Verdict

Not covered here (not part of building): installing on a phone, the Google OAuth client for sign-in, Play Console upload, and the package size question. Those are now their own step-by-step guide — Google Cloud & Play Console setup. Background in the pipeline wireframe.

1Build environment

Machine-wide, already correct. To re-check:

flutter config --list | grep jdk
  jdk-dir: /opt/homebrew/opt/openjdk@17

ls ~/Library/Android/sdk
  build-tools  cmdline-tools  platform-tools  platforms  licenses

Confirmed during the real build:

[12:35:10] 编包用的 JDK 来自 flutter config --jdk-dir:/opt/homebrew/opt/openjdk@17
[12:35:10] JDK: openjdk version "17.0.20.1" 2026-08-18
[12:35:10] SDK: .../Android/sdk(platforms: android-33 android-34 android-35 android-36)

2Dependencies

Nothing to pre-install. The build runs flutter pub get itself and fails the whole run if resolution fails. Native dependencies (CameraX and the Guava compile-time shim) are declared in app/android/app/build.gradle.kts and need no manual step.

The only dependency fact that matters operationally is the one in §1: a third-party plugin is what pins the JDK to exactly 17.

3Credentials — the signing key

SHA-1 7A:03:8F:8C:9A:FA:D9:26:A5:62:CD:B9:3E:77:29:E2:25:E7:91:CA · valid to 2054.

🔑 这棵树本来没有,已从仓库外那份权威配置取用:/Users/jeffchoong/.hoop-keys/key.properties
[12:35:10] 🔑 用真钥匙签:/Users/jeffchoong/.hoop-keys/hoop-upload.jks

4Permissions

This was the one thing that could have silently broken NOVA, so it was checked rather than assumed.

5The build command, and what verifies it

cd <a clean checkout of master>
bash tools/tf-build/cut_android.sh <versionCode> <that same path>

NOVA's existing convention for iOS applies unchanged: one fresh worktree per build (~/.hoop/wt-nova-build<N>), path passed as the second argument. The script does not read any config for the tree — it builds exactly what it is pointed at.

• versionCode must increase with every Play upload, and a used number is spent forever.
• Do not redirect the output. The script owns /tmp/cutandroid<N>.log and its own checks read that path.
• It does not touch pubspec.yaml — the build number comes from the command line, so an Android build cannot disturb the iOS line.

The eight gates — every one stops the build

6Verifying a build afterwards

The script does this, but these are the commands to confirm independently:

# package name and versionCode, read out of the artifact
~/Library/Android/sdk/build-tools/36.0.0/aapt2 dump badging <apk> | head -1
# → package: name='com.hooptech.hoop' versionCode='N' ...

# who signed it
JAVA_HOME=/opt/homebrew/opt/openjdk@17 \
~/Library/Android/sdk/build-tools/36.0.0/apksigner verify --print-certs -v <apk>

Three things must hold: package name is com.hooptech.hoop, versionCode is what was requested, and the signer digest matches the keystore.

Two standalone test suites can be run at any time, without building:

bash tools/tf-build/ensure_key_properties_test.sh   # 8 checks
bash tools/tf-build/apk_signer_check_test.sh       # 7 checks, needs an APK

The proof — a real build, today

Rather than inspecting configuration and declaring it ready, I ran the pipeline exactly as NOVA would: a brand-new worktree at origin/master, zero commits behind, no key.properties in it.

…
✅ 签名者指纹和 key.properties 那把钥匙对得上:2d71b3184c4aa64316bdae1f6dd0ea15…
✅ versionCode 1,真钥匙签的。

If a build fails

What I verified, and what I did not

Verified by running it today: a full end-to-end build from a clean checkout, the JDK and SDK selection, the key being adopted automatically into a tree that lacked it, all eight gates passing, the artifacts existing, and the signature and versionCode read back out of the package. Plus the permission question in §4 — which user NOVA runs as and whether it can read the key.

Not verified: that NOVA itself has been asked to run this yet — I proved the pipeline works under NOVA's conditions, not that NOVA has executed it. Also unverified: anything beyond building (phone install, Google sign-in, Play upload, whether Play accepts the size), which is out of scope here by your instruction.