Sovereign Mobile — Roadmap

Chronological task index and canonical task status. One row per task. Full detail for any task lives in docs/epics/; this file tracks only sequencing and status.

Epic task IDs (e.g. 20.1) are permanent and shared with the sovereign monorepo's own epic 20 — cite them in commits, PRs, and cross-references. Roadmap slot versions below (0.1.1, 0.2.1, …) are this repo's own and are volatile: they reflect current sequencing and shift when priorities change. Keep slots out of branch names and commit subjects.

This repo has not had a public release yet — see the Phase 1 definition of done below for that bar. Individual tasks land and ship to internal builds/testing ahead of that: Phase 2 (bridge transport) is done as of 2026-08. docs/repositories.md in the sovereign monorepo listed this repo's status as "Not yet created" as of 2026-07-31 — stale now that real code has landed; update it there when touching that doc next.

Phase 1 — Whole-instance shell (sovereign workstream 0002)

The reason this repository is created. Ships the universal app: onboarding, instance persistence/switching, WebView loading, store release. No device bridge beyond whatever thin slice RFC 0083 has landed centrally by the time this phase starts.

Slot	Task	Status	Epic task
0.1.1	Capacitor shell scaffold	⏳	20.1
0.1.2	Store release setup and privacy declarations (iOS + Android)	📋	20.4
0.1.3	sovereign:// deep link scheme	✅	20.14

Prerequisites, owned in the sovereign monorepo, gate this phase but are not this repo's own work: the WKWebView offline spike (task 20.10), the instance identity/validation endpoint (task 20.2), and the in-app text-size control that discharges the pinch-zoom accessibility debt (task 10.2). See sovereign workstream 0002 for that sequencing; this repo's leg 4/5 can begin once workstream 0002's leg 1 gate clears and leg 2's response contract is agreed (not necessarily merged).

Phase 2 — Bridge transport

This shell's implementation of the shared device capability bridge (sovereign RFC 0083). Nothing in this phase starts before the protocol itself (@sovereignfs/bridge, @sovereignfs/sdk/device-client) exists centrally.

Slot	Task	Status	Epic task
0.2.1	Mobile SDK native environment and bridge adapter (Capacitor transport of @sovereignfs/bridge)	✅	20.3

Phase 3 — Capability breadth

Each row is an additive registry entry against the same bridge contract, not a new mechanism. Sequencing here is not strict — these can land in any order once Phase 2 ships, as product need identifies them.

Slot	Task	Status	Epic task
0.3.1	Native push notifications (APNs/FCM)	✅	20.5
0.3.2	Native photo picker and camera capture	✅	20.6
0.3.3	Biometric auth capability	✅	20.7
0.3.4	Haptics capability	✅	20.8
0.3.5	Background capability planning	📋	20.9
0.3.6	Encrypted secure-storage capability (SQLCipher database; iOS verified, Android build-only)	🚧	20.13

Further candidates (geolocation, calendar, NFC, and others) are tracked as open questions, not roadmap rows, in docs/research/0002-device-capability-candidates.md until a concrete plugin need graduates one onto this list.

Phase 4 — Focused plugin apps

Separately gated (sovereign workstream 0001, RFC 0082). Publishing individual, single-plugin apps from this same codebase.

Slot	Task	Status	Epic task
0.4.1	Focused plugin app build targets	📋	20.11
0.4.2	Plugin app store release process and rationing policy	📋	20.12

Definition of done — Phase 1 public release

Restated from sovereign workstream 0002, since it's the concrete bar for this repo's first shipped version:

• [ ] Published on the App Store and Play Store (public release, not just an internal track).
• [ ] First launch prompts for an instance URL, validates it, and loads the instance; a stored instance loads directly on relaunch.
• [ ] An invalid or unreachable URL fails with an inline error and does not crash.
• [ ] A non-Sovereign URL is rejected as such, not merely as "unreachable".
• [ ] Users can add, remove, and switch between at least two instances.
• [ ] External links open outside the primary WebView.
• [ ] Offline behavior matches the scope decided by the offline spike's finding, and whatever is not supported is documented rather than silently broken.
• [ ] No Sovereign auth, role, or plugin behavior is duplicated in native code.
• [ ] docs/repositories.md in the sovereign monorepo reflects this repo's actual status once created and shipping.

Changelog

Version	Date	Change
0.1	2026-07-31	Initial roadmap
0.2	2026-08-03	Phase 2 (20.3, bridge adapter) done; 20.8 (haptics) closed as subsumed by 20.3
—	2026-08-08	20.6 (native photo picker / camera capture) done — landed without its own version bump at the time
0.3	2026-08-09	20.7 (biometric auth capability) done — iOS and Android build/launch-verified (JDK 21 installed this session)
0.4	2026-08-09	20.14 (sovereign:// deep link scheme) done — two real cross-platform bugs found and fixed along the way (iOS WKUserScript aliasing, Android Chromium URL-authority parsing); see docs/epics/shell.md and ADR 0008
0.5	2026-08-09	20.5 (native push notifications, RFC 0087 leg 4) done — native iOS/Android push clients, on-device P-256 keypair generation, payload decryption; no new bridge capability, per RFC 0083 §7
0.6	2026-08-13	20.13 (encrypted secure-storage capability, sovereign RFC 0093 leg 4) partial — Keychain/Keystore key custody done and build-verified both platforms, @capacitor-community/sqlite/SQLCipher database not started (tracked under sovereign epic task 8.20); no interactive prompt verified yet, no real caller exists (matches 20.7's own shipped state). Also fixed a pre-existing bug found along the way: biometrics.confirm (20.7) was dispatched but never advertised in either platform's handshake capabilities array.
0.7	2026-08-14	20.13 (secure-storage capability, completion) still 🚧 partial — @capacitor-community/sqlite turned out unusable as designed (its API is JS-facing and this shell strips Capacitor's own bridge from remote content), replaced with direct SQLCipher linking (SQLCipher.swift SPM on iOS, net.zetetic:sqlcipher-android + androidx.sqlite:sqlite on Android). SecureDatabase.swift/SecureDatabase.java built, build-verified both platforms, and interactively verified end-to-end on iOS (a real device-credential round-trip, plus the sovereign monorepo's example-device-only reference plugin surviving a full app kill/relaunch). Android reaches a real credential-confirmation dialog once a device credential is configured, but this AVD image's SystemUI reproducibly wedges on PIN/credential screens, blocking confirmation of the completed ok path — an emulator-specific issue, not a code defect. Also fixed, on the sovereign monorepo side: DeviceStorageKeySection.tsx and device-only-kv.ts were both unreachable/inert on native shells, independent of this repo's own code — see that repo's own PR for detail.