NetExperts fixed homeserver policy — 25 October 2026

Every normal webpack build compiles NETEXPERTS_HOMESERVER as the literal https://synapse.nxx.au. SdkConfig normalizes mutable downloaded configuration and enforces trusted mode/provider lock. Config.json, query/deep-link URLs, user preferences, runtime global variables and discovered m.homeserver.base_url cannot change the API provider.

Every application-created Matrix client uses utils/NetExpertsClient.ts, which rejects foreign API base URLs before construction. This covers password/reset/registration, stored-session restoration, legacy SSO, QR, OAuth whoami, welcome and normal sync clients. Direct MatrixClient constructions in discovery and QR were also replaced. Stored credentials are validated before persistence or destructive session clearing. Login-response well_known cannot delegate m.homeserver. Static/server-name discovery and QR negotiation validate the provider. OAuth validates its Matrix API target before start/completion; it does not pin the legitimate OIDC issuer.

Only the Matrix homeserver is pinned: other well-known metadata, delegated OIDC issuer metadata and MatrixRTC foci remain supported. Transport security, authentication and private room permissions are unchanged.

A local QA override requires a separate development-mode webpack build with NETEXPERTS_QA_HOMESERVER=http://127.0.0.1:61040. Any other value, or any override in production mode, aborts the build. That development bundle refuses to run on a non-loopback application origin. Editing config.json is no longer a QA endpoint override. Unbundled upstream unit tests omit the compile constant; product-policy tests explicitly set it. All shipped packages use production mode and the literal public endpoint.

Tests: NetExpertsHomeserver.test.ts has13 policy tests, including malformed/foreign/scheme/path/userinfo/loopback URLs, editable config, login-response delegation, persistent client and discovery. Combined relevant config/login/session/QR/OAuth suite has115 passing tests. TypeScript and production webpack build pass. qa-homeserver-pin.mjs tests actual compiled Chrome app with hostile config/query/stored-provider/global override and full foreign Matrix username; no foreign-provider requests are allowed. This is endpoint immutability in supplied builds, not a claim to prevent an owner editing source code or browser developer tools.
