ruizkinio · ruizkinio · Aug 13, 2026 · Aug 13, 2026 · Aug 13, 2026
diff --git a/docs/RELEASE_NOTES_DRAFT.md b/docs/RELEASE_NOTES_DRAFT.md
@@ -54,8 +54,8 @@ code, token, or provider URL.
 | `Jumpgate-22.0-ALPHA2-Jumpgate-3.0.0-armeabi-v7a.apk` | `9ff620c0d07f7dffd960a0b7620b30dfcbbdb7efcbe5e969ac719b7d643ab763` | `armeabi-v7a` | `io.github.ruizkinio.jumpgate` | `10625572b5f34c5125b030dd5ab5fd40bdcd263d0fa8e2073ddee70435970551` |
 
 - Jumpgate Kodi commit: `b105087fb2ec00db4576e2f4b1221f9c45acd84f`
-- Bridge commit: `28848c13ae515c651e267e1f1ab9f24ebabd168c`
-- Bridge image digest: `sha256:05e9d5a79aaff27a81b61f548bef78933ec541d5af59b1d1f2bcb2cc3ca17b6a`
+- Bridge commit: `a2716ae68e9ce88561ed0ebc9ec1092cd20c3535`
+- Bridge image digest: `sha256:08599364f5bfdc6573bdf8e4d0e91ee4e0d7e38433e60fc993773e55dce21618`
 - Candidate lock commit: `86c5ee83211c48c49b386aa0fe3df0ec3d61c47a`
 - Protected non-physical release validation: `https://github.com/ruizkinio/Jumpgate/actions/runs/31706953795`
 - Sanitized device UAT evidence: `{{UAT_EVIDENCE_URL}}`

diff --git a/docs/RELEASE_STATUS.md b/docs/RELEASE_STATUS.md
@@ -5,11 +5,11 @@ candidate is locked to these public component commits:
 
 | Input | Public branch | Candidate commit |
 | --- | --- | --- |
-| Bridge | `Jumpgate-bridge/main` | `28848c13ae515c651e267e1f1ab9f24ebabd168c` |
+| Bridge | `Jumpgate-bridge/main` | `a2716ae68e9ce88561ed0ebc9ec1092cd20c3535` |
 | Kodi | `Jumpgate-kodi/master` | `b105087fb2ec00db4576e2f4b1221f9c45acd84f` |
 
 The Bridge is deployed at immutable image digest
-`sha256:05e9d5a79aaff27a81b61f548bef78933ec541d5af59b1d1f2bcb2cc3ca17b6a`.
+`sha256:08599364f5bfdc6573bdf8e4d0e91ee4e0d7e38433e60fc993773e55dce21618`.
 Protected deployment provenance and live health checks pass for that digest.
 
 Kodi's protected stable release workflow produced signed `arm64-v8a` and
@@ -24,6 +24,9 @@ physical UAT passes.
 - Bridge deployment attestation, live image digest, `/health/live`, `/health/ready`,
   and `/version` pass.
 - Kodi host tests and both Android ABI builds pass protected CI.
+- The deterministic UAT-only VobSub provider passes live HTTPS transport and
+  integrity checks against the exact merged Bridge commit. Its isolated Fly image
+  is test infrastructure and is not part of the production candidate lock.
 - The reproducible public-history audit in protected run `31706953795` reports zero
   unresolved findings. That run also independently verified the final Jumpgate and
   Stremio APKs, Bridge deployment provenance, live Bridge state, and current GitHub

diff --git a/release/candidate.json b/release/candidate.json
@@ -5,24 +5,24 @@
     "bridge": {
       "repository": "https://github.com/ruizkinio/Jumpgate-bridge.git",
       "branch": "main",
-      "commit": "28848c13ae515c651e267e1f1ab9f24ebabd168c",
-      "imageDigest": "sha256:05e9d5a79aaff27a81b61f548bef78933ec541d5af59b1d1f2bcb2cc3ca17b6a",
+      "commit": "a2716ae68e9ce88561ed0ebc9ec1092cd20c3535",
+      "imageDigest": "sha256:08599364f5bfdc6573bdf8e4d0e91ee4e0d7e38433e60fc993773e55dce21618",
       "provenance": {
-        "runUrl": "https://github.com/ruizkinio/Jumpgate-bridge/actions/runs/31697768697",
+        "runUrl": "https://github.com/ruizkinio/Jumpgate-bridge/actions/runs/31727797491",
         "workflowId": 320575057,
         "workflowPath": ".github/workflows/fly-deploy.yml",
         "event": "push",
         "branch": "main",
         "headRepository": "ruizkinio/Jumpgate-bridge",
         "imageArtifact": {
-          "id": 9180010405,
-          "name": "jumpgate-image-28848c13ae515c651e267e1f1ab9f24ebabd168c",
-          "archiveDigest": "sha256:44a64b91982fcacf271ddd2c8567ef42491ac25db7820aa5144e2f1fa02dbc9d"
+          "id": 9191991638,
+          "name": "jumpgate-image-a2716ae68e9ce88561ed0ebc9ec1092cd20c3535",
+          "archiveDigest": "sha256:b67971493345e5c4f7004ba48ea4ed04084899ec02082935bcb5e36ea4650403"
         },
         "deploymentAttestationArtifact": {
-          "id": 9180257108,
-          "name": "jumpgate-deployment-attestation-31697768697-1-28848c13ae515c651e267e1f1ab9f24ebabd168c",
-          "archiveDigest": "sha256:e0f3767582911653c3a937b0409e9fa4c0677f0dfbe15b3bcd30cef193d9490c"
+          "id": 9192230605,
+          "name": "jumpgate-deployment-attestation-31727797491-1-a2716ae68e9ce88561ed0ebc9ec1092cd20c3535",
+          "archiveDigest": "sha256:99dfb5fd3a749648c0e6e5a36cd682008d9eee4e46ea5d4c14a2a3a580cbc96a"
         }
       }
     },

diff --git a/release/tests/validate-release.test.mjs b/release/tests/validate-release.test.mjs
@@ -509,7 +509,7 @@ test("rewritten Kodi history requires the exact clean anchor and protected PR ch
   );
 
   assert.deepEqual(COMPONENT_POLICIES.bridge.requiredPullRequests, [
-    1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
+    1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21,
   ]);
 });
 
@@ -596,7 +596,7 @@ test("audited component executable closures are exact and reject byte or policy
       ["scripts/ci/fly-managed-rollout.js", "9cc954b815c012130e636f9fc2944873561efe7d1b3cf9f1bb7068f9cee7245f"],
       ["scripts/ci/deployment-attestation.js", "8bdd29ef1c9ae853bf90ed438f39d1083ea05526779e553971833ee00c87ffc0"],
       ["scripts/ci/http-smoke.js", "c1a658a8e17d4eed4041c71ac8834fe9ef254a59c9f075a81b10cdd83a223ff0"],
-      ["package.json", "0afead6fde8d3ed72e8f98d49f2883ef10d3917cbf646ce7a8828c1cdbe05d51"],
+      ["package.json", "9676fb8056525cc68504fb91565c857f81fa5a12f75548b8b8ba0be65534c2c7"],
       ["package-lock.json", "00e73f23ee5363e2e753d81e28cba047bc8bce7ba5a360be00608b792dd18016"],
       [".npmrc", "89570b4333de5a4920e113d299e774c671b4e83ebfe34757ad27c3960a7bd269"],
       ["fly.toml", "723cfbe7a912d2d2bd0b70f7e113d6e676349825a5a875d250a891a09dc05c99"],

diff --git a/release/validate-release.mjs b/release/validate-release.mjs
@@ -36,7 +36,7 @@ export const COMPONENT_POLICIES = Object.freeze({
       }),
       Object.freeze({
         path: "package.json",
-        sha256: "0afead6fde8d3ed72e8f98d49f2883ef10d3917cbf646ce7a8828c1cdbe05d51",
+        sha256: "9676fb8056525cc68504fb91565c857f81fa5a12f75548b8b8ba0be65534c2c7",
       }),
       Object.freeze({
         path: "package-lock.json",
@@ -52,7 +52,7 @@ export const COMPONENT_POLICIES = Object.freeze({
       }),
     ]),
     requiredPullRequests: Object.freeze([
-      1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
+      1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21,
     ]),
   }),
   kodi: Object.freeze({

diff --git a/stremio-addon b/stremio-addon
+2 −0		.dockerignore
+4 −0		.gitignore
+42 −0		Dockerfile.uat
+12 −3		README.md
+2 −0		fly.uat.toml
+242 −27		index.js
+11 −1		lib/pairing-coordinator.js
+19 −4		lib/release-validation.js
+2 −0		lib/storage/uat-release-bootstrap.js
+204 −0		lib/uat-vobsub-fixture.js
+1 −0		package.json
+4 −0		public/release-validation.html
+20 −1		public/release-validation.js
+99 −0		scripts/uat-vobsub-author/Program.cs
+15 −0		scripts/uat-vobsub-author/README.md
+15 −0		scripts/uat-vobsub-author/author.csproj
+230 −0		scripts/uat-vobsub-live-smoke.js
+1 −1		test/bridge-regression.test.js
+335 −2		test/release-validation.test.js
+14 −1		test/uat-release-bootstrap.test.js
+54 −0		test/uat-vobsub-live-smoke.test.js
+29 −0		uat-fixtures/vobsub/README.md
+ −		uat-fixtures/vobsub/jumpgate-uat-vobsub-v1.mp4
+ −		uat-fixtures/vobsub/jumpgate-uat-vobsub-v1.zip