The Android client
Last updated
The Weald Android app is a direct mobile client. It can join a workspace without a Mac, holds its own device identity and group state, and connects to the workspace relay for chat, the ticket board, presence and voice calls. It needs Android 8.0 or later and is distributed as a signed APK.
Join a workspace
Open an invite link or paste one into the app, then enter the one-time code sent to you separately. Android verifies the invite, creates a device key for that workspace, joins the groups covered by the invite and derives their content keys on the phone. No Mac transfers those keys, and the relay never sees them.
An existing member can also issue a local grant to a phone that is beside their Mac. That path transfers the relay address, certificate pins, group identifiers and the keys needed to read the granted epochs. The grant travels in the fragment of a weald:// link, so a browser and web server never receive its key material.
After either path, the app connects directly to the hosted or self-hosted relay for that workspace. Each workspace has its own relay address, certificate pins and device key.
What it shows
The Android shell carries a workspace rail, channels and the main phone views:
- Chat verifies each message before showing it and keeps a bounded local scrollback.
- Board shows the workspace ticket lanes and opens each ticket in a detail sheet.
- Presence shows the roster and live availability when members choose to publish it.
- Relay reports the connection state, TLS mode, address and certificate pins.
- Calls carries peer voice calls through the relay without creating call history.
If a group advances to an epoch the phone cannot open, the app says that the conversation moved instead of showing a stale view as though it were current.
What it can change
Android can send direct messages, move a ticket, leave a ticket comment and take part in a voice call when its membership and relay permissions allow those actions. A device joined by invite has its own identity in the workspace access set and signs its own writes.
Shared channel publishing remains on the Mac. The Android composer refuses that action explicitly rather than accepting a message it cannot safely publish. A grant-only phone also stays read-only anywhere its grant and access-set entry do not authorize a write.
Presence is optional per workspace. Turning it on publishes a short-lived live frame; turning it off stops that claim rather than writing a durable status record.
Keys and recovery
The app stores one Ed25519 device key per workspace behind the Android Keystore. From Settings, you can save that identity as a one-page device-keys PDF containing twenty-four words. The document picker gives the app permission to write only the file you choose; the app does not upload, email or copy the key to the clipboard.
Those words restore the phone's device identity, not its message history or MLS group state. Keep the PDF somewhere private, because anybody holding it can present the same device identity to the workspace.
Install and requirements
Download the signed APK from Download, then allow installation from the app you use to open it. Weald requires Android 8.0 or later. A normal workspace connection uses secure WebSockets and the certificate policy saved with that workspace.