[DoodleBears]

Refs #2599 · Parent #2598 · Claim

Task: codex/local/01a1639d-a211-7a30-a976-b6f6416ca9b1

Why the change

Fix the four missing-attribute errors that stopped the shared Android Release build at :app:lintVitalRelease by making each existing network-security domain explicitly exact-match.

Special things to note

• Merge risk: two-way door — revert this patch; small blast radius — four attributes in the generated network-security policy, with the same hosts and general cleartext denial. Review all four false values; no wildcard or subdomain access is added.
• Source-only repair requested by the shared QA center. git diff --check passed; Exact-head CI 39838495115 passed all applicable jobs: static lint/format/typecheck/build, selected tests, mobile verification and isolated Host smoke. Native-module/full-shard/docs jobs were skipped by the plan; they are not native-build passes. Local source checks were not repeated; the center has now passed Release lint and both Android builds on the merged main recorded below. The previous LAN Kotlin compilation passed, but that does not qualify this fix. A new native build is required; no QA worktree or generated native file was modified.
• No visible UI or architecture change; the compact diff below is the review aid, so no new screenshots or HTML explainer are needed for this patch. Original LAN T1: independent encrypted phone pairing, DM and revocation #2599 native LAN acceptance remains open.

Change outline

The source config plugin generates the same four exceptions:

- <domain>encrypted-lan.invalid</domain>
+ <domain includeSubdomains="false">encrypted-lan.invalid</domain>
- <domain>localhost</domain>
+ <domain includeSubdomains="false">localhost</domain>
- <domain>127.0.0.1</domain>
+ <domain includeSubdomains="false">127.0.0.1</domain>
- <domain>10.0.2.2</domain>
+ <domain includeSubdomains="false">10.0.2.2</domain>

The existing native LAN socket test now asserts the complete four-domain declaration and base-config cleartextTrafficPermitted="false"; a bilingual release fragment records the build fix.

Proposed local source check (not yet allocated): pnpm exec vitest run apps/mobile/test/native-lan-socket.test.ts --maxWorkers=1 --no-file-parallelism. After merge, the QA owner cuts a new recorded main revision and reruns prebuild/Release lint through the shared lane; the failed frozen build is preserved as evidence.

Merged at 2026-10-22T19:22:49Z as 843d84b1c304a6dfac4c405c1da70ebfe2512ed1. The QA center rebuilt this exact main; the prior 9cd926c0 Release lint failure remains recorded. Binary qualification below does not claim phone acceptance.

Android build qualification PASS — 2026-10-22: exact main 843d84b1c304a6dfac4c405c1da70ebfe2512ed1, including #2597/#2600/#2605. Fresh prebuild emits four includeSubdomains="false" attributes; :app:lintVitalRelease passes. Release build succeeded in 17m41s and Debug in 4m47s, serial Gradle max-workers 2, actual Node 24.21.0 / pnpm 12.4.2.

Artifact	Bytes	SHA256
Release, arm64-v8a	52,749,174	9018D62C4CD5B3EDC79C8BE9DF0EFB49BF873F9B0C5AE85B0D7FC628EC928E44
Debug, arm64-v8a	116,489,638	EF7BE31A0E7E8DB05D72AB001491E83CDCF35EB40561EAFB418014E906336ED8

Both use ai.botharness.deepseekbot.dev and the existing local debug signer; neither is a store distribution build. Actual APK package/ABI/signature, LAN DEX class and compiled network-policy binding passed inspection. Release class/resource renaming was resolved through R8 mapping and the APK resource table. Release contains the JS bundle and is non-debuggable.

Final strict post-CNG Android fingerprint, including the generated native directory: 1da81501f7520b1b26002d234fae90eb3041b389 (234 sources). This was recomputed serially after stable builds; an earlier computation overlapping prebuild was discarded. Do not equate this mode directly with a pre-CNG fingerprint.

UNTESTED: installation/cold launch of these APKs, encrypted LAN pairing/offline Feed/DM/restart/revoke/disable, performance/FPS, screenshots and iOS. No app install, Host, Metro or phone UI/settings/pairing/reverse changes occurred. Only designated POCO Android 16/API36 identity/ABI/OS was read. Own processes/listeners were cleared and lease released at 20:04:15.7163242Z; global ADB was untouched.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4a944b3e-aa1c-42e4-b3f5-c1497fc2711f

📥 Commits

Reviewing files that changed from the base of the PR and between bdcc996 and e7fcdc2.

📒 Files selected for processing: 3

• apps/mobile/test/native-lan-socket.test.ts
• apps/mobile/with-lan-channel.js
• changes/2599-lan-release-lint.md

+----------------------------------------------------------+
| This regex looks like you sneezed on the keyboard-twice. |
+----------------------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}