chore: back-merge Android KYC release fixes into dev (TASK-22472)

[jjramirezn]

Summary

Back-merge release/android-kyc at 331002ff8 into current dev so the next production release retains the reviewed Android KYC build fixes.

Includes #3080 (retain Cordova's generated registry and check the final AAB for registry plus Sumsub class) and #3082 (grant the Android caller the permission required by the callee's isolated tag job). It also carries the isolated release-branch guards.

This is an additive merge from current dev. Only four native build files differ; later production app fixes and the content pointer remain intact.

Task and merge order

TASK-22472 · TASK-22471

Keep this PR in draft until #3081 lands. Then merge current dev into this branch, retain the main and release/android-kyc guards plus the updated operational runbook, and finish CI and Chip review. No human merge or deployment is authorized by this PR preparation.

Revert #3078 is closed without merge. This PR retains the current dev architecture.

QA and release gates

• YAML and XML parse; @xml/config remains in the Android resource keep list.
• Local gates pass: 560 unit suites, 6,922 tests (5 skipped), typecheck, and repository formatting.
• Source fix(android): TASK-22471 keep the Cordova plugin registry through resource shrinking #3080 documents a reproduced broken AAB before the fix and registry plus Sumsub class present after the fix. Chip checked those artifact assertions.
• Source fix(ci): TASK-22471 grant the android release call the write its tag job needs #3082 fixes a reproduced workflow-validation error in the native caller.
• No Android build or device QA is claimed by this back-merge. Native packaging changed; this is not a JS-only OTA fix.
• Before dispatching from main, verify it contains these reviewed native/KYC fixes and has passed the required native release QA.
• Screenshots: N/A (native packaging and workflows only).

[notion-workspace]

Allow native releases from main and integrate Android KYC release fixes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
peanut-wallet	Ready	Preview	Sep 9, 2026 7:21pm UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 1bb69132-ee4c-44e6-9620-c518e875248f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Code-analysis diff

Painscore total: 8914.96 → 8914.96 (0)
Findings: 0 net (+0 new, -0 resolved)

[github-actions]

🧪 UI test report — ✅ all green

Suites

• ✅ unit: 6927 ran, 0 failed, 0 skipped, 2.3m

📊 Coverage (unit)

metric	%
statements	76.7%
branches	63.0%
functions	70.8%
lines	77.7%

⏱ 10 slowest test cases

time	test
🐢 9.0s	src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx › Network failure keeps loading while retries remain, then shows the generic error
4.0s	src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx › MANTECA_MERCHANT_RECENT_REFUND fails fast with copy that names the real cause
4.0s	src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx › MANTECA_SOURCE_OVER_MONTHLY_CAP fails fast with copy that names the real cause
4.0s	src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx › User KYC not approved fails fast with copy that names the real cause
4.0s	src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx › routes the KYC rejection on its wire code, and does not retry it
4.0s	src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx › a refused idempotency key tells the user to scan again, not to contact support
4.0s	src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx › MANTECA_MERCHANT_VOLUME_NEAR_CAP fails fast with copy that names the real cause
4.0s	src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx › MANTECA_USER_NOT_PROVISIONED fails fast with copy that names the real cause
3.1s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › never places two stickers in heavy overlap (broad seed sweep)
3.0s	src/app/(mobile-ui)/qr-pay/__tests__/qr-pay-states.test.tsx › Going offline blames the connection, and reconnecting clears it for the recovered scan

_{📍 Inline annotations are in the **Unit test report** check above. Coverage artifact: `coverage-unit`. Generated by `.github/workflows/tests.yml`.}

[chip-peanut-bot]

This pull request was already closed when the review finished, so these findings are follow-up work rather than a gate.

Chip review — changes requested

The resource keep rule is sound, but the new AAB verification can reject a valid Android artifact and stop every release before upload.

Findings

• BLOCKING · .github/workflows/android-release.yml:320 · DEX probe false-fails under pipefail
  GitHub's bash runner enables pipefail. When grep -q finds this descriptor before unzip finishes streaming a large classes.dex, grep exits early, unzip receives SIGPIPE (141), and the pipeline evaluates false; FOUND therefore stays false and the valid release aborts before Play upload. This reproduces with an 8 MiB DEX containing the descriptor at its start. Consume the stream fully (for example, grep -aF ... >/dev/null without -q) or extract each DEX to a temporary file before searching it.

• MINOR · .github/workflows/android-release.yml:309 · [claude-opus] New shrinker guards for TASK-22471 ship without the unit tests this repo already uses for the identical prior incident
  The change adds two guards against the Android KYC "Class not found" regression: the @xml/config entry in android/app/src/main/res/raw/me_peanut_wallet_keep.xml:9, and the Verify Cordova plugin registration survived resource shrinking step in .github/workflows/android-release.yml:309. Neither is pinned by a test, and the repo has an exact precedent for pinning both kinds of guard after the previous shrinker incident: scripts/__tests__/android-proguard.test.js asserts the R8 keep rules for CapacitorPlugin/Permission are still in proguard-rules.pro, and scripts/__tests__/android-release-workflow.test.js:32-36 asserts the analogous Verify Capacitor permission metadata survived R8 step is still present in the workflow. This back-merge changes neither test file.

Untested case, concretely: a future cap sync regeneration, a merge conflict resolution, or a cleanup of the tools:keep one-liner drops @xml/config — pnpm test stays green and the failure only appears at release time. Worse, the AAB check is the sole remaining net, and deleting or renaming that workflow step also passes every test, which is precisely the state that let binary 1.5.0+21653381 reach Play with the registry stripped and every Android KYC launch failing.

Fix: add a case to scripts/__tests__/android-proguard.test.js (or a sibling) asserting me_peanut_wallet_keep.xml still lists @xml/config in tools:keep, and a case to scripts/__tests__/android-release-workflow.test.js asserting the workflow still contains Verify Cordova plugin registration survived resource shrinking plus the base/res/xml/config.xml and Lcom/sumsub/msdk/plugins/cordova/SNSMobileSdkCordovaPlugin; assertions — mirroring the existing CameraPlugin test one-for-one.

Inline anchors unavailable for 2 finding(s); the findings remain in this summary.

Checked clean

• Exact detached head, trusted author, dev base ref, and supplied base SHA all match; the merge base is the supplied base SHA.
• Reviewed the four-file diff and commit history for the release-branch guards, Android resource keep rule, AAB assertions, and reusable-workflow permission grant.
• Confirmed the generated Cordova registry and Sumsub native class are part of the Android build surface and that release builds enable resource shrinking.
• Reproduced the new large-stream unzip | grep -q probe under bash -o pipefail: a present descriptor returns pipeline status 141; the proposed consuming grep form succeeds.
• Exact-head CI reports unit, typecheck, eslint, format, native-export, human-authors, and aggregate CI checks successful.

Security review by moonshotai/kimi-k3: 0 finding(s), marked with the model name. It reads the diff only and answers only security, privacy and money, so treat its findings as advice.

Third opinion by claude-opus: 1 finding(s), marked with the model name. It answers only product truth, missing tests and the cross-repo contract, so treat its findings as advice.

Exact head: 94e8d78b2137 · Context: repo · Took 9m