fix(android): consolidate release and correct recovery cancellation

.github/release/android-tag-signer-fingerprints.txt

@@ -0,0 +1,8 @@
+# Fail-closed production contract.
+#
+# Replace the line below, in a reviewed pull request, with the exact
+# `ssh-keygen -l -E sha256` fingerprint authorized to sign Android release
+# tags. Exactly one canonical SHA256 fingerprint is allowed. The matching
+# one-line OpenSSH Ed25519 public key must be stored as one-line base64 in the
+# ANDROID_RELEASE_TAG_SIGNER_PUBLIC_KEY_B64 GitHub Actions repository variable.
+UNCONFIGURED_ANDROID_RELEASE_TAG_SIGNER_FINGERPRINT

.github/workflows/branch-flow.yml

@@ -12,7 +12,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Branch flow audit self-test
         run: bash scripts/test-branch-flow-audit.sh

.gitignore

@@ -10,6 +10,8 @@
 app/src/main/aidl/
 app/*.apk
 /.idea/
+__pycache__/
+*.pyc
 
 # ignore jacoco coverage reports
 /coverage
@@ -26,3 +28,19 @@ debug-keystore.jks
 *.pem
 /.release-overlays/
 /buildSrc/build
+
+# Local temporary files and generated review artifacts
+/tmp/
+/.tmp/
+/tmp-*/
+/.tmp-*/
+*.tmp
+/output/
+/.playwright-cli/
+/playwright-report/
+/test-results/
+/review-output/
+/review-artifacts/
+# Dated local acceptance and review reports
+/docs/validation/20*/
+/docs/legacy-upgrade-audit-20*.md

AGENTS.md

@@ -10,15 +10,22 @@
 [![Android CI](https://github.com/soramitsu/fearless-Android/actions/workflows/android-ci.yml/badge.svg)](https://github.com/soramitsu/fearless-Android/actions/workflows/android-ci.yml)
 
 ## Project Structure & Modules
-- `app/`: Android app entry; build types `debug/release/staging/develop/pr`.
+- `app/`: Android app entry; build types
+  `debug/release/internalAppSharing/staging/develop/pr`.
+  `internalAppSharing` is a CI-only smoke variant signed by a run-bound
+  ephemeral Android Debug JKS; it is not a production distribution path. Its
+  Google Services task reads the checksum-pinned release placeholder directly,
+  and `app/src/internalAppSharing` must never be created.
 - `feature-*/`: Split by domain with `-api` and `-impl` modules (e.g., `feature-wallet-api`, `feature-wallet-impl`).
 - `core-api/`, `core-db/`, `runtime/`, `runtime-permission/`, `common/`: Shared foundations.
 - `test-shared/`: Test-only utilities reused across modules.
 - `buildSrc/`, `detekt/`, `scripts/`, `docs/`: Gradle plugins/config, static analysis, helper scripts, documentation.
 - Per-module sources: `src/main/java|kotlin`, resources `src/main/res`, unit tests `src/test`, instrumentation tests `src/androidTest`.
 
 ## Build, Test, and Dev Commands
-- Build app (APK): `./gradlew :app:assembleDebug` (use `assembleRelease` for release).
+- Build a local debug APK: `./gradlew :app:assembleDebug`. Release artifacts
+  must follow the protected, source-bound procedure in
+  `docs/releases/PROCESS.md`; do not invoke a local release task for distribution.
 - Full build + checks: `./gradlew clean build`.
 - Static analysis: `./gradlew detektAll` (auto-fix formatting: `./gradlew detektFormat`).
 - Unit tests (aggregated): `./gradlew runTest` (runs detekt, unit tests, JaCoCo report).
@@ -56,11 +63,23 @@
 ## Security & Configuration
 - Secrets are read via `scripts/secrets.gradle`; set in env vars or `local.properties` (see `README.md`).
 - Do not commit keys, keystores, provisioning files, or `local.properties`.
-- Polkadot runtime sources: to align with a specific Polkadot SDK release (e.g., `polkadot-stable2503`), you can override chain/type registries without code changes:
-  - `TYPES_URL_OVERRIDE`, `DEFAULT_V13_TYPES_URL_OVERRIDE`, `CHAINS_URL_OVERRIDE`
+- Internal App Sharing must run only through the dedicated
+  `android-internal-app-sharing.yml` CI path. Generate a new mode-`0600` JKS and
+  bind its certificate SHA-256 for that run; never commit or reuse the private
+  key. PR runs are non-distributable validation only and must not upload an
+  artifact. Only a manual run of the first-party workflow from the protected,
+  merged, current `develop` head may retain a seven-day verified GitHub Actions
+  handoff. The workflow must never upload to Google/Play or mutate a Play track.
+  Because IAS uses fake/empty public Firebase and OAuth values, do not claim it
+  qualifies live Firebase, Google sign-in, Drive/passkey backup, or restore.
+  When versioning changes, update the workflow/verifier hardcodes for
+  `4.2.0-ias` / `230` in the same reviewed commit.
+- Polkadot runtime sources: to align debug builds with a specific Polkadot SDK release (e.g., `polkadot-stable2503`), you can override chain/type registries without code changes:
+  - `TYPES_URL_OVERRIDE`, `DEFAULT_V13_TYPES_URL_OVERRIDE`, `CHAINS_URL_DEBUG_OVERRIDE`
+  - Release chain discovery is intentionally pinned to the canonical production URL and does not accept a chain-registry override.
   - Example in `local.properties`:
     - `TYPES_URL_OVERRIDE=https://.../all_chains_types_android.json`
-    - `CHAINS_URL_OVERRIDE=https://.../chains.json`
+    - `CHAINS_URL_DEBUG_OVERRIDE=https://.../chains.json`
   - After updating, run `./gradlew detektAll runTest :app:lint`.
 - Library version pinning: to use a specific `shared_features` version compatible with a Polkadot SDK release, set
   - `SHARED_FEATURES_VERSION_OVERRIDE=1.x.y`
@@ -69,12 +88,12 @@
 ## Local Properties (private)
 - Create a root-level `local.properties` with the required secrets and service credentials. Do NOT commit this file.
 - See `docs/samples/local.properties.example` and create a private `local.properties` at the repo root; replace placeholders with your real values.
-- Typical keys include: MoonPay, X1 plugin, Google Web Client IDs, Ethereum providers (Blast, Etherscan/BscScan/PolygonScan/OKLink), WalletConnect, Alchemy, Dwellir, TON API.
+- Typical keys include: MoonPay publishable keys, X1 plugin, Google Web Client IDs, Ethereum providers (Blast, Etherscan/BscScan/PolygonScan/OKLink), WalletConnect, Alchemy, Dwellir, TON API. Never put a MoonPay server secret in Android configuration.
 - Formats: use `key=value` per line; avoid trailing spaces. Strings may be unquoted; if values contain special characters or spaces, wrap in double quotes. Set `sdk.dir=/absolute/path/to/Android/sdk` to avoid SDK lookup errors.
 - Runtime overrides (mirrors recommended for first run):
   - `TYPES_URL_OVERRIDE=https://cdn.jsdelivr.net/gh/soramitsu/shared-features-utils@master/chains/all_chains_types_android.json`
   - `DEFAULT_V13_TYPES_URL_OVERRIDE=https://cdn.jsdelivr.net/gh/soramitsu/shared-features-utils@master/chains/default_v13_types.json`
-  - `CHAINS_URL_OVERRIDE=https://cdn.jsdelivr.net/gh/soramitsu/shared-features-utils@master/chains/v13/chains.json`
+  - `CHAINS_URL_DEBUG_OVERRIDE=https://cdn.jsdelivr.net/gh/soramitsu/shared-features-utils@master/chains/v13/chains.json`
 - Verify config: `./gradlew printPolkadotSdkAlignment` prints effective URLs and any shared_features pin before you run the app/tests.
 
 ## Utils Integration

CHANGELOG.md

@@ -4,7 +4,23 @@ All notable changes to this project will be documented in this file.
 
 ## 4.2.0
 
-- Promote stable from 4.2.0‑beta.1; no functional differences
+- Wallet safety: replace destructive database fallback with a complete,
+  fail-closed Room migration path and bounded recovery for incompatible legacy
+  wallet records.
+- Startup recovery: distinguish retryable secure-storage failures, permanent
+  key loss, database failures, and restart-required state before PIN, export,
+  signing, or the wallet UI can open.
+- Lifecycle stability: discard incompatible saved fragment state at the wallet
+  gate and restore security/export warnings through FragmentManager-safe
+  constructors.
+- WalletConnect stability: defer Reown delegate registration until both clients
+  are ready, retry partial initialization safely, and keep startup, session
+  lookups, pairing, and actions nonfatal when the optional SDK is unavailable.
+- Release safety: add an isolated, source-bound Internal App Sharing candidate
+  lane with zero-copy Firebase input, external one-run signing, and adversarial
+  artifact verification.
+- Transfers: reject Bitcoin and Solana amounts outside the signed 64-bit range
+  before any network or broadcast call.
 
 ## 4.2.0‑beta.1
 
@@ -14,4 +30,3 @@ All notable changes to this project will be documented in this file.
 - Platform: Android toolchain upgrades to meet Play requirements
 - CI/CD: NDK r28; native libs verification; Polkadot alignment printing; Jenkins stability
 - Fixes: banner closing (FLW‑5177); Ethereum recipient validation; confirmation/warnings UX; UI tweaks
-