Outside the home LAN NPM closes every request without X-Kvitt-App: <key>
(return 444); the LAN check reads $realip_remote_addr (NPM's X-Real-IP
realip makes $remote_addr forgeable) and Let's Encrypt's challenge passes
on the normalised $uri. Block rehearsed in NPM v2.16.0's openresty.
README: step 4a (key, keyed APK, gate, acceptance test), health checks,
stale CARGO_BUILD_JOBS text and owner decisions fixed. HANDOFF as of
2026-10-21.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
jacobh2
2acfc34a0e