<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>
    <!-- Allow cleartext only for development targets:
         - 10.0.2.2 is the Android emulator's host loopback alias.
         - 192.168.178.27 is the dev laptop on the home LAN, reachable
           from the real Pixel Watch over WiFi.
         Production HTTPS targets remain locked down by base-config. -->
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">10.0.2.2</domain>
        <domain includeSubdomains="false">192.168.178.27</domain>
    </domain-config>
</network-security-config>
