1# Peach Android v2.17.3623## Security fixes45- Release signing passwords are now injected from `~/.secrets` through environment variables; the established keystore and signing certificate are unchanged.6- Vault restore keeps real and decoy slot records equal-length.7- Vault destruction reports failed preference commits or Codex-cache deletions instead of claiming success.8- Malformed Codex compression and no-progress streams fail closed.9- Gradle dependency verification now checks publisher signatures alongside existing hashes.10- Forged update-open intents are ignored without the app-issued one-time token.11- Marker-only Sync continuation chunks are rejected.12- Release tool selection remains pinned but accepts explicit Java and NDK paths with fail-closed checks.1314## Verification1516- Focused Codex, vault alignment, destruction, and release-signing checks passed.17- Full Android unit tests, lint, release assembly, native provenance, manifest, and Kepr helper gates are run before save.