OpenVM 0.1.x — unsigned runtime validation

[MatDayProjects]

OpenVM 0.1.x — unsigned runtime validation

Important

OpenVM is an open-source Android VM control-plane and experimental QEMU runtime milestone. It does not yet claim a verified Android guest boot, display readiness, serial console, or host-to-guest file transfer. Its APK/AAB outputs are intentionally unsigned and cannot be installed on stock Android without an independently supplied signature.

Current build record

Purpose	Commit or run	State
Unsigned artifact implementation	52300f7	✅ implemented and reviewed
Integrated implementation/docs baseline	0153e1c	✅ hosted evidence verified
Exact evidence record on main	931c1cb	✅ pushed; fresh checks running
Android CI	31328380187	🏃 running
Android Native QEMU	31328380209	🏃 running

Verified baseline artifacts

• Android CI 31327047886: 43/43 tests and two downloaded unsigned APKs.
• Native QEMU 31327047882: both runtime ABIs and package artifact 9042005849 verified; app APK SHA-256 0e5ffb9b3871413273dbde5cacf0cfa035bfe3b4c23b5b800dd5a45e1b9936ec.
• Unsigned release validation 31327061429: release artifact 9042054147; APK SHA-256 b3280bba178f737a3bb4b1a18873ce8fb16351a642b4983c50c349f84aeb24ce; AAB SHA-256 c4cc46568ae8764a35ee14e4fe180dcd46499371a47e51d109726245f3b5e16c.
• Every downloaded APK/AAB passed the committed signature-structure verifier. APKs passed alignment/package checks and returned the expected DOES NOT VERIFY; jarsigner explicitly reported the AAB unsigned; pinned bundletool validated it.
• Each packaged APK/AAB contains 92 runtime entries per ABI that match the downloaded runtime artifacts byte for byte.

No visible application surface changed in this build-only correction, so package, test, hash, and workflow evidence is provided instead of an unrelated screenshot.

廣東話摘要

今個 0.1.x milestone 將 debug 同 release outputs 全部明確改成 unsigned，再加獨立 verifier、safe staging、context records 同 bundletool 驗證。三條 baseline workflows 已經綠，下載返嚟嘅 APK/AAB、tests、hash、runtime bytes 同 provenance 都逐件對過。931c1cb 係而家 main 嘅 exact evidence record，兩條 fresh checks 仲跑緊；未有結果就唔會預先宣布成功。

Android guest boot、畫面、serial console 同檔案傳輸仍未驗證；unsigned APK 喺 stock Android 唔可以直接安裝。呢張 Announcement 會繼續用 comments 記錄同一個 build 嘅後續 verdict，唔會每次 update 再開一張新帖。

[MatDayProjects]

✅ Evidence-commit Android CI passed

Android CI run 31328380187 is green for exact main commit 931c1cb6bd2a007f1167d305a589f41fe1313038.

Downloaded artifact 9042213818 was independently rechecked:

• 43 tests passed; 0 failures, 0 errors, 0 skipped.
• Debug app APK SHA-256: ac25dbb3891991c6142fe5565dc4b2b87c2bbca5f57cd76ad8639dc8adc19ec7.
• Instrumentation APK SHA-256: 691375f9c7e21ebb862a52ba15e56f64dac8966ee57d7ba7c1e81d948fd5dfe7.
• Both APKs passed the committed structural verifier, alignment, Android-package metadata, and the expected DOES NOT VERIFY result from apksigner.
• The CI context records the exact workflow, run, attempt, commit, successful verification outcome, and Linux/X64 runner context.

Android Native QEMU run 31328380209 remains 🏃 running. No visible application surface changed, so package/test evidence is provided instead of an unrelated screenshot.

廣東話摘要

Evidence commit 嘅 Android CI 已經綠，artifact 下載返嚟再驗都一致：43 個 tests 全過，兩個 APK 都係 unsigned、alignment 同 package metadata 正常，hash 亦重現 baseline。Native workflow 仲跑緊，未會搶先講完成。

Recorded at 2026-08-09T14:15:29-04:00.

[MatDayProjects]

✅ Fresh native workflow verified

Note

This milestone covers source provenance, both native runtime matrices, unsigned APK packaging, unit tests, and downloaded-artifact inspection. It does not claim that a compatible Android guest image has booted or that display, serial-console, and host↔guest transfer paths have been proven.

English

The fresh Android Native QEMU run 31328380209 completed successfully at exact commit 931c1cb6bd2a007f1167d305a589f41fe1313038.

Evidence	Result
Workflow started	2026-08-09T18:11:21Z
Workflow completed	2026-08-09T18:26:58Z
Workflow duration	00:15:37
arm64-v8a job	✅ success · job 93282451045
x86_64 job	✅ success · job 93282451072
Package job	✅ success · job 93283823058
Unit tests	✅ 43 tests · 0 failures · 0 errors · 0 skipped
Live instrumentation	⏭️ explicitly skipped because Android refuses unsigned APK installation

Downloaded artifacts

Artifact	ID	Archived bytes	Independent result
Packaged APK/test evidence	9042371092	143714476	✅ downloaded and inspected
arm64-v8a runtime	9042308163	67171708	✅ downloaded and inspected
x86_64 runtime	9042333331	66365371	✅ downloaded and inspected

Independent APK verification

• app-debug-unsigned.apk
  • SHA-256: 697872892de9553792b1f27a1babec33177b87e4aa63b81a4b59bb025775872e
  • Size: 146692909 bytes
• app-debug-androidTest.apk
  • SHA-256: 691375f9c7e21ebb862a52ba15e56f64dac8966ee57d7ba7c1e81d948fd5dfe7
  • Size: 565053 bytes
• Both APKs passed the committed unsigned-container verifier, ZIP CRC/structure checks, zipalign -c -P 16 4, and aapt2 dump badging.
• apksigner verify --verbose returned the required non-zero DOES NOT VERIFY result for both APKs.
• No signing-material filenames were found anywhere in the downloaded evidence tree.

Independent runtime and package parity

Each ABI artifact contains exactly 95 files: one CI context record plus a 94-file runtime. Each runtime contains 83 dependency libraries, 7 allowlisted QEMU data files totaling 670720 bytes, two QEMU executables, runtime.json, and build-provenance.json.

ABI	AArch64 executable SHA-256	x86_64 executable SHA-256	APK runtime entries
arm64-v8a	f97c9f81caa2eb42ea53431178a46a25a03f908164f894fb89678e15bb2e80a8	24c9f660563903dca08ebf4d3f20cbe77535848492590d5f601eff3da4b2789a	92 ✅ byte-identical
x86_64	ce36078ad53de0cb4f69df2b70d211223142abfe10565226c5a31dbf60cc70b6	be50cc6f49a3ebda8ae0bb61e1ca17e1427db89268a8861ca4166d10065fce42	92 ✅ byte-identical

The manifests and payloads agree on QEMU 11.0.3, Android native API 29, 16384-byte page-size compatibility, the immutable Termux builder digest, pinned source revision, recipe hash, patch-manifest hash, and QEMU source hash. Every one of the 92 expected runtime payload entries per ABI was opened from the APK and SHA-256 compared with its downloaded runtime source file.

Important

The application and verification pipeline deliberately produce unsigned APKs. No certificate, keystore, private key, signing password, or signer service was generated, read, or used. A stock Android device will not install these APKs without an allowed signing identity, so this milestone verifies the open-source build and runtime package—not an installable signed release.

No visible application surface was exercised by this build-only milestone, so a screenshot would be unrelated evidence. Issue #1 remains open, and the project item remains In Progress, until a compatible Android kernel/initrd/raw image boots and the display, readiness, serial-console, and file-transfer paths are genuinely verified.

廣東話（輕鬆版）

今次 fresh native run 真係由頭綠到尾：兩個 ABI 都砌好、來源同 provenance 對得上、43 個 unit tests 全過，下載返嚟嘅三份 artifacts 亦逐件再驗。兩個 APK 都係刻意 unsigned，zipalign、aapt2 同自家 fail-closed verifier 全部過關，而 apksigner 就正確回覆 DOES NOT VERIFY——即係冇人偷偷塞咗張證書入去扮有簽名，個 build 冇玩魔術。

每個 ABI 有 83 個 runtime libraries、7 個 allowlisted QEMU data files（合共 670,720 bytes），APK 入面 92 個 runtime entries 全部逐 byte 對返下載嘅 source artifact。未完成嗰關仍然係真 Android guest boot：kernel、initrd、raw image、畫面、serial console 同檔案傳送未有實機證據，所以 issue 繼續開住，唔會用一個綠色 workflow 扮成部 VM 已經識飛。

[MatDayProjects]

🛑 Handoff — stopped guest-boot checkpoint

Important

Work stopped at the user's request at 2026-08-09T15:38:27-04:00. This is an intentionally incomplete checkpoint, not a completed Android VM or a release candidate.

Field	Exact state
Branch	codex/device-guest-boot-smoke
Commit	450f424bf39f22d44d4f9f48bde32e5cc3dd607c
Default branch	Unchanged at 931c1cb6bd2a007f1167d305a589f41fe1313038
Android CI	Run 31332163744 — running
Native QEMU	Run 31332163750 — running
Artifact policy	Unsigned; no signing identity was requested, generated, stored, or used

✅ Evidence preserved

• Android Emulator 37.1.11/API 37.1 x86_64 booted with 16 KiB pages.
• Both QEMU 11.0.3 executables from prior native run 31328380209 reported their versions and survived a bounded event-loop probe after direct adb transfer.
• A direct-kernel diagnostic reached Linux 6.12.69-android16-6, /init, and Android first-stage init. It then failed honestly because the diagnostic raw disk was intentionally empty and supplied no metadata, super, or vbmeta partitions.
• The checkpoint adds linuxboot_dma.bin to the manifest-owned firmware allowlist and adds -nic none while guest networking remains unimplemented.
• py -3 -m unittest discover -s scripts/tests -p 'test_*.py' -q passed 19/19 tests.
• The new PowerShell device harness parsed successfully, and the normalized staged Bash source passed bash -n.

📦 Files in the checkpoint

• native/qemu/qemu-build.json
• native/qemu/build-android.sh
• app/src/main/java/org/openvm/app/backend/QemuRuntimeController.kt
• app/src/test/java/org/openvm/app/backend/QemuRuntimeControllerTest.kt
• scripts/smoke-native-qemu-on-emulator.ps1
• scripts/tests/test_qemu_runtime_contract.py
• HANDOFF.md

⚠️ Unverified and remaining

• The new runtime has not yet been rebuilt and the committed device harness has not run against that rebuilt artifact.
• Gradle unit/build tasks were not rerun after this checkpoint.
• RFB 3.8 security selection still writes four bytes instead of one byte.
• ARM64 virt still needs an explicit 64-bit CPU and a declared display/boot contract.
• Process liveness is still promoted too early; the model needs distinct process-running, guest-booting, and guest-ready states.
• The guest manifest still lacks machine/CPU, partition/root topology, required devices, readiness timeout/marker, and transfer-protocol semantics.
• Host-to-guest file transfer remains unimplemented.

Note

This backend/runtime checkpoint has no changed visible application surface to capture. The current unsigned APK cannot be installed by stock Android, so no unrelated image is attached as substitute evidence.

下一手接力

工作已按要求停低，commit 同 branch 都已經保存。外層 emulator、兩個 QEMU engine、kernel 同 first-stage init 都有真實證據；但新 runtime、Gradle 同 device harness 仲未重跑。下一手應先等兩個 workflow 結果，再用新 runtime 跑 committed harness，之後修正 RFB 一-byte handshake、ARM64 CPU/display contract，同埋將「process 仲生存」同「Android 真係 ready」分開。空 disk 冇 partitions 呢件事好誠實，千祈唔好幫佢扮開機成功。