OpenVM from-scratch Android VM progress

[MatDayProjects]

🚧 OpenVM from-scratch Android VM progress

This is the rolling progress record for the from-scratch OpenVM implementation. Related milestones, CI verdicts, artifacts, corrections, and remaining runtime boundaries are posted as comments on this one thread.

Current state

Area	State	Evidence
Open-source Android control plane	✅ Implemented	VM profiles, strict guest manifest, bounded QEMU process adapter, local VNC/RFB surface, import/export, history, settings, regex builder, and tests are on main
Native QEMU packaging	✅ Static/package milestone	Commit 9cac110; runs 31319585339 and 31319585312 completed successfully
Unsigned artifact enforcement	🏃 Correction in progress	Final byte audit found the previous debug APK used Android's implicit debug identity; a fresh local correction now produces unsigned debug/release APKs and AAB with 43/43 unit tests passing
Android guest boot/display/serial/file transfer	⏳ Waiting	No compatible guest kernel/initrd/raw image has yet been supplied and booted through the production path

Important

The repository does not generate, store, or use a signing identity. Stock Android refuses to install unsigned APKs, so current workflow evidence is static packaging and unit-test evidence rather than an APK-installation claim.

廣東話：OpenVM 個地基、QEMU runtime 包裝同 Android control plane 已經落到 main，但真正 guest Android 開機、畫面 ready、serial console 同 file transfer 仲要實機證據。最後 byte audit 捉到舊 debug APK 畀 Gradle 偷偷蓋咗 Android Debug 印；而家修正緊全線 unsigned，未有 hosted replacement verdict 就唔會扮完成。

Completion gates

• Source and native runtime packaging merged to main
• Default-branch static/unit-test workflows completed successfully for 9cac110
• Merged task branch and linked worktree cleaned after ancestry proof
• Replacement CI proves every APK/AAB artifact is unsigned
• Compatible Android guest image boots through the production adapter
• Display readiness, serial console, and host-to-guest file transfer are verified

Why this thread remains open

QEMU executable probes and APK packaging do not prove that a guest operating system booted. Completion requires a compatible guest artifact set plus an observed readiness signal from the real runtime path. Until that evidence exists, the project is a substantial runtime milestone rather than verified VMOS feature parity.

[DingDingChae]

🧪 Local unsigned-artifact verification milestone

Important

These changes are still uncommitted on top of 9cac1106a041a4d40dab3b9ebd4259372e8b5929. This comment records local evidence only; replacement GitHub Actions runs have not started and no hosted success is being claimed.

What was corrected

• Both Android debug and release build types explicitly use signingConfig = null.
• The debug app APK, instrumentation APK, release APK, and release AAB are built in disposable HOME, ANDROID_USER_HOME, and GRADLE_USER_HOME directories.
• A new standard-library verifier rejects JAR/v1 signature metadata, APK v2/v3 Signing Blocks, detached v4 .idsig files, malformed ZIP archives, and signing-material filenames.
• aapt2, zipalign, apksigner, and jarsigner provide independent follow-up checks. A generic verifier failure is never treated as unsigned proof.
• Live installation/instrumentation is intentionally not attempted because stock Android refuses unsigned APKs.

Evidence

Check	Result
Clean Gradle build	✅ 119 tasks completed
Android unit tests	✅ 43 tests, 0 failures, 0 errors, 0 skipped
Verifier regression tests	✅ 7 tests
Generated signing-material filenames	✅ 0
Known historical debug-signed APK	✅ Rejected: APK Signing Block is present
actionlint -shellcheck=	✅ Structural validation passed; hosted Linux remains the shell-content verdict

Artifact	SHA-256	Local verdict
app-debug-androidTest.apk	691375f9c7e21ebb862a52ba15e56f64dac8966ee57d7ba7c1e81d948fd5dfe7	✅ valid and unsigned
app-debug-unsigned.apk	ac25dbb3891991c6142fe5565dc4b2b87c2bbca5f57cd76ad8639dc8adc19ec7	✅ valid and unsigned
app-release-unsigned.apk	2cd3d9f840fb6535a9d4cefbd758a79c413c76b21168e8a121bcc82e558ebc3f	✅ valid and unsigned
app-release.aab	6300eca9ff42b01d1d84f56d08d0ba08d061836e17cbdac5249a362c0df68670	✅ valid and unsigned

Commands and verification boundary

./gradlew clean verifyUnsignedBuildTypes testDebugUnitTest assembleDebug assembleDebugAndroidTest assembleRelease bundleRelease
python scripts/verify_unsigned_android_artifacts.py app/build/outputs/apk app/build/outputs/bundle
python -m unittest scripts.tests.test_verify_unsigned_android_artifacts -v
actionlint -shellcheck= .github/workflows/android-ci.yml .github/workflows/android-native-qemu.yml .github/workflows/android-release.yml

No visible application surface changed in this correction, so a screenshot would not show the affected build/signature boundary. The relevant evidence is the failing-then-passing artifact inspection above.

廣東話摘要

之前個 debug APK 靜雞雞拎咗 Android Debug 簽名，今次唔再俾佢戴住假鬍鬚扮 unsigned。四件 Android artifacts 而家都由獨立 parser、Android build-tools 同 Java verifier 分開驗證；local build、43 個 Android unit tests 同 7 個 verifier tests 全部通過。GitHub Actions 仲未跑，所以而家只係 local verified，未扮 hosted 已經綠燈。

Next gate

• Complete the independent security and CI portability reviews.
• Commit and push the correction.
• Verify replacement GitHub Actions runs and download their artifacts for the same byte-level checks.
• Keep Android guest boot readiness open until a compatible guest kernel/initrd/raw image is supplied and booted.

Recorded at 2026-08-09T13:21:58-04:00.

[MatDayProjects]

🚀 Unsigned correction pushed; hosted verification running

Important

The commits are now on the default branch, but all three hosted workflows are still running. This is a pushed milestone, not a hosted success claim.

Landed commits

Commit	Purpose
52300f74319f74ebea6fc7fbf025b4644df22976	Disable implicit debug signing; add APK/AAB Signing Block, JAR metadata, detached-signature, signing-file, ZIP, and symlink checks; require exact app/test APKs; pin bundletool; stage only verified packages; add CI context manifests and 17 regression tests.
0153e1c5a00e63efe1a8679926daa8ace5872a6f	Link the exact implementation commit in the changelog and handoff.

The first push attempt was refused because the locally active DingDingChae account had read-only repository permission. The existing authenticated MatDayProjects owner account was selected, its ADMIN permission was verified, and the normal non-force push then succeeded. No history was rewritten.

Hosted gates

Workflow	Run	Current state
Android CI	31327047886	🏃 running
Android Native QEMU	31327047882	🏃 running
Android Release (release=true)	31327061429	🏃 running; unsigned validation only

The release workflow was manually dispatched against the exact 0153e1c5a00e63efe1a8679926daa8ace5872a6f commit. It does not publish a release and contains no signing operation.

Review resolution

• Reject APK Signing Blocks in AAB containers as well as APKs.
• Keep failed or unchecked packages outside uploaded evidence.
• Reject file and directory symlink escapes.
• Validate real AAB semantics with checksum-pinned bundletool 1.18.3.
• Require exactly one debug app APK and one instrumentation APK.
• Add run/attempt/commit/job/runner context beside every produced artifact.
• Force verifier output parsing to the C locale.
• Commit the verifier and both test modules with the workflows that invoke them.

廣東話摘要

兩個 commits 已經落咗 default branch，舊 debug APK 嗰張「冇人邀請嘅簽名相」而家由 parser、Android tools 同 bundletool 三邊夾擊。第一次 push 用錯咗 read-only account，所以 GitHub 好老實咁閂門；轉返已登入、已驗證有 ADMIN 權限嘅 repository owner account 後，普通 push 成功，冇 force、冇改歷史。三條 hosted workflows 仲跑緊，未出成績就唔會扮綠。

Next gate

• Wait for all three runs to finish.
• Download each package/evidence artifact and repeat the byte-level unsigned checks.
• Record exact test counts, hashes, job states, and any failure cause.
• Keep Android guest boot readiness open until a compatible guest image is supplied and booted.

Recorded at 2026-08-09T13:41:38-04:00.

[MatDayProjects]

✅ Android CI hosted verification passed

Run 31327047886 completed successfully for exact commit 0153e1c5a00e63efe1a8679926daa8ace5872a6f.

Evidence	Verified result
Job	Validate debug APK · ✅ success
Artifact	9041854414
Android unit tests	43 tests · 0 failures · 0 errors · 0 skipped
Debug app APK	ac25dbb3891991c6142fe5565dc4b2b87c2bbca5f57cd76ad8639dc8adc19ec7 · ✅ unsigned
Instrumentation APK	691375f9c7e21ebb862a52ba15e56f64dac8966ee57d7ba7c1e81d948fd5dfe7 · ✅ unsigned
CI context	Run 31327047886, attempt 1, Linux/X64, verification outcome success

Both downloaded APKs independently passed the committed container verifier, zipalign -c -P 16 4, and aapt2 dump badging; both produced the expected DOES NOT VERIFY result from apksigner. The uploaded package area contains only post-verification staged APKs. No visible application surface changed, so the attached evidence is package/test output rather than a screenshot.

廣東話摘要

Android CI 第一關正式通過：43 個 tests 全數過關，app 同 instrumentation APK 下載返嚟再逐 byte 驗，兩件都係真正 unsigned。今次唔係見到綠燈就開香檳，係連 artifact 拎返落嚟再查一次先落筆。

Native QEMU run 31327047882 and unsigned release-validation run 31327061429 remain 🏃 running.

Recorded at 2026-08-09T13:45:32-04:00.

[MatDayProjects]

✅ Native runtime matrices passed

Both host-ABI runtime jobs are successful in Android Native QEMU run 31327047882 and unsigned release-validation run 31327061429, all at exact commit 0153e1c5a00e63efe1a8679926daa8ace5872a6f.

Workflow	ABI	Job result	Artifact
Android Native QEMU	arm64-v8a	✅ success	9041954338
Android Native QEMU	x86_64	✅ success	9041970503
Android Release	arm64-v8a	✅ success	9041976158
Android Release	x86_64	✅ success	9041932186

All four artifacts were downloaded and independently checked against native/qemu/qemu-build.json. Each contains 95 files, 83 versioned runtime libraries, the exact seven-file QEMU data allowlist totaling 670,720 bytes, matching SHA-256 and size metadata for both guest executables, pinned QEMU/Termux provenance, and a success context manifest for the correct workflow, run, ABI, and commit.

The native package job and the release debug/package jobs remain 🏃 running. This is build evidence rather than a visible application change, so no screenshot is presented.

廣東話摘要

兩個 workflow 嘅 arm64-v8a 同 x86_64 runtime jobs 全部成功，四份 artifacts 都下載返嚟逐件對 manifest、hash、size、83 份 libraries、七份 QEMU data 同 provenance。今次唔係望住綠色格仔就算，連箱入面啲貨都逐件點過。APK packaging 同 release validation 仲跑緊，未會提早報完成。

Recorded at 2026-08-09T13:55:43-04:00.

[MatDayProjects]

✅ Android Native QEMU run passed

Run 31327047882 completed successfully for exact commit 0153e1c5a00e63efe1a8679926daa8ace5872a6f. Both runtime collectors and the packaged unsigned-APK job are green.

Evidence	Verified result
arm64-v8a runtime	Artifact 9041954338 · ✅ independently verified
x86_64 runtime	Artifact 9041970503 · ✅ independently verified
APK/test package	Artifact 9042005849 · ✅ independently verified
Android unit tests	43 tests · 0 failures · 0 errors · 0 skipped
Debug app APK	0e5ffb9b3871413273dbde5cacf0cfa035bfe3b4c23b5b800dd5a45e1b9936ec · ✅ unsigned
Instrumentation APK	691375f9c7e21ebb862a52ba15e56f64dac8966ee57d7ba7c1e81d948fd5dfe7 · ✅ unsigned
Hosted context	All three jobs report the exact run, attempt, commit, successful build step, Linux/X64 context, and their assigned runner names

The downloaded APKs passed the committed structural verifier, zipalign -c -P 16 4, aapt2 dump badging, and the expected DOES NOT VERIFY result from apksigner. The packaged app contains byte-for-byte matches for 92 runtime entries per ABI: both QEMU executables, all 83 libraries, and all seven allowlisted QEMU data files. The package artifact also contains the explicit instrumentation-skip.txt: stock Android refuses unsigned APK installation, so no live instrumentation result is claimed.

No visible application surface changed in this run; package, hash, and test evidence is provided instead of an unrelated screenshot.

廣東話摘要

Native workflow 三個 jobs 全部通過。兩個 APK 下載返嚟再驗，app 同 instrumentation 都係真正 unsigned；43 個 tests 全過。最重要係 app APK 入面每個 ABI 嘅 92 件 runtime files 都同 collector artifact byte-for-byte 對得上，唔係只見到檔名就當同一件貨。Unsigned APK Android 唔肯裝，所以 workflow 清楚寫 skip evidence，冇扮跑過 live instrumentation。

Recorded at 2026-08-09T14:01:20-04:00.

[MatDayProjects]

✅ Unsigned release validation passed

Workflow-dispatch run 31327061429 completed successfully for exact commit 0153e1c5a00e63efe1a8679926daa8ace5872a6f. It ran from 2026-08-09T17:41:20Z through 2026-08-09T18:01:19Z (00:19:59).

Evidence	Verified result
arm64-v8a runtime	Artifact 9041976158 · ✅ verified
x86_64 runtime	Artifact 9041932186 · ✅ verified
Debug/test evidence	Artifact 9042007420 · 43 tests, 0 failures/errors/skips
Unsigned release evidence	Artifact 9042054147 · APK, AAB, checksums, bundle validation, context
Debug app APK	41513ee9a227da269b3119bfa67106adcb6c558b775e7ac513ddbad148e6bcef · ✅ unsigned
Instrumentation APK	691375f9c7e21ebb862a52ba15e56f64dac8966ee57d7ba7c1e81d948fd5dfe7 · ✅ unsigned
Release APK	b3280bba178f737a3bb4b1a18873ce8fb16351a642b4983c50c349f84aeb24ce · ✅ unsigned
Release AAB	c4cc46568ae8764a35ee14e4fe180dcd46499371a47e51d109726245f3b5e16c · ✅ unsigned

The downloaded APK/AAB files passed the committed structural verifier. Both APKs passed alignment and Android-package checks and returned the expected DOES NOT VERIFY result from apksigner; jarsigner explicitly reported the AAB as unsigned. The local bundletool 1.18.3 binary first matched pinned SHA-256 a099cfa1543f55593bc2ed16a70a7c67fe54b1747bb7301f37fdfd6d91028e29, then independently validated the downloaded AAB. SHA256SUMS.txt, verification.txt, and every context manifest match the downloaded bytes and exact workflow/run/commit/job results.

For both the release APK and AAB, all 92 packaged runtime entries per ABI match their runtime artifacts byte for byte: both QEMU executables, 83 libraries, and seven firmware/data files. This validation publishes no release and performs no signing. No visible application surface changed, so package/test evidence is provided rather than an unrelated screenshot.

廣東話摘要

Release validation 全線綠：四件 Android outputs 逐件下載、逐件驗，兩個 APK 同 AAB 都係真正 unsigned，43 個 tests 全過，checksums 對得上，bundletool 亦用鎖定 hash 版本再驗一次。APK 同 AAB 每個 ABI 嘅 92 件 runtime files 全部同 collector artifacts byte-for-byte 一致。今次只做驗收，冇偷偷 publish release，更加冇偷偷簽名；個 workflow 終於學識「冇簽名」唔等於「冇檢查」。

Recorded at 2026-08-09T14:05:51-04:00.

[MatDayProjects]

🚀 Hosted evidence committed and pushed

Commit 931c1cb6bd2a007f1167d305a589f41fe1313038 is now the exact main head. It records the independently downloaded evidence from Android CI 31327047886, Android Native QEMU 31327047882, and unsigned release validation 31327061429.

Changed files

• CHANGELOG.md
• HANDOFF.md
• ROADMAP.md
• docs/ci/android-build-and-signing.md

Local verification before push

• 17/17 artifact and workflow regression tests passed.
• Structural actionlint passed for all three Android workflows.
• git diff --check passed.
• The working tree was clean after the commit.

Current GitHub Actions state

• Android CI 31328380187 — 🏃 running at 931c1cb.
• Android Native QEMU 31328380209 — 🏃 running at 931c1cb.
• The manually dispatched unsigned release-validation run 31327061429 remains the verified release-package evidence for implementation commit 0153e1c; this documentation-only push does not publish a release or perform signing.

Android guest boot, display readiness, serial console, and host-to-guest file transfer remain unverified, so issue #1 stays open and its Project item stays In Progress.

廣東話摘要

Exact evidence 已經寫入 931c1cb 同推上 main：四份文件補齊三條綠色 runs、artifact IDs、hash、43/43 tests、bundletool 同逐 byte runtime 驗證。今次只改 documentation，兩條新 workflow 已經跑緊；未有 verdict 就唔會預先派綠色貼紙。Android guest boot、畫面、serial console 同檔案傳輸仲未驗證，所以 issue 繼續開住。

Recorded at 2026-08-09T14:11:38-04:00.

[MatDayProjects]

✅ Evidence-commit Android CI passed

Android CI run 31328380187 is green for exact main commit 931c1cb6bd2a007f1167d305a589f41fe1313038.

Downloaded artifact 9042213818 was independently rechecked:

• 43 tests passed; 0 failures, 0 errors, 0 skipped.
• Debug app APK SHA-256: ac25dbb3891991c6142fe5565dc4b2b87c2bbca5f57cd76ad8639dc8adc19ec7.
• Instrumentation APK SHA-256: 691375f9c7e21ebb862a52ba15e56f64dac8966ee57d7ba7c1e81d948fd5dfe7.
• Both APKs passed the committed structural verifier, alignment, Android-package metadata, and the expected DOES NOT VERIFY result from apksigner.
• The CI context records the exact workflow, run, attempt, commit, successful verification outcome, and Linux/X64 runner context.

Android Native QEMU run 31328380209 remains 🏃 running. No visible application surface changed, so package/test evidence is provided instead of an unrelated screenshot.

廣東話摘要

Evidence commit 嘅 Android CI 已經綠，artifact 下載返嚟再驗都一致：43 個 tests 全過，兩個 APK 都係 unsigned、alignment 同 package metadata 正常，hash 亦重現 baseline。Native workflow 仲跑緊，未會搶先講完成。

Recorded at 2026-08-09T14:15:29-04:00.

[MatDayProjects]

✅ Fresh native workflow verified

Note

This milestone covers source provenance, both native runtime matrices, unsigned APK packaging, unit tests, and downloaded-artifact inspection. It does not claim that a compatible Android guest image has booted or that display, serial-console, and host↔guest transfer paths have been proven.

English

The fresh Android Native QEMU run 31328380209 completed successfully at exact commit 931c1cb6bd2a007f1167d305a589f41fe1313038.

Evidence	Result
Workflow started	2026-08-09T18:11:21Z
Workflow completed	2026-08-09T18:26:58Z
Workflow duration	00:15:37
arm64-v8a job	✅ success · job 93282451045
x86_64 job	✅ success · job 93282451072
Package job	✅ success · job 93283823058
Unit tests	✅ 43 tests · 0 failures · 0 errors · 0 skipped
Live instrumentation	⏭️ explicitly skipped because Android refuses unsigned APK installation

Downloaded artifacts

Artifact	ID	Archived bytes	Independent result
Packaged APK/test evidence	9042371092	143714476	✅ downloaded and inspected
arm64-v8a runtime	9042308163	67171708	✅ downloaded and inspected
x86_64 runtime	9042333331	66365371	✅ downloaded and inspected

Independent APK verification

• app-debug-unsigned.apk
  • SHA-256: 697872892de9553792b1f27a1babec33177b87e4aa63b81a4b59bb025775872e
  • Size: 146692909 bytes
• app-debug-androidTest.apk
  • SHA-256: 691375f9c7e21ebb862a52ba15e56f64dac8966ee57d7ba7c1e81d948fd5dfe7
  • Size: 565053 bytes
• Both APKs passed the committed unsigned-container verifier, ZIP CRC/structure checks, zipalign -c -P 16 4, and aapt2 dump badging.
• apksigner verify --verbose returned the required non-zero DOES NOT VERIFY result for both APKs.
• No signing-material filenames were found anywhere in the downloaded evidence tree.

Independent runtime and package parity

Each ABI artifact contains exactly 95 files: one CI context record plus a 94-file runtime. Each runtime contains 83 dependency libraries, 7 allowlisted QEMU data files totaling 670720 bytes, two QEMU executables, runtime.json, and build-provenance.json.

ABI	AArch64 executable SHA-256	x86_64 executable SHA-256	APK runtime entries
arm64-v8a	f97c9f81caa2eb42ea53431178a46a25a03f908164f894fb89678e15bb2e80a8	24c9f660563903dca08ebf4d3f20cbe77535848492590d5f601eff3da4b2789a	92 ✅ byte-identical
x86_64	ce36078ad53de0cb4f69df2b70d211223142abfe10565226c5a31dbf60cc70b6	be50cc6f49a3ebda8ae0bb61e1ca17e1427db89268a8861ca4166d10065fce42	92 ✅ byte-identical

The manifests and payloads agree on QEMU 11.0.3, Android native API 29, 16384-byte page-size compatibility, the immutable Termux builder digest, pinned source revision, recipe hash, patch-manifest hash, and QEMU source hash. Every one of the 92 expected runtime payload entries per ABI was opened from the APK and SHA-256 compared with its downloaded runtime source file.

Important

The application and verification pipeline deliberately produce unsigned APKs. No certificate, keystore, private key, signing password, or signer service was generated, read, or used. A stock Android device will not install these APKs without an allowed signing identity, so this milestone verifies the open-source build and runtime package—not an installable signed release.

No visible application surface was exercised by this build-only milestone, so a screenshot would be unrelated evidence. Issue #1 remains open, and the project item remains In Progress, until a compatible Android kernel/initrd/raw image boots and the display, readiness, serial-console, and file-transfer paths are genuinely verified.

廣東話（輕鬆版）

今次 fresh native run 真係由頭綠到尾：兩個 ABI 都砌好、來源同 provenance 對得上、43 個 unit tests 全過，下載返嚟嘅三份 artifacts 亦逐件再驗。兩個 APK 都係刻意 unsigned，zipalign、aapt2 同自家 fail-closed verifier 全部過關，而 apksigner 就正確回覆 DOES NOT VERIFY——即係冇人偷偷塞咗張證書入去扮有簽名，個 build 冇玩魔術。

每個 ABI 有 83 個 runtime libraries、7 個 allowlisted QEMU data files（合共 670,720 bytes），APK 入面 92 個 runtime entries 全部逐 byte 對返下載嘅 source artifact。未完成嗰關仍然係真 Android guest boot：kernel、initrd、raw image、畫面、serial console 同檔案傳送未有實機證據，所以 issue 繼續開住，唔會用一個綠色 workflow 扮成部 VM 已經識飛。

[MatDayProjects]

🛑 Handoff — stopped guest-boot checkpoint

Important

Work stopped at the user's request at 2026-08-09T15:38:27-04:00. This is an intentionally incomplete checkpoint, not a completed Android VM or a release candidate.

Field	Exact state
Branch	codex/device-guest-boot-smoke
Commit	450f424bf39f22d44d4f9f48bde32e5cc3dd607c
Default branch	Unchanged at 931c1cb6bd2a007f1167d305a589f41fe1313038
Android CI	Run 31332163744 — running
Native QEMU	Run 31332163750 — running
Artifact policy	Unsigned; no signing identity was requested, generated, stored, or used

✅ Evidence preserved

• Android Emulator 37.1.11/API 37.1 x86_64 booted with 16 KiB pages.
• Both QEMU 11.0.3 executables from prior native run 31328380209 reported their versions and survived a bounded event-loop probe after direct adb transfer.
• A direct-kernel diagnostic reached Linux 6.12.69-android16-6, /init, and Android first-stage init. It then failed honestly because the diagnostic raw disk was intentionally empty and supplied no metadata, super, or vbmeta partitions.
• The checkpoint adds linuxboot_dma.bin to the manifest-owned firmware allowlist and adds -nic none while guest networking remains unimplemented.
• py -3 -m unittest discover -s scripts/tests -p 'test_*.py' -q passed 19/19 tests.
• The new PowerShell device harness parsed successfully, and the normalized staged Bash source passed bash -n.

📦 Files in the checkpoint

• native/qemu/qemu-build.json
• native/qemu/build-android.sh
• app/src/main/java/org/openvm/app/backend/QemuRuntimeController.kt
• app/src/test/java/org/openvm/app/backend/QemuRuntimeControllerTest.kt
• scripts/smoke-native-qemu-on-emulator.ps1
• scripts/tests/test_qemu_runtime_contract.py
• HANDOFF.md

⚠️ Unverified and remaining

• The new runtime has not yet been rebuilt and the committed device harness has not run against that rebuilt artifact.
• Gradle unit/build tasks were not rerun after this checkpoint.
• RFB 3.8 security selection still writes four bytes instead of one byte.
• ARM64 virt still needs an explicit 64-bit CPU and a declared display/boot contract.
• Process liveness is still promoted too early; the model needs distinct process-running, guest-booting, and guest-ready states.
• The guest manifest still lacks machine/CPU, partition/root topology, required devices, readiness timeout/marker, and transfer-protocol semantics.
• Host-to-guest file transfer remains unimplemented.

Note

This backend/runtime checkpoint has no changed visible application surface to capture. The current unsigned APK cannot be installed by stock Android, so no unrelated image is attached as substitute evidence.

下一手接力

工作已按要求停低，commit 同 branch 都已經保存。外層 emulator、兩個 QEMU engine、kernel 同 first-stage init 都有真實證據；但新 runtime、Gradle 同 device harness 仲未重跑。下一手應先等兩個 workflow 結果，再用新 runtime 跑 committed harness，之後修正 RFB 一-byte handshake、ARM64 CPU/display contract，同埋將「process 仲生存」同「Android 真係 ready」分開。空 disk 冇 partitions 呢件事好誠實，千祈唔好幫佢扮開機成功。