Project Description: IMPORTANT: We are reposting this project because the previous developer could not demonstrate deep enough expertise in Android security and VPN lifecycle management. We are looking for a true Senior Android Engineer. Do not bid if you rely on wrappers or cannot handle low-level Android networking constraints. We are building a parental-protection app that enforces a secure, always-on WireGuard tunnel. Our backend is ready (providing JSON config); your job is to build the bulletproof Android client. THE CORE CHALLENGE The app is not just a VPN client; it is a security enforcer. The child must NOT be able to bypass the VPN. The OS must NOT kill the service (Foreground + Watchdog). The app must resist uninstallation (Device Admin / Anti-Tamper). CORE SCOPE (Native Kotlin Only) VPN Engine: Implement VpnService using WireGuard (official libraries or wg-quick-go). Zero-Leak Policy: Enforce "Always-On" behavior programmatically or guide the user to lock it. Implement a strict Kill-Switch (block all traffic if tunnel drops). Resilience (The Hard Part): Create a robust Foreground Service that survives aggressive battery optimization (Xiaomi/Samsung/OnePlus). Implement a Watchdog that checks tunnel health every 2-5 seconds and auto-restarts instantly. Anti-Tamper & Security: Device Admin implementation to prevent unauthorized uninstallation. Parental PIN gate for opening the app or changing settings. Prevent "Force Stop" where possible via policy or auto-restart. Integrations: Fetch configuration from our secure REST API (JSON). Store sensitive keys in Android Keystore (Non-negotiable). Multi-language support (English/Spanish resources). ACCEPTANCE CRITERIA (Strict) Connectivity: Internet access is strictly impossible unless the VPN tunnel is established. Stability: The VPN auto-reconnects within 5 seconds after a network change (WiFi <-> Data) or unexpected drop. Persistence: The service survives a device reboot and aggressive task killing attempts. Security: Uninstallation is blocked without the Parent PIN (via Device Admin). Quality: Clean Kotlin code, fully documented, passing QA on Android 10–14. WHAT I PROVIDE Backend API documentation & Test Server. WireGuard profile specs. MILESTONES (Non-negotiable Structure) 1) Core Engine Proof (25%) VpnService + WireGuard implementation connects to our server. Demonstrates successful traffic routing. 2) Hardening & Resilience (35%) Implementation of Always-On logic and Kill-Switch. Foreground Watchdog Service (auto-heal). Anti-Tamper: Device Admin implementation to block uninstall. 3) UI/UX & Logic (20%) Full UI implementation (Login, Status, PIN, Settings). Multi-language support (EN/ES). 4) API Integration & Polish (20%) Full backend integration (Token exchange). Final QA fixes and Code Handover. REQUIRED SCREENING QUESTIONS Please answer technically. Generic copy-paste bids will be ignored. Which specific WireGuard implementation strategy will you use (userspace, kernel-module, Go-backend)? How do you handle OEM-specific battery killers (e.g., Xiaomi MIUI, Samsung OneUI) to prevent the VPN service from dying? Explain your logic for the "Watchdog": how do you detect a "zombie" tunnel that looks connected but passes no traffic? Do you have experience implementing Device Admin to prevent uninstallation? BUDGET & TIMELINE Budget: $1,500 – $2,000 USD (Fixed) Timeline: 4–6 Weeks (We prefer quality/stability over speed). Note: We will request a code snippet or a brief technical interview to verify expertise before awarding.