defiQUG
4f78404f87
- Extend RBAC modules/permissions; Home + drawer + Nav routes for ATF/NCIC/military/judicial/intelligence - Wire Orders/Evidence/Reports/ATF/NCIC/Military/Judicial/Intelligence Compose flows with Hilt ViewModels - Evidence: custody chain merge in repository; list/detail UI; fix transfer entity evidenceId - SyncService: hydrate credential payloads after list pull; CredentialCacheSyncPort API + tests - CredentialCacheMerger hydrateMissingPayloads; CredentialsViewModel refresh/hydrate split - OrderServiceTest; SyncService + CredentialCacheMerger tests; NCIC operator display - docs: OUTSTANDING-PRODUCTION-AND-COMPLIANCE-WORK.md; GAPS updates; README implementation status - Misc doc/build updates (OpenAPI test, compliance matrix, etc.) Made-with: Cursor
143 lines
6.6 KiB
Markdown
143 lines
6.6 KiB
Markdown
# Secure Mobile Operations Application (SMOA)
|
||
|
||
[](https://gitea.d-bis.org/Sankofa_Phoenix/SMOA/actions)
|
||
|
||
**Repository (monorepo):** [https://gitea.d-bis.org/Sankofa_Phoenix/SMOA](https://gitea.d-bis.org/Sankofa_Phoenix/SMOA) — `git clone https://gitea.d-bis.org/Sankofa_Phoenix/SMOA.git`
|
||
|
||
**CI:** [`.gitea/workflows/ci.yml`](.gitea/workflows/ci.yml) (Gitea Actions) — runs `./gradlew smoaVerify` on push/PR.
|
||
|
||
**Android Foldable Devices – Online / Offline Mission Operations**
|
||
|
||
> **Constitutional Status**: This repository implements **SMOA**, a Tier-1 canonical sovereign system. See [NOTICE.md](./NOTICE.md) and [CANONICAL_CONSTITUTION.md](../CANONICAL_CONSTITUTION.md) for details.
|
||
|
||
## Overview
|
||
|
||
SMOA is a hardened Android-based application designed for deployment on approved foldable mobile devices. The application enables identity presentation, secure internal routing, and mission communications in connected, disconnected, and degraded environments, while enforcing multi-factor authentication, dual biometric verification, and cryptographic data protection.
|
||
|
||
## Project Structure
|
||
|
||
```
|
||
smoa/
|
||
├── app/ # Main application module
|
||
├── core/ # Core modules
|
||
│ ├── auth/ # Authentication framework
|
||
│ ├── security/ # Security infrastructure
|
||
│ ├── common/ # Common utilities
|
||
│ ├── barcode/ # PDF417 barcode generation
|
||
│ ├── as4/ # AS4 gateway messaging
|
||
│ ├── eidas/ # eIDAS compliance
|
||
│ ├── signing/ # Digital signatures & seals
|
||
│ └── certificates/ # Certificate management
|
||
├── modules/ # Feature modules
|
||
│ ├── credentials/ # Issued credentials
|
||
│ ├── directory/ # Internal directory
|
||
│ ├── communications/ # Unit communications
|
||
│ ├── meetings/ # Secure meetings
|
||
│ ├── browser/ # Controlled browser
|
||
│ ├── orders/ # Orders management
|
||
│ ├── evidence/ # Evidence chain of custody
|
||
│ ├── reports/ # Report generation
|
||
│ ├── atf/ # ATF form support
|
||
│ ├── ncic/ # NCIC/III integration
|
||
│ ├── military/ # Military operations
|
||
│ ├── judicial/ # Judicial operations
|
||
│ └── intelligence/ # Intelligence operations
|
||
└── docs/ # Documentation
|
||
```
|
||
|
||
## Features
|
||
|
||
### Authentication & Security
|
||
- Three-factor authentication (PIN + Fingerprint + Facial Recognition)
|
||
- Hardware-backed encryption
|
||
- Session management
|
||
- RBAC framework
|
||
- Policy management
|
||
|
||
### Functional Modules
|
||
- **Credentials**: Digital credential presentation with PDF417 barcodes
|
||
- **Orders**: Digital orders management with workflow
|
||
- **Evidence**: Chain of custody tracking per NIST SP 800-88
|
||
- **Reports**: Multi-format report generation (PDF, XML, JSON, CSV)
|
||
- **ATF**: ATF form support (4473, Form 1, Form 4)
|
||
- **NCIC**: NCIC/III database integration
|
||
- **Military**: MIL-STD credential support and classification
|
||
- **Judicial**: Court orders, case files, subpoenas
|
||
- **Intelligence**: Compartmented access control and source protection
|
||
|
||
### Compliance Standards
|
||
- PDF417 barcode (ISO/IEC 15438)
|
||
- AS4 gateway (OASIS AS4 Profile 1.0)
|
||
- eIDAS qualified signatures
|
||
- ISO 8601 date formatting
|
||
- ISO 3166 country codes
|
||
- NIST SP 800-88 (evidence handling)
|
||
- CJIS Security Policy (NCIC)
|
||
- DODI 8500.01 (military security)
|
||
|
||
## Building
|
||
|
||
```bash
|
||
# Backend tests + Android debug APK (recommended):
|
||
./gradlew smoaVerify --no-daemon
|
||
# or: ./scripts/build-all.sh
|
||
|
||
# Full project build:
|
||
./gradlew build
|
||
```
|
||
|
||
See [docs/development/BUILD.md](docs/development/BUILD.md) for details. Debug APK: `app/build/outputs/apk/debug/app-debug.apk`.
|
||
|
||
## Requirements
|
||
|
||
- Android Studio Hedgehog or later
|
||
- JDK 17
|
||
- Android SDK 24+ (minimum), 34 (target)
|
||
- Gradle 8.2+
|
||
|
||
## Documentation
|
||
|
||
See the `docs/` directory for comprehensive documentation:
|
||
|
||
### Core Documentation
|
||
- `reference/SPECIFICATION.md` - Application specification
|
||
- `reference/COMPLIANCE_MATRIX.md` - Compliance status matrix
|
||
- `reference/COMPLIANCE_EVALUATION.md` - Detailed compliance assessment
|
||
- `reference/IMPLEMENTATION_REQUIREMENTS.md` - Technical requirements
|
||
- `status/IMPLEMENTATION_STATUS.md` - Current implementation status
|
||
|
||
### Project Reports
|
||
- `reports/completion/` - All completion and progress reports
|
||
- `PROJECT_REVIEW.md` - Comprehensive project review and gap analysis
|
||
- `PROJECT_REVIEW_SUMMARY.md` - Executive summary
|
||
- `FINAL_COMPLETION_REPORT.md` - Final completion report
|
||
- `COMPLETE_IMPLEMENTATION_REPORT.md` - Complete implementation report
|
||
- And other completion/progress reports
|
||
|
||
### Documentation Index
|
||
- `docs/README.md` - Complete documentation index and navigation guide
|
||
- `docs/DOCUMENTATION_RECOMMENDATIONS.md` - Documentation organization recommendations
|
||
|
||
## Implementation Status
|
||
|
||
### App surfaces (aligned with feature list above)
|
||
|
||
**Security (defense-in-depth, deployment-dependent):** Screen protection (e.g. `FLAG_SECURE`), VPN hooks, MFA + biometric sign-in flow, encrypted stores — validate against your org’s assessment; not a substitute for formal certification.
|
||
|
||
**Functional modules — navigable UI + domain services:**
|
||
Credentials, **Orders** (list/detail, workflow steps, Room), **Evidence** (list/detail, custody transfers + chain in DB), **Reports** (type/format generation via `ReportService`), **ATF** (4473 validate/submit simulation; Forms 1/4 documented stubs), **NCIC** (ORI/UCN validation + simulated query; live III requires CJIS), **Military** (demo credential issuance), **Judicial** (demo court order), **Intelligence** (compartments, NTK, protected source demo), plus Directory, Communications, Meetings, Browser — all reachable from **Home** and the drawer under **RBAC** (`core/auth`).
|
||
|
||
**Infrastructure:** Hilt, Navigation Compose, offline/sync and backend contract (see `core/common`, `backend/`). WebRTC remains integration-ready, not a full production mesh.
|
||
|
||
### Tests
|
||
|
||
Unit / integration tests run via `./gradlew smoaVerify` (backend + Android unit tests + debug APK). Add module-level tests as features harden; external compliance (CJIS, eTrace, barcode jurisdictions) still needs agency-specific validation.
|
||
|
||
### Code quality
|
||
|
||
Project builds with the configured toolchain; treat lint and coverage as ongoing hygiene.
|
||
|
||
## License
|
||
|
||
Proprietary - Government Use Only
|