }
+}
+function buildAdvancedSecurityChecks(targetRoot, detection, manifestEntries, gradleModules) {
+    // Fixed order (agents.txt Batch 8 section 9.1) — never alphabetical, never
+    // derived from filesystem/object iteration.
+    const descriptors = [
+        { id: "android-network-security-audit", category: "android-network-security", title: "Android Network Security Config audit", run: () => auditAndroidNetworkSecurity(targetRoot, detection, manifestEntries) },
+        { id: "android-backup-configuration-audit", category: "android-backup-configuration", title: "Android backup configuration audit", run: () => auditAndroidBackupConfiguration(targetRoot, detection, manifestEntries) },
+        { id: "android-release-configuration-audit", category: "android-release-configuration", title: "Android release configuration audit", run: () => auditAndroidReleaseConfiguration(targetRoot, detection, manifestEntries, gradleModules) },
+        { id: "android-secret-candidates-audit", category: "android-secret-candidates", title: "Android hardcoded secret-candidate audit", run: () => auditAndroidSecretCandidates(targetRoot, detection) },
+        { id: "android-signing-configuration-audit", category: "android-signing-configuration", title: "Android signing configuration audit", run: () => auditAndroidSigningConfiguration(targetRoot, detection, gradleModules) },
+        { id: "android-webview-security-audit", category: "android-webview", title: "Android WebView security audit", run: () => auditAndroidWebViewSecurity(targetRoot, detection) },
+        { id: "android-file-provider-audit", category: "android-file-provider", title: "Android FileProvider security audit", run: () => auditAndroidFileProviders(targetRoot, detection, manifestEntries) },
+        { id: "android-sensitive-storage-audit", category: "android-sensitive-storage", title: "Android sensitive-storage audit", run: () => auditAndroidSensitiveStorage(targetRoot, detection) },
+        { id: "android-sensitive-logging-audit", category: "android-sensitive-logging", title: "Android sensitive-logging audit", run: () => auditAndroidSensitiveLogging(targetRoot, detection) },
+        { id: "android-clipboard-security-audit", category: "android-clipboard", title: "Android clipboard security audit", run: () => auditAndroidClipboardSecurity(targetRoot, detection) },
+        { id: "android-firebase-google-services-audit", category: "android-firebase-google-services", title: "Android Firebase/Google services audit", run: () => auditAndroidFirebaseGoogleServices(targetRoot, detection) },
+    ];
+    return descriptors.map(runIsolatedCheck);
+}
+// Memoizes by Gradle operation id: the fixed allowlist (operations.ts) maps
+// each operation id to fixed args, so within one validation run the same
+// operation id always means the same command — caching by id is safe and
+// prevents running `lintDebug` twice when both --android-gradle-operations
+// lint-debug and --android-external-tools android-lint are requested
+// together (agents.txt Batch 8 section 10.6).
+function createDedupingGradleExecutor(base) {
+    const cache = new Map();
+    return (plan) => {
+        const cached = cache.get(plan.operationId);
+        if (cached)
+            return cached;
+        const promise = base(plan);
+        cache.set(plan.operationId, promise);
+        return promise;
+    };
+}
+function readToolPackageMetadata(toolRoot) {
+    try {
+        const pkgRaw = fs.readFileSync(path.join(toolRoot, "package.json"), "utf8");
+        const pkg = JSON.parse(pkgRaw);
+        return { toolPackageName: pkg.name ?? "my-dev-kit-lab", toolPackageVersion: pkg.version ?? "unknown" };
+    }
+    catch {
+        return { toolPackageName: "my-dev-kit-lab", toolPackageVersion: "unknown" };
+    }
+}
+function hasGitDirectory(targetRoot) {
+    try {
+        return fs.existsSync(path.join(targetRoot, ".git"));
+    }
+    catch {
+        return false;
+    }
+}
+export async function validateAndroidTarget(options) {
+    const startedAt = new Date().toISOString();
+    const startedMs = Date.now();
+    // 1. Resolve the local target.
+    const local = resolveLocalProjectTarget(options.targetPath, options.toolRoot);
+    const resolvedTargetRoot = path.resolve(local.targetRoot);
+    const hasGit = local.hasGit || hasGitDirectory(resolvedTargetRoot);
+    // 2. Capture initial target snapshot (read-only).
+    const snapshotBefore = captureTargetSnapshot(resolvedTargetRoot, hasGit);
+    // 3. Detect and classify the Android project.
+    const detection = detectAndroidProject(resolvedTargetRoot);
+    // 5. Build Android target metadata / profile.
+    const androidProfile = createAndroidProfile({
+        detectionConfidence: detection.confidence,
+        evidence: detection.evidence,
+        unsupportedNotes: detection.warnings,
+        projectType: detection.projectKind,
+        projectSubtype: detection.uiToolkit,
+        supportedCapabilities: ["static-detection", "manifest-analysis", "gradle-metadata"],
+    });
+    const targetMetadata = createAndroidTargetMetadata({ local, androidProfile, detection });
+    // 6-7. Parse every discovered manifest independently (module/source-set
+    // association preserved by parseAllAndroidManifests itself).
+    const manifestEntries = parseAllAndroidManifests(resolvedTargetRoot, detection);
+    const manifests = manifestEntries.map((e) => e.manifest);
+    // 8-11. Four static audits — failure isolation: each returns its own
+    // AndroidCheckResult/findings independently of the others.
+    const permissionsCheck = auditAndroidPermissions(detection, manifestEntries);
+    const componentsCheck = auditAndroidExportedComponents(detection, manifestEntries);
+    const intentFiltersCheck = auditAndroidIntentFilters(detection, manifestEntries);
+    const deepLinksCheck = auditAndroidDeepLinks(detection, manifestEntries);
+    // 12-14. Static Gradle metadata + release metadata summary.
+    const gradle = readAndroidGradleMetadata(resolvedTargetRoot, detection);
+    const gradleMetadataCheck = buildAndroidGradleMetadataCheckResult(detection, gradle);
+    const releaseMetadata = buildAndroidReleaseMetadataSummary(detection, gradle);
+    // Detection + manifest-parsing checks (required families with no prior
+    // batch owner).
+    const detectionCheck = buildAndroidDetectionCheckResult(detection);
+    const manifestParsingCheck = buildAndroidManifestParsingCheckResult(detection, manifestEntries);
+    // Shared, deduping Gradle executor: reused for both --android-gradle-
+    // operations and (if android-lint is also externally requested) the
+    // Batch 7 Android Lint adapter, so `lintDebug` never runs twice for one
+    // validation run (agents.txt Batch 8 section 10.6).
+    const sharedGradleExecutor = createDedupingGradleExecutor(options.gradleExecutor ?? createRealGradleCommandExecutor());
+    // 15-16. Optional Gradle operations — never run unless explicitly requested.
+    const requestedOperationIds = options.requestedGradleOperationIds ?? [];
+    const gradleOperationResults = requestedOperationIds.length > 0
+        ? await runOptionalGradleValidation({
+            enabled: true,
+            targetRoot: resolvedTargetRoot,
+            detection,
+            operationIds: requestedOperationIds,
+            executor: sharedGradleExecutor,
+            allowWithoutTaskDiscovery: options.allowGradleWithoutTaskDiscovery,
+            platform: options.platform,
+        })
+        : [];
+    // v0.4.1 Batch 8 — eleven internal advanced Android checks, active by
+    // default (agents.txt Batch 8 section 9.1). Sequential, fixed order,
+    // isolated per-check via runIsolatedCheck. Never executes a process or
+    // touches the network.
+    const advancedSecurityChecks = buildAdvancedSecurityChecks(resolvedTargetRoot, detection, manifestEntries, gradle.modules);
+    // v0.4.1 Batch 8 — optional external-tool integration. Never executes
+    // unless requestedExternalToolIds is non-empty (same "no request, no
+    // execution" convention as Gradle operations). Wrapped in try/catch so a
+    // dispatcher-level failure (e.g. an unknown tool id slipping past CLI
+    // validation in a programmatic caller) cannot discard the checks already
+    // gathered above.
+    const requestedExternalToolIds = options.requestedExternalToolIds ?? [];
+    let externalToolChecks = [];
+    if (requestedExternalToolIds.length > 0) {
+        try {
+            externalToolChecks = await runRequestedAndroidExternalTools({
+                request: {
+                    requestedTools: requestedExternalToolIds,
+                    targetRoot: resolvedTargetRoot,
+                    artifactRoot: options.externalToolArtifactRoot ?? path.join(options.toolRoot, "reports", "security", "external-tools"),
+                    networkPolicy: options.externalNetworkPolicy ?? "deny",
+                },
+                detection,
+                executors: {
+                    semgrep: options.externalToolExecutors?.semgrep ?? createRealExternalToolExecutor(),
+                    osv: options.externalToolExecutors?.osv ?? createRealExternalToolExecutor(),
+                    androidLint: options.externalToolExecutors?.androidLint ?? sharedGradleExecutor,
+                    dependencyCheck: options.externalToolExecutors?.dependencyCheck ?? createRealExternalToolExecutor(),
+                },
+                discover: options.externalToolDiscover,
+                javaAvailable: options.javaAvailable,
+                lintTaskAvailable: options.lintTaskAvailable,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            externalToolChecks = [
+                {
+                    id: "android-external-tools-dispatch",
+                    category: "android-semgrep",
+                    title: "External security-tool dispatch",
+                    status: "error",
+                    requirementLevel: "optional",
+                    ran: false,
+                    skipped: false,
+                    evidence: [],
+                    findings: [],
+                    warnings: [],
+                    errors: [`External-tool dispatch raised an unexpected error: ${message}`],
+                    sourcePaths: [],
+                    confidence: "unknown",
+                    environmentRequirements: [],
+                    candidateEvidence: [],
+                },
+            ];
+        }
+    }
+    // 17. Target mutation evidence — captured after every process this run may
+    // have executed (Gradle operations, advanced checks, and external tools),
+    // so the static-only path also proves it made no changes.
+    const snapshotAfter = captureTargetSnapshot(resolvedTargetRoot, hasGit);
+    const targetMutation = buildTargetMutationReport(snapshotBefore, snapshotAfter);
+    const immutabilityCheck = buildAndroidTargetImmutabilityCheckResult(targetMutation);
+    // 18. Assemble checks/findings in deterministic order (agents.txt Batch 8
+    // section 11.1): the existing v0.4.0 check order is preserved exactly
+    // (ending with immutabilityCheck, as before), and the eleven advanced
+    // checks and any requested external tools are APPENDED after it — never
+    // interleaved into the existing order.
+    const checks = [
+        detectionCheck,
+        manifestParsingCheck,
+        permissionsCheck,
+        componentsCheck,
+        intentFiltersCheck,
+        deepLinksCheck,
+        gradleMetadataCheck,
+        ...gradleOperationResults,
+        immutabilityCheck,
+        ...advancedSecurityChecks,
+        ...externalToolChecks,
+    ];
+    const findingsById = new Map();
+    for (const check of checks) {
+        for (const finding of check.findings) {
+            // Exact-duplicate dedupe by id only (agents.txt section 10.4) —
+            // distinct manifests/components/permissions/deep-links always produce
+            // distinct ids (see androidFinding.ts's content-derived id builder),
+            // so this never collapses genuinely different evidence.
+            if (!findingsById.has(finding.id)) {
+                findingsById.set(finding.id, finding);
+            }
+        }
+    }
+    const findings = [...findingsById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    const skippedChecks = checks.flatMap((c) => (c.skipInfo ? [c.skipInfo] : []));
+    const warnings = checks.flatMap((c) => c.warnings);
+    const errors = checks.flatMap((c) => c.errors);
+    const environmentLimitations = [...new Set(checks.flatMap((c) => c.environmentRequirements))];
+    // 19. Play-readiness checklist placeholders.
+    const isLibraryOnly = detection.projectKind === "library";
+    const isNonAndroid = detection.projectKind === "non-android";
+    const playReadiness = buildAndroidPlayReadinessChecklist({ isLibraryOnly, isNonAndroid, releaseMetadata, manifests });
+    // 20. Verdict.
+    const multipleApplicationModules = detection.applicationModules.length > 1;
+    const { verdict, recommendedNextStep, reasons } = calculateAndroidVerdict({
+        checks,
+        findings,
+        detection,
+        playReadiness,
+        targetMutation,
+        multipleApplicationModules,
+    });
+    const finishedAt = new Date().toISOString();
+    const durationMs = Date.now() - startedMs;
+    const { toolPackageName, toolPackageVersion } = readToolPackageMetadata(options.toolRoot);
+    return {
+        schemaVersion: ANDROID_VALIDATION_SCHEMA_VERSION,
+        artifactType: ANDROID_VALIDATION_ARTIFACT_TYPE,
+        tool: { toolRoot: path.resolve(options.toolRoot), toolPackageName, toolPackageVersion },
+        target: targetMetadata,
+        profile: androidProfile,
+        detection,
+        manifests,
+        gradle,
+        checks,
+        findings,
+        skippedChecks,
+        warnings,
+        errors,
+        releaseMetadataSummary: {
+            available: Boolean(releaseMetadata.applicationModulePath),
+            note: releaseMetadata.applicationModuleSelectionNote,
+        },
+        releaseMetadata,
+        playReadinessSummary: { available: playReadiness.applicable, note: playReadiness.note },
+        playReadiness,
+        verdict,
+        verdictReasons: reasons,
+        recommendedNextStep,
+        targetMutationEvidence: targetMutation,
+        reportReferences: [],
+        startedAt,
+        finishedAt,
+        durationMs,
+    };
+}