v0.1.0 — first formal release

May 5, 2026 · 2 min read

Platform team

The first formal Android release of AfriAnnotate is now live and distributed via Firebase App Distribution.

What ships

Cloud-hosted web at afriannotate.waraka.org — Cloud Run + Cloud SQL + GCS, served on a Google-managed cert via Cloudflare DNS
Brevo email delivery for transactional mail (verification, password reset, welcome). SPF + DKIM + DMARC verified on both apex afriannotate.org and afriannotate.waraka.org
Email-first unified auth flow: type your email, the server routes you to signup / verify / login based on account state
Strict email-verification gate with invite-only org membership — no automatic per-user org creation
Auto-login on verify and reset clicks — no second password prompt after clicking a one-shot link
Forgot / reset password with quadratic-backoff resend and exponential per-(IP, email) rate limits
Email-change verification — the new address must be confirmed before the swap commits
Operator-tunable rate limits via PlatformSettings (adjust base + cap per endpoint without a deploy)
Dynamic platform name — rename once at Platform → Branding and it propagates to emails, UI, browser title
NoOrgState — clear messaging for users with no organisation membership, distinguishing "removed from org" vs "never invited"
Project create wizard — Data Import unblocks after labeling config is selected; inline warning when uploaded data is missing required $varname fields per file; Save button gated on validation
Capacitor thin-client APK pointed at the cloud, with live feature-flag fetch (no rebuild for flag flips)

Available via Firebase App Distribution. See Mobile install for the step-by-step.

versionCode=77925650, versionName=app-v0.1.0, SHA256 a5215e77215a3db66e96652d68e118e8d1313fc9bb325329eb4585b626990dcc.

Mobile is online-only for now — no IndexedDB outbox yet, no offline data reads. Roadmap covers this in a future release.
Email deliverability to strict corporate filters (Mimecast, Microsoft ATP, university IT) sometimes fails despite correct SPF/DKIM/DMARC. Workaround: platform owners can mark users verified manually.

Mobile + desktop hardening pass, expanded API surface, additional content modules for Hausa / Swahili / French / Portuguese readers.