🔒 Aisle Security Analysis

✅ We scanned this PR and did not find any security vulnerabilities.

_{Aisle supplements but does not replace security review.}

Analyzed PR: #30726 at commit d64a5fd

Greptile Summary

This PR adds ktlint linting and formatting tooling to the Android app and benchmark modules, reformats all Gradle Kotlin scripts to 4-space indentation, removes deprecated AGP gradle.properties flags, and adds an explicit notification permission guard to satisfy Android lint. The changes are largely housekeeping, with one functional change in SystemHandler.kt that deserves attention.

Key observations:

• SystemHandler.kt permission guard: The new POST_NOTIFICATIONS check in post() silently returns without posting or signalling an error. This causes handleSystemNotify() to return ok(null) (success) even if the notification was dropped due to a missing/revoked permission — a regression from the previous behaviour where a SecurityException would be caught and surfaced as a NOTIFICATION_FAILED error.
• android.dependency.useConstraints flipped to false: Previously true, this flag controls AGP's automatic dependency version alignment across configurations. Worth confirming it has no effect in AGP 9.x before landing.
• ktlint setup: Correctly declared at the root with apply false and applied per-module with matching configuration. The new android:lint, android:format, and android:lint:android scripts in package.json are clean and well-named.
• README checklist: Several previously open items are now checked off, reflecting real feature completions landing alongside this tooling PR.

Confidence Score: 3/5

• Safe to merge with the caveat that the silent-return permission guard in SystemHandler.kt causes false-success responses when a notification is silently dropped.
• The ktlint tooling setup and Gradle reformatting are mechanical and low-risk. The gradle.properties flag removals are plausible deprecation cleanups but android.dependency.useConstraints toggling to false needs confirmation. The main concern is the SystemHandler.kt permission guard that silently swallows a notification failure and returns success to the caller, which is a functional regression in error reporting even if the race condition is rare.
• apps/android/app/src/main/java/ai/openclaw/android/node/SystemHandler.kt — the silent return inside post() needs to be revised to avoid masking failures. apps/android/gradle.properties — confirm android.dependency.useConstraints=false is safe in AGP 9.x.

_{Last reviewed commit: 6e60604}

🔒 Aisle Security Analysis

✅ We scanned this PR and did not find any security vulnerabilities.

_{Aisle supplements but does not replace security review.}

Analyzed PR: #30726 at commit 89c705a

Landed via temp rebase onto main.

• Gate: pnpm android:lint && cd apps/android && ./gradlew :app:testDebugUnitTest --tests ai.openclaw.android.node.SystemHandlerTest && ./gradlew assemble
• Land commit: d64a5fd
• Merge commit: 08f98ac