OpenVM bootstrap and protected APK signing handoff

[MatDayProjects]

Scope

Build OpenVM from an empty checkout as a local-first open-source Android VM control plane, add profile/image-reference management, and provide a protected GitHub Actions release-signing path.

Current verification state

🏃 running — the hosted signing workflow is running for commit ef523824b3ea4cc39f14526078c6c98cf61eab39.

Local evidence already recorded:

• ./gradlew testDebugUnitTest assembleDebug lintDebug passed.
• ./gradlew assembleDebugAndroidTest passed; the instrumentation APK compiled, but no Android emulator was available to execute it.
• ./gradlew assembleRelease bundleRelease passed; release APK/AAB outputs are unsigned before the protected CI signing step.
• actionlint -shellcheck= passed structural workflow validation. The Windows host has no shellcheck, so run-block shell analysis remains a hosted-CI gate.
• Debug APK certificate verification with apksigner verify --verbose --print-certs passed.

The application surface has not been captured because no emulator/device is available in this workspace; no unrelated screenshot is being presented as proof.

Handoff

• Branch: main
• Source commit: ef523824b3ea4cc39f14526078c6c98cf61eab39
• Hosted run: https://github.com/MatDayProjects/material-android/actions/runs/31288800196
• Signing environment: android-release
• Signing material: stored only in GitHub Actions encrypted secrets; no key or password is in the repository.

粵語摘要

OpenVM 由空白 checkout 起步，已經有本地 VM 設定檔、映像參考、歷史、設定頁、regex 搜尋同受保護嘅 GitHub Actions APK 簽名流程。local checks 已過，hosted signing run 仲做緊；冇 Android emulator，所以唔會扮有 screenshot 證明畫面。

[MatDayProjects]

🚀 In progress

Start: 2026-08-08T21:42:15-04:00
Branch: main
Attempt: repair the invalid Gradle wrapper-validation reference, run the protected GitHub Actions signing workflow for ef523824b3ea4cc39f14526078c6c98cf61eab39, and verify the generated APK certificate and safe artifact set.

The local Android build is verified. The hosted result is still running at https://github.com/MatDayProjects/material-android/actions/runs/31288800196. No screenshot is attached because this workspace has no emulator or device; the issue will not claim visual verification without a genuine capture.

粵語

🚀 而家開工：喺 main 修正無效嘅 Gradle wrapper-validation reference，跑 ef523824b3ea4cc39f14526078c6c98cf61eab39 嘅 GitHub Actions 簽名 workflow，再驗 APK certificate 同安全 artifact。Local Android build 已驗證，hosted result 仲係 running；冇 emulator，所以唔會亂放 screenshot。

[MatDayProjects]

🛠️ Milestone — hosted signing verification running

The GitHui Actions path has now cleared the two setup failures and is executing the protected signing job.

Checkpoint	Evidence	State
Initial workflow	31288743258 — gradle/actions/wrapper-validation@v2 was unavailable	failed, repaired
SDK bootstrap	31288800196 — newline-separated packages were passed as one Android SDK package name	failed, repaired
Current workflow	run 31288853956 on e406a3d86a16edbd2eda8960573a8fc216f383d2	running
Debug validation	Wrapper, Java, Android SDK, apksigner, build, and artifact evidence	verified
Protected release	Keystore decoding, APK/AAB signing, certificate match, and safe artifact upload	running

Note

No emulator or physical Android device is available in this workspace, so there is no runtime screenshot yet. The instrumentation APK compiles locally; device execution remains unverified.

粵語：GitHui Actions 條路已經修好兩個設定問題，而家正用受保護嘅 signing secrets 執行 APK/AAB 簽署；debug 驗證已經過，證書配對同 artifact 上載仍然進行中。未有 emulator 或實機，所以暫時冇 runtime screenshot；instrumentation APK 本地編譯已驗證，實機執行仍未驗證。

[MatDayProjects]

🔐 Credential diagnosis — certificate generation repair

Run 31289082313 proved the workflow reaches the protected signing command. The exact failure is:

java.io.IOException: Failed to obtain key with alias from release.keystore. Wrong password?
Caused by: java.security.UnrecoverableKeyException

The keystore store password and alias validation passed, so the stored private-key password did not match the key entry. No private value is being exposed. I am generating a fresh release keystore with one high-entropy password used consistently for the store and key, replacing the four android-release environment secrets through gh, and rerunning the workflow.

粵語：31289082313 已經證明 workflow 可以去到受保護 signing command；真正 poke guy 係 keystore 個 store password 同 alias 過到，但 private-key password 對唔上。秘密值唔會公開；而家會重新產生一個高熵 release keystore，用同一個 password 正確設定 store 同 key，再安全更新四個 android-release secrets，然後重跑。

[MatDayProjects]

🔁 Milestone — protected signing material rotated

A fresh RSA-4096 PKCS#12 release keystore was generated locally, the old not-yet-used credential was replaced, and all four android-release environment secrets were updated through gh without printing secret values or retaining the keystore in the repository. The temporary generation script and keystore were deleted immediately after the secret update.

Next gate: dispatch android-release.yml with release=true and verify that the APK and AAB signatures match the new certificate. Current state: running once dispatched.

粵語：已經重新產生 RSA-4096 PKCS#12 release keystore，舊 certificate 仲未出過街，所以安全換走；四個 android-release secrets 已經用 gh 更新，冇印出秘密，temporary script 同 keystore 亦即刻刪除。下一關係重跑 release=true，驗證 APK/AAB 同新 certificate 配對；而家等 dispatch。

[MatDayProjects]

🧪 Milestone — signing reached the artifact, comparison fixed

Run 31289306142 showed that apksigner successfully signed app-release.apk with the freshly generated certificate and uploaded the signed APK. The run failed only because the shell fingerprint comparison did not normalize the keytool and apksigner text identically; the certificate itself was valid.

Commit 3f77877 now normalizes both public SHA-256 fingerprints with the same pipeline, rejects an empty digest, and reports both public values on mismatch. It is on main; final hosted verification is run 31289501081, currently running.

粵語：31289306142 已經用新 certificate 真正簽好 app-release.apk，仲上載咗 signed APK；失敗只係 shell 比對 fingerprint 時兩邊格式清潔得唔一樣，certificate 本身係有效。3f77877 已修正同一套 normalization，最新 hosted verification 31289501081 正在跑。

[MatDayProjects]

🧰 Milestone — exact fingerprint extraction repaired

Run 31289501081 reported the public expected fingerprint correctly as 0dbe…, but the APK extractor returned the label text certificatesha-256digest. Commit dc4749f replaces field-splitting with anchored label removal for both APK and AAB outputs, while keeping the values public-only and secret-safe. It is dewed to main.

Final hosted verification is run 31289656429, currently running.

粵語：31289501081 報到正確 expected fingerprint 0dbe…，但 APK extractor 交返 label certificatesha-256digest；dc4749f 已改用準確 label removal，APK 同 AAB 都一樣處理，秘密繼續安全。最新 run 31289656429 正在驗證。

[MatDayProjects]

🧱 Milestone — AAB signing moved into Gradle

Run 31289818161 finally passed APK signing and certificate verification but failed on app-release.aab: Gradle had already produced a JAR-signed bundle with a different certificate, and the post-step correctly rejected it. Commit 1c2a439 fixes the root cause by wiring the protected keystore into the ciRelease Gradle signing config, so both the APK and AAB are produced by Gradle with the same certificate. The workflow retains an APK fallback signer and verifies both outputs.

Local evidence with the isolated JDK 21: testDebugUnitTest, lintDebug, assembleDebugAndroidTest, assembleRelease, and bundleRelease all passed. The workflow is being dispatched next; hosted state is not yet verified.

粵語：31289818161 APK signing 同 certificate verification 已經過，但 app-release.aab 係 Gradle 先用另一張 certificate 簽咗，post-step 正確拒絕。1c2a439 已將受保護 keystore 接入 ciRelease Gradle signing config，APK 同 AAB 而家同一張 certificate 出貨，workflow 仲會驗證兩件 artifact。JDK 21 本地測試全部過，下一步重跑 hosted verification。

[MatDayProjects]

✅ Finished — OpenVM bootstrap and protected APK/AAB signing

Finish: 2026-08-08T22:30:19-04:00
Elapsed: 00:48:04 from 2026-08-08T21:42:15-04:00
Verification state: verified for the implemented control-plane and hosted signing scope.

The first OpenVM milestone is merged into main, pushed, and verified. The native QEMU/AVF guest adapter remains deliberately unimplemented and documented as the next implementation boundary; no emulator or connected device was available for a runtime screenshot or instrumentation execution.

What landed

• A from-scratch Android app in org.openvm.app with VM profile creation/editing, validation, local persistence, guest-image URI import through the Storage Access Framework, JSON import/export, append-only local history, backend-readiness reporting, settings, localized copy, bounded regex search, and the Ctrl+Shift+F command palette.
• Protected GitHub Actions signing with an android-release environment. The release job decodes the owner-managed keystore only on the hosted runner, wires it into Gradle for both APK and AAB variants, verifies certificates, and uploads only safe evidence.
• Documentation, roadmap, security guidance, contribution guidance, changelog, sanitized AGENTS.md, and the hosted signing handoff.

Commits

Commit	Result
7c58a29	Created the OpenVM Android control plane and initial CI workflow from an empty checkout.
ef52382	Repaired the Gradle wrapper validation action reference.
e406a3d	Repaired Android SDK package bootstrap input.
81ebc10	Added APK signer diagnostics.
3f77877	Normalized certificate fingerprint comparison.
dc4749f	Fixed certificate fingerprint extraction.
d3a3716	Added Android Build Tools 37 certificate-output support.
1c2a439	Wired the protected signing identity into Gradle release APK/AAB variants.
3726270	Recorded hosted signing evidence and the final handoff.

Files changed

The initial implementation added the Android project, app source, resources, tests, Gradle wrapper/configuration, workflows, documentation, license, and repository guidance. The signing repair pass specifically changed:

• .github/workflows/android-ci.yml
• .github/workflows/android-release.yml
• app/build.gradle.kts
• docs/ci/android-build-and-signing.md
• CHANGELOG.md
• HANDOFF.md

Tests and hosted evidence

File	Tests	Result
app/src/test/java/org/openvm/app/model/VmProfileTest.kt	4	4 passed, 0 failures
app/src/test/java/org/openvm/app/settings/OpenVmSettingsTest.kt	1	1 passed, 0 failures
app/src/androidTest/java/org/openvm/app/MainActivitySmokeTest.kt	1	Compiled in assembleDebugAndroidTest; not executed because no emulator/device was available

• Local JDK 21 gates passed: testDebugUnitTest, lintDebug, assembleDebugAndroidTest, assembleRelease, and bundleRelease.
• Structural workflow validation passed with actionlint -shellcheck=; this Windows host has no shellcheck, so hosted CI remains the run-block shell gate.
• GitHub Actions run 31290128594 passed debug validation and protected signed APK/AAB verification for commit 1c2a439.
• GitHub Actions run 31290391405 passed the final push validation for commit 3726270.
• Hosted release evidence included app-release.apk, app-release.aab, verification.txt, and SHA256SUMS.txt. The public certificate SHA-256 was verified as 0dbe4aecd0c1911f6b8cb5a736efe3823ed2753cfa193464b40bf5a1f25b7428.

粵語摘要

OpenVM 第一階段由空白 checkout 起步，砌好本地 VM 設定、映像參考、歷史記錄、設定、搜尋同誠實嘅 backend 狀態；GitHub Actions 亦真係用受保護 keystore 簽好 APK 同 AAB，再驗證證書同 checksum。原生 QEMU/AVF guest engine 未扮開機，留返下一階段用真機同真映像驗證，唔會畀一張 UI 截圖扮成 VM 已經識飛。

The issue remains open for the next native-backend and emulator-verification milestone; this milestone's code, documentation, hosted signing, and remote verification are complete.

[MatDayProjects]

🏃 Runtime milestone update — process-backed QEMU boundary

OpenVM now has a tested, shell-free process boundary for a user-supplied QEMU executable and guest image.

Evidence	Result
Code commits	08eeecc, ea65413, 6ec5b5a
Local unit/lint/package gate	✅ testDebugUnitTest, lintDebug, and assembleDebugAndroidTest passed; 58 Gradle tasks reported successful completion
Emulator gate	✅ 3 instrumentation tests passed on Pixel_10_Pro_XL API 37, including private asset copy/hash and QEMU profile-editor coverage
Previous remote validation	✅ run 31291663906 passed for ea65413
Current remote validation	🏃 run 31291783692 is running for the evidence commit

The controller validates app-private paths, bounded assets, ELF class/ABI, lifecycle states, exit codes, and bounded output. It does not claim a verified Android guest boot or display transport. The API 37 emulator exposes no AVF virtualization service for this ordinary app, so those native capabilities remain open work.

粵語摘要

OpenVM 而家有真 QEMU process 邊界：唔經 shell、會驗私有路徑、asset 大小、ELF ABI、開停機狀態同輸出尾巴。API 37 emulator 三個測試全過，GitHub Actions 新一輪仲跑緊。未有 Android guest 真正 boot 或 display transport，就唔扮已經做到；AVF service 喺呢部普通 app emulator 度都未露面。

Note

This is a milestone update for issue #1. The issue remains open for a reproducible bundled QEMU target, guest image manifest, and real guest display/console transport.

[MatDayProjects]

✅ Remote verification complete — process boundary milestone

GitHub Actions run 31291783692 passed for commit 6ec5b5a. The repository now has green remote evidence for the QEMU process-boundary code, documentation, and API 37 emulator capture.

• ✅ testDebugUnitTest, lintDebug, and assembleDebugAndroidTest passed locally.
• ✅ 3 instrumentation tests passed on Pixel_10_Pro_XL API 37.
• ✅ The debug APK surface below is captured from the installed artifact used by the emulator smoke run.
• ⏳ Native guest boot, a reproducible bundled QEMU target, guest-image manifest, and display/console transport remain open; this milestone does not claim them.

粵語摘要

GitHub Actions 31291783692 已經用 6ec5b5a 跑綠，QEMU process 邊界、文件同 API 37 emulator 截圖都有遠端證據。三個 instrumentation tests 加埋 unit、lint、debug package 都過晒。Guest 仲未真正 boot、display/console 同 reproducible QEMU target 亦未完成，所以呢個 milestone 只報已驗證嗰部分，唔會將控制面扮成完整 VM。

Note

Issue #1 remains open for the native runtime and guest-display work described above.

[MatDayProjects]

🏃 Display transport milestone — remote check running

OpenVM now has a private framebuffer transport boundary for the QEMU process adapter. Commits 8a7a1ba and 83a8867 add:

• -vnc unix:<app-private-socket> to the shell-free QEMU command;
• a bounded RFB 3.8 raw-frame decoder over Android LocalSocket;
• a real framebuffer ImageView surface for running profiles;
• collision-resistant profile asset names, atomic replacement, no-progress/storage limits, bounded output lines, verified forced-stop behavior, and cancellation before process launch.

Check	Evidence
Local unit/lint/package gate	✅ testDebugUnitTest, lintDebug, assembleDebugAndroidTest passed
Emulator smoke	✅ 4 instrumentation tests passed on Pixel_10_Pro_XL API 37
Remote GitHub Actions	🏃 run 31292471025 is running for 83a8867
Guest readiness	⏳ Not claimed: no bundled QEMU, image manifest, Android guest boot, touch, keyboard, console, or file transfer yet

The capture below is the real API 37 control surface from the debug artifact. It intentionally shows the backend state, not a fabricated guest framebuffer; no QEMU binary was available for a boot/display capture.

粵語摘要

OpenVM 而家有私有 UNIX socket framebuffer 邊界：QEMU command 會開 -vnc unix:...，app 用 bounded RFB client 畫 frame，仲加埋 asset 防撞名、atomic replace、長 log 限長、force stop 驗證同 start cancellation。Local unit、lint、package 同 API 37 四個 instrumentation tests 都過，GitHub Actions 31292471025 仲跑緊。未有 bundled QEMU、guest image manifest 或 Android guest 真 boot，就唔會拎控制台張圖扮 guest 畫面。

Note

Issue #1 remains open for reproducible native QEMU packaging, guest-image manifest enforcement, guest input/console/file transfer, and verified Android boot.

[MatDayProjects]

✅ Finished — framebuffer and lifecycle hardening verified

The display/hardening milestone is complete on the default branch.

Item	Verified evidence
Commits	8a7a1ba, 83a8867
Files	QEMU controller, RFB/VNC transport, asset store, profile store, MainActivity display surface, tests, README, roadmap, handoff, feature docs, changelog
Local tests	✅ testDebugUnitTest, lintDebug, assembleDebugAndroidTest passed; 4 instrumentation tests passed on Pixel_10_Pro_XL API 37
Remote CI	✅ GitHub Actions run 31292471025 passed for 83a8867
Signing baseline	✅ protected run 31290128594 remains green for the signed APK/AAB and certificate verification

The app now has a genuine local framebuffer boundary, but no claim of Android guest readiness: QEMU is still user-supplied, the image contract is not yet manifest-enforced, and guest boot, input, serial console, clipboard, and file transfer remain open.

粵語摘要

呢個 framebuffer 同 lifecycle hardening milestone 已經喺 default branch 完成，local 同 GitHub Actions 都過。QEMU 而家有私有 UNIX socket 畫面邊界，asset 防撞名、atomic replacement、長 output 限制、forced stop 驗證、start cancellation 都有測試。不過 QEMU binary 仲要 user-supplied，manifest、guest boot、input、console、clipboard 同 file transfer 未完成，所以張圖只係真 control surface，唔係假 guest 畫面。

Note

Issue #1 remains open for reproducible native QEMU packaging, manifest-enforced Android images, guest input/console/file transfer, and verified Android boot.

[MatDayProjects]

🚀 In progress — guest-image boot contract and display-input hardening

Start: 2026-08-09T00:18:33-04:00
Branch: main
Remote commit: 485dfbd

English

The guest-image milestone is now pushed to main. It adds a strict version-1 manifest with architecture/machine pairing, raw-image size/SHA-256 binding, kernel/initrd size/SHA-256 binding, strict UTF-8 and nesting limits, application-owned QEMU lifecycle across Activity recreation, SAF display-name lookup, backup exclusions for private runtime assets, and bounded local RFB touch/key input. The API 37 emulator capture below is the real profile editor, scrolled to the manifest/kernel/initrd controls.

Local verification is verified: testDebugUnitTest passed, connectedDebugAndroidTest passed with 4 tests on Pixel_10_Pro_XL API 37, and the debug APK was rebuilt. Hosted verification is running in GitHub Actions run 31294251538 for the exact remote head. Native QEMU packaging and a verified Android guest boot remain outside this milestone.

粵語版

呢個 guest-image milestone 而家已經推咗去 main。而家有 strict version-1 manifest、architecture/machine 配對、raw image size/SHA-256 綁定、kernel/initrd size/SHA-256 綁定、strict UTF-8 同 nesting limit、Activity 轉身都唔會殺錯 QEMU、SAF display name、runtime asset backup exclusion，同埋 bounded 本地 RFB touch/key input。下面張 API 37 capture 係真機 emulator 嘅 profile editor，已經 scroll 到 manifest/kernel/initrd controls。

Local verification 係 verified：testDebugUnitTest 過咗，connectedDebugAndroidTest 喺 Pixel_10_Pro_XL API 37 過咗 4 個 test，debug APK 亦重新 build。Hosted verification 而家喺 GitHub Actions run 31294251538 running，對住同一個 remote head。Native QEMU packaging 同真正 Android guest boot 仲未驗證。

Note

The release signing identity and certificate remain in the protected GitHub Actions secret path; no private keystore or password is included here.

[MatDayProjects]

✅ Finished — guest-image boot contract and display-input hardening

Start: 2026-08-09T00:18:33-04:00
Finish: 2026-08-09T00:19:53-04:00
Elapsed: 00:01:20
Branch: main
Remote head: 485dfbd17a04b9999c8c53b8cc6fda086d7cbae5

English

The requested milestone is complete and present on the default branch. The implementation commit af43751fb7b1ed162242e739a131c36f6b4706d9 adds the strict guest-image manifest, image/kernel/initrd integrity binding, application-owned QEMU lifecycle, private runtime backup exclusions, and bounded RFB display input. Documentation and the exact changelog/handoff record are in 485dfbd17a04b9999c8c53b8cc6fda086d7cbae5.

Verification

Gate	Evidence
JVM unit tests	testDebugUnitTest passed with the changed test files covering QemuRuntimeControllerTest 9 tests, VmProfileTest 6, GuestImageManifestTest 18, and RfbClientTest 6.
Android emulator	connectedDebugAndroidTest passed 4/4 on Pixel_10_Pro_XL API 37: MainActivitySmokeTest 2 and RuntimeAssetStoreTest 2.
Debug package	assembleDebug passed after the final source commit.
Repository hygiene	git diff --check passed; the local checkout is clean.
Hosted CI	GitHub Actions run 31294251538 passed for remote head 485dfbd17a04b9999c8c53b8cc6fda086d7cbae5. Its only annotations are upstream Node 20/setup-java deprecations.
Signing path	Protected signing run 31290128594 remains green; certificate SHA-256 is 0dbe4aecd0c1911f6b8cb5a736efe3823ed2753cfa193464b40bf5a1f25b7428. No private keystore or password is public.

Changed files

CHANGELOG.md
HANDOFF.md
README.md
ROADMAP.md
app/src/androidTest/java/org/openvm/app/MainActivitySmokeTest.kt
app/src/main/java/org/openvm/app/MainActivity.kt
app/src/main/java/org/openvm/app/OpenVmApplication.kt
app/src/main/java/org/openvm/app/backend/QemuRuntimeController.kt
app/src/main/java/org/openvm/app/backend/RuntimeBackend.kt
app/src/main/java/org/openvm/app/model/VmProfile.kt
app/src/main/java/org/openvm/app/runtime/GuestImageManifest.kt
app/src/main/java/org/openvm/app/runtime/RfbClient.kt
app/src/main/java/org/openvm/app/runtime/RuntimeAssetStore.kt
app/src/main/java/org/openvm/app/runtime/VncDisplayClient.kt
app/src/main/res/values/strings.xml
app/src/main/res/xml/backup_rules.xml
app/src/main/res/xml/data_extraction_rules.xml
app/src/test/java/org/openvm/app/backend/QemuRuntimeControllerTest.kt
app/src/test/java/org/openvm/app/model/VmProfileTest.kt
app/src/test/java/org/openvm/app/runtime/GuestImageManifestTest.kt
app/src/test/java/org/openvm/app/runtime/RfbClientTest.kt
docs/features/README.md
docs/features/evidence/qemu-manifest-api37.png
docs/features/evidence/qemu-manifest-editor-api37.png
docs/features/guest-image-manifest.md
docs/features/qemu-runtime.md
docs/features/vm-profiles.md

粵語版

今次 milestone 已經完成，亦已經喺 default branch 度。af43751 加咗 strict guest-image manifest、image/kernel/initrd integrity binding、application-owned QEMU lifecycle、private runtime backup exclusion，同 bounded RFB display input；485dfbd 就補齊 changelog、handoff 同 exact verification record。

JVM testDebugUnitTest 過晒，API 37 emulator connectedDebugAndroidTest 4/4 通過，assembleDebug 通過，git diff --check 通過，GitHub Actions run 31294251538 對住同一個 commit 亦通過。Protected signing run 31290128594 同 certificate fingerprint 仍然有效；private keystore 同 password 冇公開。

Warning

This milestone still does not claim that a native QEMU binary is packaged or that a real Android guest boot has been verified. Serial console and host-to-guest file transfer remain future runtime work.

Verification state

verified for the requested open-source control-plane milestone and protected APK signing path; native guest execution remains unverified.