Source snapshot validation — 2026-09-25

172 JVM/Robolectric tests passed with freshly generated synthetic test identities.
Source-only debug APK build and debug lint passed.
The credential-asset guard rejected a synthetic .pk8 probe and passed after it was removed.
APK inspection found no offline-mfi assets or credential-container files.
Static test private-key/certificate files have been removed from the source snapshot.
No new public APK or CarPlay compatibility claim is made. This development build lacks accessory authentication provisioning.

The original release and incident records are preserved locally with restricted access. See SECURITY.md.