GhostIDE v2.31.0 - Hardening marathon 2

Hardening marathon 2: twenty rounds (v2.12.0-v2.31.0) answering the second external audit. See BUILD_NOTES.md in this repo and HARDENING_PLAN.md + PAIRING.md in the ghost-ide repo.

What this round changed

• Pairing: join rate limiting (5 wrong codes / 10 min per source), guest roles (host-set view-only policy for new tokens; viewers read + heartbeat only), pair panel status/unpair/policy controls
• Containment: PathCheck component-aware checks at the workspace safe-path and all three archive extractions (eco, Python runtime, git templates); control-char path refusal
• Backups: inspect endpoint (validate without applying) + restore preview UI, envelope provenance (createdBy, appVersion), symlink-entry and truncated-archive probes
• Structure: PairHub and BackupService split out of IdeServer (after GitSupport); IdeServer.VERSION single source for health/update/backup meta
• Release integrity: changelog dates real again (tooling fix + 12 entries corrected), per-version commit messages restored, CI probe-log artifacts on failure, About panel shows live build evidence

Artifact

• ghostide-v2.31.0.apk, versionCode 136, 20,312,683 bytes
• MD5 b71084fe1e85662fc377892864e8154e
• SHA-256 18ce8204afed4a3ccd0af2a68f065a99a218448f0fc87e1b324288dc15d8774c
• Signer: the studio debug keystore (same certificate as every sideload build; the production upload key is separate and never in this repo)
• The APK binary is distributed through the studio's direct file link (see the device pass); the automation credential cannot attach assets (uploads.github.com is outside its scope), so verify any copy against the SHA-256 above.

Evidence (sandbox/JVM/CI class; device proof is the owner's pass, DEVICE_PASS_V231): 63/63 frontend harness files, JVM BkTest 15/15 + ZgTest 14/14 + PcTest 6/6, probes hardening 14/14 + restore 25/25 + pair 27/27 + GH-connect e2e 19/19, eco E1 ALL PASS, DOM-stub boot gate clean, staged bundle byte-match. Known open items, stated plainly: LAN pairing traffic is unencrypted (PAIRING.md), a process kill mid-restore-apply can leave a partial tree, and the stacked device pass for v1.58-v2.31 is still the owner's.

Update, Oct 22, 2026: the stacked device pass is done. Ryan installed this exact APK (SHA-256 above) and reported the consolidated DEVICE_PASS_V231 checklist working in full: "Everything works." Device proof is no longer outstanding for v2.31.0. The LAN-encryption and mid-restore-kill items above remain open as stated.