Skip to content

Lessons

Workflow lessons

  1. Prove on host first. The musl binary ran under WSL against the mock gateway before anything touched the emulator. Emulator time then tested only the device layer.
  2. Probe the sandbox directly. A tiny C probe, native/probe_seccomp.c, listed exactly which syscalls the app policy traps. That list drove every fix on the previous page.
  3. Use the seams the project gives you. fx ships e2e fixtures and loopback-only gateway overrides. The mock gateway mirrors the project’s own fixture, and the endpoint override needed no fx changes.
  4. Keep patches minimal and documented. The tree carries minimal Android patches with a patches doc. Each fix stays upstream-safe and additive, which kept the later OpenRouter work small.

Known limitations

  • No interactive PTY. Foreground and persistent terminal sessions stay bypassed. Captured commands take the direct spawn-and-collect path.
  • arm64 untested on hardware. The artifact builds, but no ARM emulator runs on this x86 host.
  • Live inference needs a key. Transport, protocol, tool loop, and app integration are proven. A user-supplied key is the remaining step, and none lives in the tree by policy.

What comes next

Two items close it out. Run the native OpenRouter path against live inference with a real key. Then run the arm64 artifact on real hardware. After that, the same proof runs on a real phone instead of an emulator.