A watch-only Bitcoin wallet for Android: track xpubs, addresses and cold-storage wallets, derive receive addresses on the go, and broadcast pre-signed transactions — entirely over Tor, paired exclusively with a Bitcoin Dojo you control (or one from the community directory; visit https://DojoBay.org for more info).
This is a community continuation, not a new project. Credit where it belongs:
- Samourai Wallet — original Sentinel (code preserved in the Samourai-Wallet GitHub org; their web domains were seized in 2024 and later hosted phishing — treat any samouraiwallet.* site as hostile)
- tetragrammalol/sentinel-android-dojobay — the maintenance arc merged back here in October 2026: the kmp-tor 2.x migration, BIP-329 labels, Whirlpool autolabels, Bad Bank and the tag-triggered release pipeline
- fixes adopted from wanderingking072's fork (authored by @MightyMercurian)
Samourai Sentinel went dark in 2024. This repository revived it as the Dojo Bay edition, taking the Dojo-or-nothing direction after the original infrastructure was seized.
tetragrammalol/sentinel-android-dojobay forked from here at 36a7e27 ("Dojo onboarding, BIP84 default, UTXO labels, staging CI, and Network screen fixes", 2026-09-06) and carried the maintenance arc forward while this tree was quiet. That work — 161 commits, including the BIP-329 support first offered as #5 — merged back here as #6 in October 2026. This repository is the canonical tree; the fork mirrors this history and remains an active contributor.
Merged here as #6. Issue numbers in this section and the next refer to the contributor's tracker, not this repository's.
| Area | Status |
|---|---|
| kmp-tor 2.x migration (in-process TorRuntime) | done (#2, #10) |
| Tor watchdog: bounded auto-recovery from boot=0 wedges | done (#11, #14) |
| Boltzmann entropy/linkability per tx | done (#7) |
| Whirlpool autolabels: TX0/mix/remix detection | done (#40, #43) |
| Bad Bank deduction + lineage propagation | done (phase 1 via #53; umbrella #46, phase 2 = #54) |
| BIP-329 label management (import/export/edit/render) | done (#24; first offered here as PR #5) |
| Dojo-or-nothing: dead Samourai API key + build plumbing removed | done (#22, #23) |
| QR pairing payload guard, string extraction, directory name+flag | done (#25, #21, #17) |
| Dependency bumps one-family-per-PR (okhttp, coroutines, hummingbird) | done (#28, #29, #30) |
| Build deprecation sweep + CI modernization (checkout v5, setup-java v5, ubuntu-26) | done (#33, #59) |
| minSdk 21 -> 23 (Android 5.0/5.1 dropped) | done (#60) |
| minSdk 23 -> 24 (Android 6.0 dropped) | done (#236) |
| Tag-triggered release pipeline (APK + SHA-256) | done (#39, #63, #65, #67) |
| Ordered catch arms for escape-class errors (ApiNotConfigured et al.) | done, partial (#103, #125, #131) |
| Live tx-facts row retired; Confirmation renamed Confirmations | done (#119, #127) |
| Connection light GREEN only at full bootstrap; staged climb UX | done (#99, #134) |
| Dojo boot gating: sync/websocket wait on boot=100 + SOCKS listener | done (#135 arc: #136-#139) |
| Entropy kill switch (nothing displays pending the re-enable design) | done (#106) |
- Bad Bank Tainted — mixed-input propagation, phase 2 of #46 — #54
- Bad Bank chips in tx details and tx list — #55
- Per-tx entropy re-enable, tiered: local <=5x5, am-i.exposed deep link for wide rounds, boltzmann-rs port for 6x6-9x9 — #107
- CancellationException laundering at BroadcastTx and ImportSegWitService — #129
- Mid-sync tx-table flicker / tx-sheet kick-out on fresh re-pair — #124
- "Sync interrupted." flash on routine refresh — #132
- Tor connection streamline (dormancy wake, post-bootstrap onion latency) — #135
- Dead-code sweep — sweep/ package, WebUtil stubs, send/PushTx trustedNode, LBC/BFX constants — #79
- Mask sensitive data — dojo onion hostnames in logcat traces, XPUB/pairing payload handling in shared storage — #96
- 16 KB page-size for native libs (camera libs compliant; Tor leg pending kmp-tor-resource#192; benign while sideloaded) — #20
- Remaining on-device smoke debt: Dojo pairing/sync, websocket reconnect, animated-UR scan — #36
- Bip329Parser network classification unification with NetworkClassifier — #64
- BBQR (BQR:) label import alongside animated UR — #70
- Animated-UR label scan UX (minutes-long scans on small exports) — #71
- Fee defaults 1-4 s/vb unusable on congested mempool — #77
- Analytics provider chooser (local-first, separate PR) — #8
- OXT seen-backend successor when an API lands — #9
- Vendored bitcoinj suite fails locally on Kali JDK (locale data; CI green) — #75
- Fork version line: stay v5.1.3-dojobay.N or major-bump to v6.0.0 — #66
Labels are a first-class subsystem:
- Whirlpool autolabels classify TX0/mix/remix transactions from account identity alone — no explorer lookups, never implying anonymity gain.
- Bad Bank pins the toxic change output ("badbank") of Whirlpool Tx0s and propagates the label to descendant spends of wallet-derived UTXOs; the mixed-input (Tainted) class is the queued next phase.
- BIP-329 is the storage format: import/export/edit/render with total parser semantics (absent label = do not alter, empty = explicit clear, cross-network refs rejected, origin and createdAt preserved), verified round-trip against Sparrow in both directions. Labels are privacy-sensitive metadata: stored locally only, network-scoped, hidden under street mode.
Manual and imported labels always win over automatic ones.
- Embedded Tor runs in-process (kmp-tor 2.x TorRuntime) with a watchdog that recovers boot=0 wedges: stop first, wipe tor state, rebuild, restart — bounded, with a retryable error when the recovery budget is exhausted.
- The connection light is GREEN only at boot=100 with a live SOCKS listener; the post-ON climb renders as legible stage summaries on the Network screen and during Dojo import.
- The first sync round and websocket connect are gated on full bootstrap; directory-fetch probe failures explain themselves in plain language with one auto-retry.
- Directory and Dojo traffic goes only through the app's SOCKS proxy to onion services; the Dojo Bay directory itself is an onion service. No clearnet Samourai endpoints are contacted. Sentinel never holds your private keys.
Tagging a v* tag runs the release workflow: a gated job builds the staging
flavor and publishes the APK plus a SHA256SUMS.txt to GitHub Releases. The
pipeline arrived with #6, which had been cutting v5.1.3-dojobay.N
prereleases on the fork; the version line to use here is still open, and the
app reports 5.1.2 internally either way.
The staging flavor installs as Sentinel Beta (applicationId
com.samourai.sentinel.staging) and coexists with a production Sentinel
install. Grab an APK from the
Releases
page, from the
Actions
build-staging-apk artifacts, or build it:
./gradlew :app:assembleStagingDebug
Requires a JDK 21+ compatible toolchain (Room runs via KSP; kapt is gone); CI builds on Temurin 21. minSdk is 24 (Android 7.0+).
Experimental community software, provided as-is, with no affiliation to Samourai Technologies or Dojo Bay operators. Read the code; that is the point of a wallet like this.