Cross-platform App Hardening (DexGuard-class), Enterprise-gated - #5527

Adds a single hardening layer that renames classes/methods/fields, encrypts
string constants and obfuscates control flow across every port (Android, iOS/
ParparVM, JavaScript, native desktop) from one bytecode transform, integrated
with Crash Protection so obfuscated stack traces are still symbolicated.

Engine (new maven/cn1-hardening, run as a forked process so it is single-sourced
with the build daemon and carries its own ProGuard/ASM): demux the fat jar,
rename with ProGuard using a prefixed dictionary that avoids the ParparVM
NativeSymbolIndex culler pathology, encrypt LDC literals and static-final
ConstantValue strings with a per-class decoder, opaque-predicate control flow on
safe platforms, ParparVM mangle-collision guard, CheckClassAdapter verification,
and a cross-platform mapping. Android keeps R8 as its sole renamer.

Symbolication (new maven/cn1-retrace): ProGuard mapping parse/chain plus the
ParparVM trace-string parser that java.lang.Throwable.getStackTrace() now mirrors
on device, and a local retrace CLI. Crash payload gains rawStack/traceFormat/
mappingId/hardenLevel; PiiScrubber.scrubRawStack; cause-chain capture.

Surface/entitlement: harden.* build hints, HardeningPreflight (fail the build on
local/source targets, invalid level, on-device-debug), Executor.hardenSourceJar/
runBuild wiring, a read-only Hardening status API, and the App-Hardening developer
guide chapter. Also fixes the invalid build_key literal, the BuildHintEditor
grouped-Select values lookup, and the "obfuscates by default" overclaim in the
security chapter.

Tests: 25 unit tests across the two modules and the crash payload (full ProGuard
round-trip, string round-trip + plaintext-absence, control-flow verification,
mapping retrace, trace-format detection, pre-flight truth table).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- Complete GPLv2+Classpath header on the 4 files the copyright gate flagged
  (BuildHintEditor had none; BuildHintSchemaDefaults + the two new tests were short).
- Convert Hardening.java/package-info.java to /// markdown comments (core src gate).
- Declare cn1-hardening:standalone as a runtime-scope plugin dependency so the reactor
  builds the engine before the plugin embeds it (fixes the antrun copy failing in CI);
  fix an illegal -- inside the new XML comment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ProGuard 7.3.2 cannot read class files newer than JDK 20 (it fails on the JDK's
own module classes), so the renamer must run on JDK 8-20 -- the cloud daemon
forks the engine on JDK 17. The engine now fails with a clear message instead of
a cryptic ProGuard error when renaming is requested on a too-new JVM, and the
ProGuard-dependent tests skip (JUnit assumption) on JDK 21+ so the PR CI JDK-21
leg stays green. String encryption and control-flow tests have no such limit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- FrameClassWriter: COMPUTE_FRAMES resolved common superclasses through the
  engine's own classloader, which lacks the app/library classes when run as a
  forked jar, so any class with a merge between application types aborted
  hardening. Resolve the hierarchy from a classloader over the (renamed) input
  classes plus the library jars, falling back to Object. Threaded through the
  string-encryption and control-flow transforms; unit-tested. (Codex P1)
- Pass the FULLY QUALIFIED main class to the keep rules: getMainClass() is the
  simple name, so a bare value kept a default-package class and let ProGuard
  rename the real application class out from under the generated stub. Fixed in
  both the plugin and daemon config writers. (Codex P1)
- The reactor dependency forcing cn1-hardening to build before the plugin (so
  the engine jar exists for the embed step) already landed in the prior commit. (Codex P1)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Codex P1/P2:
- harden.keep: split on newlines only (a ';' is legal inside a rule body).
- Keep SourceFile,LineNumberTable so ParparVM/native traces keep real line
  numbers for retrace.
- Honor constants-vs-all string mode: 'constants' encrypts only values declared
  as static-final String constants (and javac's inlined copies), 'all' encrypts
  every literal.
- Propagate cn1.mappingId/cn1.hardened/cn1.hardenLevel into the request before
  stub generation; Android stub now stamps them (Hardening.isHardened(), crash
  report mappingId/level).
- Supply the compile/platform classpath to ProGuard as library jars so an app
  method overriding a framework method is not renamed apart from its superclass.
- Append harden.keep + the name-bound PropertyBusinessObject keep to Android's
  R8 config (Android keeps R8 as sole renamer).

Build fixes:
- CrashProtection.safeRawStack: build the raw stack with StringBuilder instead of
  java.io.PrintWriter, which the core's CLDC11 bootclasspath (ANT build) lacks.
- Embed the engine jar via maven-dependency-plugin:copy (resolves the standalone
  artifact from the reactor/repo) so partial plugin-only CI builds no longer fail
  copying from an unbuilt sibling target/.
- Keep the test resource bytes ASCII (explicit byte[] rather than a non-ASCII
  literal).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…, Select delimiters)

- OutputVerifier: pass the input/library hierarchy classloader to
  CheckClassAdapter.verify so the final verification pass resolves application
  types instead of loading them from the engine's classpath (a class with a merge
  between app types would otherwise fail verification). (P1)
- Keep every class named by a META-INF/services/* descriptor (the service
  interface and each provider), since the descriptors are copied verbatim and
  ServiceLoader would break if they were renamed; regression-tested. (P1)
- Terminate the hardening Select .values lists with their delimiter, which
  BuildHintEditor reads as the last character, so the simulator shows the real
  options instead of splitting on a letter. (P2)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

MappingWriter.jsonEscape only escaped quote and backslash, so a SourceFile
containing a newline, tab or other control character was emitted literally --
a raw newline split the single-line metadata comment and a raw control char is
invalid JSON, either of which stopped MappingFile.parseSourceFileMetadata from
recovering the filename (retrace then fell back to a synthesized path). This is
reachable for a Kotlin or package-private Java class in an unusually named Unix
file. Escape b/f/n/r/t and other control chars (as the 4-hex-digit form), and
teach the reader to decode those escapes back. Round-trip tested both sides.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

parseSourceFileMetadata trim()'d the decoded fileName, so a Unix source file
whose name has leading/trailing whitespace (e.g. " Screen.kt") retraced to a
different, nonexistent filename and broke source links. The closing quote
bounds the JSON string exactly, so return the decoded value verbatim and treat
only a genuinely empty value as absent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

A HealthBackgroundListener is reconstructed after a process restart by its
persisted class name: HealthStore writes getClass().getName() to Preferences,
and the platform builder scans the hardened jar to generate a factory mapping
that name back to a constructor. The engine's keep set omitted it, so an
engine-renamed Apple/native build renamed the implementor; because the default
mapping seed changes between builds, an updated app's regenerated factory no
longer recognized the previously persisted name and resolveBackgroundListener()
silently returned nothing, deferring background health delivery. Keep the
implementors, exactly as the location/background-callback and Login rules do.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

applyHardeningRequestArgs was called only from the Android/iOS/JavaScript
request builders; the Windows and Linux native builders (windows-source,
local-windows-device, local-linux-device) built their request and called
runBuild without it. So a local Windows/Linux build that took
harden.allowUnhardenedLocalBuild=true injected no cn1.harden.forceOff and
hardenSourceJar ran hardening anyway, producing an orphaned local mapping.
Call the helper from those two request builders too; all five runBuild sites
now carry the per-build decision.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The App-Hardening resource-limitation note tripped Microsoft.Adverbs on
"rarely"; reword without the adverb. No content change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

FrameClassWriter: the superclass walk returned java/lang/Object via
isAssignableFromBytes(Object, type2) -- always true -- BEFORE the
chainReachesObject incompleteness check, so a merge where type2's chain is
broken by a missing intermediate that hides a nearer common base (A extends
Base, B extends an absent Missing extends Base) was emitted as Object without
being flagged. Stop the walk before Object so reaching it falls through to the
incompleteness check; a broken type2 chain is now flagged and the class shipped
unhardened.

StringEncryptTransform: the GETSTATIC collector recorded the reference owner
(C.X), but an inherited field read (GETSTATIC C.X for a field declared by
superclass B) must key on the declaring class B.X, which is what
encryptStaticFinalStrings checks. Resolve the owner to the field's declaring
class through the hierarchy before recording it, so the ConstantValue of an
inherited, externally-read constant is preserved rather than migrated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

JavaSEPort.getPlatformName() returns mac/win for a skinless desktop app (Linux
falls through to win), which collide with the native ParparVM-C names, so the
platform-name gate still misclassified a JavaSE desktop throwable whose message
contained a "    at X.Y:N" line as parparvm-text. ParparVM's System.getProperty
always returns null while a real JVM sets java.vm.name, so derive the trace
format from that runtime signal: anything on a JVM (JavaSE desktop, the
simulator, or Android) is never parparvm-text regardless of its displayed name.
A package-private 4-arg overload takes runningOnJvm explicitly so a JVM-hosted
unit test can still exercise the native path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

OutputVerifier handled the case where CheckClassAdapter.verify THROWS on an
absent target-only type, but ASM sometimes catches that failure internally and
prints its stack trace to the report instead. A non-empty report was then
rejected, so a class whose frame analysis needs an unavailable platform
superclass could still fail hardening. Detect the unresolved-type text in the
report (ClassNotFoundException / TypeNotPresentException / NoClassDefFoundError
/ " not present") and take the structural fallback, mirroring
BytecodeComplianceMojo's isUnresolvableTypeOutput.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The opening paragraph still described the old "mask only non-frame lines"
behavior and promised a minified-JS coordinate like app.js:1:123456 survives,
contradicting the accurate explanation later in the same javadoc. scrubRawStack
now routes every line through scrubMessage, so document the uniform masking and
its loss of large columns (short line numbers still survive; precise
coordinates come from structured frames). No behavior change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…cuit

The Android APK cache check (skip build when the APK is newer than the sources)
returned before applyHardeningPreflight() ran, and getSourcesModificationTime()
keys only on source timestamps -- not build hints -- so an explicit hardening
request, especially one made via a -D command-line property, was silently
dropped and the stale, potentially unhardened APK returned with no error. Move
the preflight ahead of the cache check and overlay -D command-line hints in the
early preflight so the request is seen, validated, and refused if unsupported
rather than silently ignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Moving the pre-flight ahead of the cache check validated the hardening request
but did not invalidate the cache, so an off->standard change made through a -D
hint (which getSourcesModificationTime cannot see) still returned the older,
possibly unhardened APK. Record whether the pre-flight resolved that hardening
will run (non-off level and not force-off) and skip the source-timestamp cache
short-circuit in that case, forcing a rebuild so the request is honored. When
hardening is off / force-off / opted out, the cache still applies.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The previous guard only bypassed the up-to-date cache for off->on; disabling
hardening (on->off, opting Android out, or turning every transform off) left
hardeningWillRun false, so the cache returned the old HARDENED APK -- an
artifact contradicting the current config. Record the hardening OUTCOME the APK
was built with ("unhardened" or "hardened:<level>") in a marker beside the APK,
and treat the cache as up-to-date only when that marker still matches. A change
in either direction now rebuilds, while two unhardened (or identical-level)
invocations still hit the cache.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The marker keyed only on harden.level, so changing harden.strings, harden.rename,
harden.controlFlow, harden.keep or harden.seed without changing the level left
the key identical (both aggressive builds were "hardened:aggressive") and the
timestamp cache reused an APK built with the previous transforms and mapping.
Fingerprint every effective codename1.arg.harden.* setting (sorted, SHA-256) into
the hardened key so any transform/keep/seed change invalidates the cache; an
unhardened build keeps its single key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>