@rosetears/aili-pi 0.1.0

package/skills/android-native-dev/references/motion-system.md

@@ -0,0 +1,203 @@
+# Motion System Guidelines
+
+Animation and transition specifications for Material Design 3.
+
+## Motion Principles
+
+### Four Core Characteristics
+
+| Principle | Description |
+|-----------|-------------|
+| **Responsive** | Quickly responds to user input at the point of interaction |
+| **Natural** | Follows real-world physics (gravity, friction, momentum) |
+| **Aware** | Elements are aware of surroundings and other elements |
+| **Intentional** | Guides focus to the right place at the right time |
+
+## Duration Guidelines
+
+### By Interaction Type
+
+| Type | Duration | Usage |
+|------|----------|-------|
+| Micro | 50-100ms | Ripples, state changes, hover |
+| Short | 100-200ms | Simple transitions, toggles |
+| Medium | 200-300ms | Expanding, collapsing, revealing |
+| Long | 300-500ms | Complex choreography, page transitions |
+
+### By Device Type
+
+| Device | Typical Duration | Adjustment |
+|--------|------------------|------------|
+| Mobile | 300ms | Baseline |
+| Tablet | 390ms | +30% slower |
+| Desktop | 150-200ms | Faster, more responsive |
+| Wearable | 210ms | -30% faster |
+
+### Duration Rules
+
+- **Maximum**: Keep under 400ms for most transitions
+- **User-initiated**: Faster (closer to instant feedback)
+- **System-initiated**: Can be slightly longer
+- **Loading states**: Use indeterminate indicators for unknown duration
+
+## Easing Curves
+
+### Standard Curves
+
+| Curve | Usage | Characteristics |
+|-------|-------|-----------------|
+| **Standard** | Most common transitions | Quick acceleration, slow deceleration |
+| **Emphasized** | Important/significant transitions | More dramatic curve |
+| **Decelerate** | Elements entering screen | Starts fast, ends slow |
+| **Accelerate** | Elements leaving screen permanently | Starts slow, ends fast |
+| **Sharp** | Elements temporarily leaving | Quick, snappy motion |
+
+### Curve Values (Cubic Bezier)
+
+| Curve | Value |
+|-------|-------|
+| Standard | cubic-bezier(0.2, 0.0, 0.0, 1.0) |
+| Emphasized | cubic-bezier(0.2, 0.0, 0.0, 1.0) |
+| Decelerate | cubic-bezier(0.0, 0.0, 0.0, 1.0) |
+| Accelerate | cubic-bezier(0.3, 0.0, 1.0, 1.0) |
+
+## Movement Patterns
+
+### Arc Motion
+
+- Use natural, concave arcs for diagonal movement
+- Single-axis movement (horizontal/vertical only) stays straight
+- Elements entering/exiting screen move on single axis
+
+### Choreography
+
+- **Stagger**: Offset timing for related elements (20-40ms between)
+- **Cascade**: Sequential reveal from a focal point
+- **Shared motion**: Elements that move together maintain relationship
+
+## Transition Patterns
+
+### Container Transform
+
+Best for: Navigation from card/list item to detail screen
+
+- Origin container morphs into destination
+- Maintains visual continuity
+- Content fades during transformation
+
+### Shared Axis
+
+Best for: Same-level navigation (tabs, stepper)
+
+| Axis | Direction | Usage |
+|------|-----------|-------|
+| X-axis | Horizontal | Tabs, horizontal paging |
+| Y-axis | Vertical | Vertical lists, feeds |
+| Z-axis | Depth | Parent-child relationships |
+
+### Fade Through
+
+Best for: Unrelated screen transitions
+
+- Outgoing content fades out
+- Incoming content fades in
+- Brief overlap period
+- No shared elements
+
+### Fade
+
+Best for: Show/hide single elements
+
+- Simple opacity change
+- Optionally combine with scale
+- Quick duration (100-200ms)
+
+## Component-Specific Motion
+
+### FAB
+
+| State | Animation |
+|-------|-----------|
+| Appear | Scale up + fade in |
+| Disappear | Scale down + fade out |
+| Transform | Morph to extended FAB |
+| Press | Elevation change (3dp → 8dp) |
+
+### Bottom Sheet
+
+| State | Animation |
+|-------|-----------|
+| Expand | Slide up with decelerate curve |
+| Collapse | Slide down with accelerate curve |
+| Dismiss | Swipe down with velocity-based duration |
+
+### Navigation
+
+| Pattern | Animation |
+|---------|-----------|
+| Push | Incoming slides from right, outgoing shifts left |
+| Pop | Incoming slides from left, outgoing shifts right |
+| Modal | Slide up from bottom |
+
+### Cards
+
+| State | Animation |
+|-------|-----------|
+| Expand | Container transform to detail |
+| Press | Subtle elevation increase |
+| Reorder | Follow finger with physics |
+
+## Loading & Progress
+
+### Indeterminate Indicators
+
+- Use for unknown duration
+- Continuous, looping animation
+- M3 Expressive: Customizable waveform and thickness
+
+### Determinate Indicators
+
+- Use when progress is measurable
+- Smooth, linear progression
+- Update frequently for responsiveness
+
+### Skeleton Screens
+
+- Show layout structure immediately
+- Subtle shimmer animation
+- Replace with content as it loads
+
+## Accessibility Considerations
+
+### Reduced Motion
+
+- Respect prefers-reduced-motion setting
+- Provide alternatives:
+  - Instant transitions (no animation)
+  - Simple fade instead of complex motion
+  - Static loading indicators
+
+### Motion Duration
+
+- Keep essential feedback < 100ms
+- Avoid motion that could trigger vestibular issues
+- Test with motion sensitivity settings enabled
+
+## Implementation Notes
+
+### Android Animation APIs
+
+| API | Usage |
+|-----|-------|
+| MotionLayout | Complex, coordinated animations |
+| Transition | Activity/Fragment transitions |
+| Animator | Property animations |
+| AnimatedContent | Compose content transitions |
+| animateContentSize | Compose size changes |
+
+### Performance Tips
+
+- Use hardware layers for complex animations
+- Avoid animating layout properties (use transform)
+- Profile with GPU rendering tools
+- Target 60 FPS (16ms per frame)

package/skills/android-native-dev/references/performance-stability.md

@@ -0,0 +1,223 @@
+# Performance & Stability Guidelines
+
+Android Vitals thresholds, performance requirements, and stability best practices.
+
+## Android Vitals Thresholds
+
+### Core Metrics (Google Play)
+
+Exceeding these thresholds affects app visibility on Google Play:
+
+| Metric | Overall Threshold | Per Phone Model | Per Watch Model |
+|--------|-------------------|-----------------|-----------------|
+| User-perceived crash rate | **1.09%** | 8% | 4% |
+| User-perceived ANR rate | **0.47%** | 8% | 5% |
+| Excessive battery usage | 1% | - | 1% |
+| Excessive wake locks | 5% | - | - |
+
+### Consequences of Exceeding Thresholds
+
+- Reduced app visibility in Google Play
+- Warning label on store listing
+- Lower ranking in search results
+- Negative impact on user trust
+
+## Startup Performance
+
+### Requirements
+
+| Metric | Target | Maximum |
+|--------|--------|---------|
+| Cold start | < 1 second | 2 seconds |
+| Warm start | < 500ms | 1 second |
+| Hot start | < 100ms | 500ms |
+
+### If Startup Exceeds 2 Seconds
+
+Must provide visual feedback:
+- Progress indicator
+- Splash screen with animation
+- Loading skeleton
+
+### Optimization Techniques
+
+| Technique | Impact |
+|-----------|--------|
+| Lazy initialization | Defer non-critical work |
+| Async loading | Move I/O off main thread |
+| View hierarchy optimization | Reduce layout depth |
+| App Startup library | Initialize components efficiently |
+| Baseline Profiles | Pre-compile hot paths |
+
+## Rendering Performance
+
+### Frame Rate Requirements
+
+| Target | Frame Time | Notes |
+|--------|------------|-------|
+| 60 FPS | ≤ 16.67ms | Standard requirement |
+| 90 FPS | ≤ 11.11ms | High refresh rate displays |
+| 120 FPS | ≤ 8.33ms | Premium devices |
+
+### Jank Detection
+
+| Metric | Threshold | Severity |
+|--------|-----------|----------|
+| Slow frames | > 16ms | Warning |
+| Frozen frames | > 700ms | Critical |
+| Jank rate | > 1% of frames | Poor experience |
+
+### Common Rendering Issues
+
+| Issue | Cause | Solution |
+|-------|-------|----------|
+| Overdraw | Multiple layers drawn | Reduce background stacking |
+| Deep hierarchy | Complex view nesting | Use ConstraintLayout, Compose |
+| Main thread work | Blocking operations | Move to background thread |
+| Large bitmaps | Unoptimized images | Downsample, use vector |
+
+## ANR Prevention
+
+### ANR Triggers
+
+| Scenario | Timeout |
+|----------|---------|
+| Input dispatch | 5 seconds |
+| Broadcast receiver | 10 seconds |
+| Service start | 20 seconds |
+
+### Prevention Strategies
+
+- Never perform network calls on main thread
+- Never perform database operations on main thread
+- Never perform file I/O on main thread
+- Use coroutines, RxJava, or other async mechanisms
+- Reduce synchronized block contention
+
+### Common ANR Causes
+
+| Cause | Solution |
+|-------|----------|
+| Network on main thread | Use coroutines/RxJava |
+| Database on main thread | Use Room with suspend |
+| File I/O on main thread | Use Dispatchers.IO |
+| Lock contention | Reduce synchronized blocks |
+| Dead locks | Careful threading design |
+
+## Battery Optimization
+
+### Wake Lock Guidelines
+
+| Rule | Implementation |
+|------|----------------|
+| Minimize duration | Release as soon as possible |
+| Use appropriate type | PARTIAL_WAKE_LOCK only when needed |
+| Always release | Use try-finally or lifecycle |
+| Prefer WorkManager | System-managed scheduling |
+
+### Background Restrictions
+
+| Feature | Best Practice |
+|---------|---------------|
+| Background services | Use WorkManager instead |
+| Location | Request only when necessary |
+| Network | Batch requests, respect connectivity |
+| Alarms | Use inexact alarms when possible |
+
+### Doze and App Standby
+
+| Mode | Behavior | Adaptation |
+|------|----------|------------|
+| Doze | Limited network, alarms delayed | Use FCM for high-priority |
+| App Standby | Background work restricted | Use expedited WorkManager |
+| Buckets | Frequency limits by usage | Design for infrequent execution |
+
+## Memory Management
+
+### Memory Best Practices
+
+| Practice | Benefit |
+|----------|---------|
+| Avoid memory leaks | Prevent OutOfMemoryError |
+| Use weak references | Allow garbage collection |
+| Recycle bitmaps | Reduce memory pressure |
+| Monitor heap | Profile regularly |
+
+### Common Memory Issues
+
+| Issue | Detection | Solution |
+|-------|-----------|----------|
+| Activity leak | LeakCanary | Fix lifecycle references |
+| Bitmap leak | Memory profiler | Recycle, use Glide/Coil |
+| Context leak | Static analysis | Use application context |
+| Handler leak | Lint warning | Use WeakReference |
+
+## StrictMode
+
+### What StrictMode Detects
+
+| Category | Issues |
+|----------|--------|
+| Thread | Disk reads/writes, network, slow calls |
+| VM | Leaked objects, unsafe intents, content URI exposure |
+
+Enable StrictMode in debug builds to detect violations during development.
+
+## SDK Requirements
+
+### Version Requirements
+
+| Property | Requirement |
+|----------|-------------|
+| targetSdk | Latest Android SDK (Google Play requirement) |
+| compileSdk | Latest Android SDK |
+| minSdk | Based on target audience |
+
+### Third-Party SDK Management
+
+| Practice | Reason |
+|----------|--------|
+| Keep updated | Security fixes, compatibility |
+| Audit regularly | Remove unused dependencies |
+| Monitor crashes | SDKs can cause issues |
+| Check permissions | SDKs may request excessive permissions |
+
+### Non-SDK Interface Restrictions
+
+- Don't use reflection for hidden APIs
+- Use Android Studio lint to detect
+- APIs may break in future versions
+
+## Monitoring and Profiling
+
+### Tools
+
+| Tool | Purpose |
+|------|---------|
+| Android Studio Profiler | CPU, memory, network, energy |
+| Android Vitals (Play Console) | Production crash/ANR data |
+| Firebase Performance | Real-time performance monitoring |
+| Perfetto | Advanced system tracing |
+| Benchmark library | Reproducible measurements |
+
+### Key Metrics to Track
+
+| Metric | Tool |
+|--------|------|
+| Startup time | Macrobenchmark |
+| Frame timing | JankStats |
+| Memory usage | Memory Profiler |
+| Network latency | Network Profiler |
+| Battery drain | Energy Profiler |
+
+## Performance Checklist
+
+- [ ] Cold startup < 2 seconds
+- [ ] Rendering at 60 FPS
+- [ ] No StrictMode violations
+- [ ] Crash rate < 1.09%
+- [ ] ANR rate < 0.47%
+- [ ] No memory leaks
+- [ ] Background work uses WorkManager
+- [ ] Wake locks properly released
+- [ ] SDKs up to date

package/skills/android-native-dev/references/privacy-security.md

@@ -0,0 +1,244 @@
+# Privacy & Security Guidelines
+
+Security best practices and privacy requirements for Android applications.
+
+## Permissions
+
+### Principle of Least Privilege
+
+| Rule | Implementation |
+|------|----------------|
+| Request minimum | Only permissions essential for core features |
+| Request when needed | At point of use, not app startup |
+| Explain why | Show rationale before system dialog |
+| Degrade gracefully | App works (limited) if denied |
+
+### Permission Request Flow
+
+1. Check if already granted
+2. If not, show educational UI (rationale)
+3. Request permission
+4. Handle result (grant or denial)
+5. If denied, offer alternative or reduced functionality
+
+### Sensitive Permissions
+
+| Permission | Consideration |
+|------------|---------------|
+| Location | Use coarse if fine not needed |
+| Camera | Request only when capturing |
+| Microphone | Request only when recording |
+| Contacts | Consider contact picker intent |
+| Storage | Use scoped storage |
+| SMS/Call Log | Restricted, needs approval |
+
+### Alternative Approaches
+
+| Instead of... | Consider... |
+|---------------|-------------|
+| READ_CONTACTS | Contact picker intent |
+| ACCESS_FINE_LOCATION | Coarse location |
+| READ_EXTERNAL_STORAGE | Storage Access Framework |
+| CAMERA | Camera intent |
+
+## Data Storage
+
+### Storage Types
+
+| Type | Security | Usage |
+|------|----------|-------|
+| Internal storage | Private to app | Sensitive data |
+| External storage | World-readable | Shared files only |
+| SharedPreferences | Private, unencrypted | Non-sensitive settings |
+| EncryptedSharedPreferences | Private, encrypted | Sensitive settings |
+| Room database | Private, optional encryption | Structured data |
+
+### Sensitive Data Rules
+
+| Rule | Implementation |
+|------|----------------|
+| Store internally | Use internal storage, not external |
+| Encrypt at rest | Use EncryptedSharedPreferences, SQLCipher |
+| Don't log | Never log PII or credentials |
+| Clear on logout | Wipe user data completely |
+
+### Data Logging
+
+Never log sensitive data such as passwords, emails, tokens, or personal information. Only log non-sensitive operational information.
+
+## Network Security
+
+### HTTPS Requirements
+
+- All network traffic must use SSL/TLS
+- Configure Network Security Config
+- Don't allow cleartext traffic
+
+### Network Security Config
+
+Define a network security configuration that:
+- Disables cleartext traffic
+- Specifies trusted certificate authorities
+- Optionally implements certificate pinning for high-security apps
+
+### Certificate Pinning (Optional)
+
+For high-security apps, pin certificates to prevent MITM attacks. Include backup pins and plan for certificate rotation.
+
+## User Identity
+
+### Credential Manager
+
+Integrate Credential Manager for unified sign-in supporting:
+- Passkeys
+- Federated identity
+- Traditional passwords
+
+### Biometric Authentication
+
+Use biometric authentication for sensitive operations like:
+- Financial transactions
+- Accessing sensitive documents
+- Confirming identity
+
+### Autofill Support
+
+Provide autofill hints on input fields:
+- emailAddress, username for identity fields
+- password for credential fields
+- creditCardNumber, postalCode for payment fields
+
+## App Components Security
+
+### Exported Components
+
+| Component | Exported Rule |
+|-----------|---------------|
+| Launcher Activity | exported="true" with intent-filter |
+| Internal Activity | exported="false" |
+| Internal Service | exported="false" |
+| Content Provider (shared) | exported="true" with permissions |
+
+Always explicitly set the exported attribute on all components.
+
+### Custom Permissions
+
+Use signature-level protection for custom permissions that control access between your own apps.
+
+### Intent Validation
+
+- Validate all intent data before use
+- Check URI scheme and host
+- Use explicit intents when possible
+- Don't trust extras from unknown sources
+
+### PendingIntent Security
+
+Use FLAG_IMMUTABLE for PendingIntents unless mutability is required. This prevents other apps from modifying the intent.
+
+## WebView Security
+
+### Safe WebView Configuration
+
+| Setting | Recommendation |
+|---------|----------------|
+| JavaScript | Disabled unless required |
+| File access | Disabled |
+| Content access | Disabled |
+| Universal file access | Never enable |
+
+### Avoid Dangerous Practices
+
+| Don't | Why |
+|-------|-----|
+| setAllowUniversalAccessFromFileURLs(true) | Security vulnerability |
+| addJavascriptInterface() with untrusted content | Code injection risk |
+| Load untrusted URLs | XSS, phishing |
+
+## Cryptography
+
+### Use Platform APIs
+
+- Use Android Keystore for key storage
+- Use standard algorithms (AES-GCM, RSA)
+- Never implement custom cryptography
+- Use SecureRandom for random generation
+
+### Avoid
+
+- Custom encryption implementations
+- Weak algorithms (MD5, SHA1 for security)
+- Hardcoded keys or secrets
+- Non-cryptographic random generators
+
+## Code Security
+
+### No Dynamic Code Loading
+
+| Don't | Do Instead |
+|-------|------------|
+| Load code at runtime | Android App Bundles |
+| Download DEX files | Play Feature Delivery |
+| Execute scripts | Predefined functionality |
+
+### Debug Code Removal
+
+- Set debuggable=false in release builds
+- Enable minification (R8/ProGuard)
+- Remove debug libraries from production
+
+## Device Identifiers
+
+### Don't Use Hardware IDs
+
+| Identifier | Status |
+|------------|--------|
+| IMEI | Don't use |
+| MAC address | Don't use |
+| Serial number | Don't use |
+| Android ID | Limited use only |
+
+### Recommended Alternatives
+
+| Use Case | Solution |
+|----------|----------|
+| Analytics | Firebase Analytics ID |
+| Advertising | Advertising ID (resettable) |
+| App instance | Generate UUID on install |
+| User identity | Account-based ID |
+
+## Google Play Policies
+
+### Data Safety
+
+- Declare all data collected
+- Explain data usage
+- Provide privacy policy
+- Allow data deletion requests
+
+### User Data Policy
+
+| Rule | Requirement |
+|------|-------------|
+| Transparency | Clear disclosure of data use |
+| Security | Protect user data appropriately |
+| Minimization | Collect only what's needed |
+| Control | Allow users to manage data |
+
+## Security Checklist
+
+- [ ] Permissions requested only when needed
+- [ ] Permissions explained to user
+- [ ] Sensitive data stored internally
+- [ ] No sensitive data in logs
+- [ ] All network traffic over HTTPS
+- [ ] Network security config defined
+- [ ] Components export status explicit
+- [ ] Custom permissions use signature protection
+- [ ] Intents validated before use
+- [ ] PendingIntents use FLAG_IMMUTABLE
+- [ ] WebView configured securely
+- [ ] Platform crypto APIs used
+- [ ] No debug code in production
+- [ ] No hardware IDs used
+- [ ] Privacy policy available