Release v1.3.1 and re-pin keep to v0.11.0

[kwsantiago]

Prepares v1.3.1: versionCode 29 to 30, versionName 1.3.0 to 1.3.1, the per-ABI Fastlane changelogs (302, 304) in all five locales, and a re-pin of keep to the v0.11.0 release tag. F-Droid reads changelogs from the source tree at the tagged commit, so they have to land before the tag.

This is a security release. v1.3.0 ships a core whose sign-policy gate is evaluated before app expiry, before the standing-permission lookup and before a stored refusal, so an app the user had explicitly denied could still be auto-approved, provided it was opted in to background signing and the policy was Auto or Basic. An expired app could be auto-approved the same way, and an indeterminate permission lookup was bypassed rather than failing closed. keep v0.11.0 evaluates expiry, the lookup and a standing DENY ahead of the policy, and an explicit "ask" now prompts rather than being overridden. The reject reasons are unchanged; what changes is which requests reach them.

Pinned to the tag's commit, 7de93595, not the tag object. .github/actions/setup-keep resolves the tag to its commit and then compares that against keep.version, so the tag object's own SHA fails the check. keep v0.11.0's NDK, cargo-ndk and Rust pins match this repo's, verified by scripts/check-toolchain-pins.sh.

Paired with #533, which is the client half of the same fix. The two are separable only in the sense that they merged separately: #533 makes an expired window require re-approval and stops the sweep erasing a standing refusal, and without it the re-pin would make deny_expired reachable for exactly the apps whose refusal the sweep was deleting. Also includes #532, which gives the core-owned store sole ownership of the per-app policy tier.

Changelogs

The three user-visible changes, in the order they are likely to be noticed: a remembered refusal now holds while automatic approval is on; a permission set to ask now asks; and an app whose access window has run out must be approved again instead of falling back to the default policy, with its background-signing permission withdrawn. The third is the one most likely to prompt "why is it asking me again", so it is stated plainly rather than implied.

Test plan

• scripts/check-release-changelogs.sh and scripts/check-toolchain-pins.sh pass locally, including the 500-character cap added in Trim v1.2.0 changelogs to 500 characters and check every changelog's length #531.
• CI rebuilds the Rust layer and regenerates the uniffi bindings against the new pin, then runs the unit and instrumented suites. That is the real check on the re-pin, since the bindings are build output rather than checked in.
• The Reproducibility workflow needs a workflow_dispatch run on main after merge, and the tag-triggered run then compares the published APKs byte for byte.

Summary by CodeRabbit

• Release

  • Updated the app to version 1.3.1.

• Permission behavior

  • Remembered denials and permissions set to ask are respected even when automatic approval is enabled.
  • Apps must be approved again after their access window expires; background signing permission is removed.
  • Denials remain in effect for the duration set by the user.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a1b35d78-8949-4b37-944d-fbc38c97bc6a

📥 Commits

Reviewing files that changed from the base of the PR and between efe366f and 42cd150.

📒 Files selected for processing (12)

• app/build.gradle.kts
• fastlane/metadata/android/de-DE/changelogs/302.txt
• fastlane/metadata/android/de-DE/changelogs/304.txt
• fastlane/metadata/android/en-US/changelogs/302.txt
• fastlane/metadata/android/en-US/changelogs/304.txt
• fastlane/metadata/android/es-ES/changelogs/302.txt
• fastlane/metadata/android/es-ES/changelogs/304.txt
• fastlane/metadata/android/ja-JP/changelogs/302.txt
• fastlane/metadata/android/ja-JP/changelogs/304.txt
• fastlane/metadata/android/pt-BR/changelogs/302.txt
• fastlane/metadata/android/pt-BR/changelogs/304.txt
• keep.version

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The app version changes to 1.3.1, and the keep.version reference changes. New changelog entries in five locales describe permission and access-window behavior.

Changes

Release metadata

Layer / File(s)	Summary
Release identifiers app/build.gradle.kts, keep.version	The app version changes to code 30 and name 1.3.1. The keep.version value changes.
Localized release notes fastlane/metadata/android/{de-DE,en-US,es-ES,ja-JP,pt-BR}/changelogs/{302,304}.txt	New changelog entries describe remembered denials, ask-mode permissions, expired access windows, background signing, and denial duration.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 42cd1

The release metadata and localized notes are updated, and the build checks the pinned revision. The source behind that revision could not be independently verified, but no concrete mismatch or build failure is established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the two main changes: the v1.3.1 release and the keep dependency re-pin to v0.11.0.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit reads the release notes by moonlit clover,
Denials stay remembered; ask-mode prompts take over.
When access windows close, approval comes anew,
Five locales share the notes, in languages true.
Version numbers hop ahead; the burrow hums with cheer.}

_{Comment @coderabbitai help to get the list of available commands.}