- Pinned-root network security config (D-082) is now a template in
app/src/releasePinnedRoot/; with kvitt.tls.pinnedRoot=true the task
generatePinnedRootNetworkSecurityConfig writes it into the release
resources with the domain kvitt.publicHost (D-121), and stops with a
clear message while the root src/release/res/raw/kvitt_root_ca.crt is
not committed (fallback unprepared, SPEC 10.5.3). Comment: pinned NPM
root (D-120).
- Port 443 (D-124): RELEASE_SERVER_URL is https://<kvitt.publicHost>
without a port (RELEASE_SERVER_PORT removed); the AC-2.6 intent filter
has no android:port; InviteLink drops an explicit default port.
- S-1 fixture GOLDEN_SERVER https://kvitt.example.org; 28 S-1 goldens
re-recorded (only the server row changed).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
jacobh2
038c6036fe