v0.1.5

v0.1.5 — hardening release

A maintenance release focused on reliability and safety. Eleven verified issues found in external review of v0.1.4 — five medium and six low severity — are fixed, with nothing deferred. A follow-up review of this tree raised eight further low-severity points, which were also fixed and verified before publication.

Highlights:

• Cleartext loopback RPC is now permitted by an explicit, narrow network security configuration (127.0.0.1 and localhost only; cleartext denied everywhere else). The earlier working assumption — that the platform permits loopback cleartext by default — is not supported by primary sources for API levels below 37; see SECURITY.md for the correction.
• Orphan node recovery is licensed by provenance (incarnation-stamped pid records) instead of a consumable first-session flag, and an interrupted spawn leaves a marker so a later process can find and recover the orphan.
• Stop now escalates for the session's own child: destroy, bounded wait, then destroyForcibly.
• "Sync complete" requires evidence: a valid system_syncState response in the same session.
• Node log reading is chunk-bounded (no unbounded line accumulation), RPC calls have an overall deadline and are disconnected on stop, and build outputs are isolated per run.

No changes to the node launch arguments, the database, the permissions (still four), or the bundled node binary (still the versionCode 10 build).

APK: quantus-node-v0.1.5.apk, 55,700,262 bytes
SHA-256: 22ab1fe1faa9e07598a3b13f24dd7a299c8bef403af655239a7fe25029e9ec2e
Signed with the release certificate used since v0.1.0. An in-place update over v0.1.4 was confirmed on the reference device, with existing node data preserved.

Pre-release verification: 1,107 JVM harness checks passing, API-surface scan clean for minSdk 31, string keys consistent across all 9 languages, entry-level reproducible build comparison, and a full-repository consistency check with no corrections required.