Harden Kitsune release and System Mode lifecycle

[Jordan231111]

Summary

• harden release signing and manager identity, updater byte verification, SQLite initialization and legacy HideList preservation, daemon and concurrent-su failure paths, APK sessions, Android component lifecycles, and hidden-manager recovery
• keep the public database at version 12 for rollback compatibility; only an existing Kitsune/Delta database receives a verified backup and one transactional legacy-to-canonical union, while a fresh install skips migration and a durable marker prevents repeated reconciliation
• contain experimental Direct-System/System Mode to debug builds, add capability and payload checks, private mount isolation, non-mutating SELinux preflight, explicit warning, and exact in-process rollback for the currently owned mutation set
• remove the tracked public test key and credentials; debug builds remain automatic and release builds use one ordinary external four-field signing configuration
• retain bounded high-yield host/CI regressions and remove three Gradle test invocations proven permanently NO-SOURCE; heavy stress and destructive emulator experiments remain local and disposable
• keep README, status, build, and app text concise while preserving DEVELOPMENT_ROADMAP.md as the detailed source of goals, current position, remaining PRs, evidence, release gates, and the same-day ZygiskNext v1.4.4 black-box research update

Exact final local verification

Final code commit: 530f2a3f8
PR head: c840347f4
History: exactly two commits over kitsune

• changed-line whitespace, shell parsing, Python parsing, and 99/99 host contract, migration, failure-injection, and property tests passed
• the real app JVM suite and app/shared/stub Android lint passed with zero errors
• the exact head built all four native ABIs in debug and release and produced all four APKs; all daemon identities coherently report c840347f-kitsune with the correct debug/release mode
• the combined signer and 16 KiB ELF/ZIP contract passed for debug and ephemeral-signed release app/stub pairs; the temporary release key is outside the repository and is deleted after the gate
• generated upstream, dependency/license/SBOM, package-signature, and RustSec-disposition records verified; the exact historical probe checked 373 gitlinks and found exactly six reviewed unavailable objects, with no unknown loss or stale disposition
• a fresh cargo audit against official database commit 84dd8268 still observes one RSA vulnerability and five reviewed warnings; each relevant advisory/affected/version record is fingerprinted
• official ARM64 Android 14, 15, and 16 AVDs completed debug and release patch, setup, reboot, self-test, root, bounded concurrent-su, parser corpus, byte restoration, and deletion on the pre-final artifact head
• a full Google APIs Android 15 release lane installed and relaunched a randomized hidden manager, preserved exact release bytes/certificate in the dynamic manager, and retained root; substituting a debug-signed dynamic APK produced a daemon signature-mismatch log and deletion
• the inherited unknown-app Settings edge now fails gracefully when that activity is absent and immediately opens the hide-name dialog when a full Settings image grants the authoritative app-op, without a crash or second tap
• the same BlueStacks Tiramisu64 instance compared the released backend and hardened candidates, restored the starting payload, and reproduced one unchanged vendor launch/storage failure that passed on immediate retry; this is strong evidence for that specific intermittent BlueStacks failure, not a blanket classification of every future boot failure

Hosted-gate history

• rewritten head 2292696a0 passed source, build/JVM/lint/artifact, API 29, API 35, and upstream/security gates; API 23 exposed Android 6 ADB PTY \r in otherwise-correct PackageManager and Magisk readiness output
• corrected head fc10d9242 passed source, release/debug build, JVM/lint/artifact, API 23/29/35, and aggregate product gates; its security job then exposed that an unrelated global RustSec database commit made the exact generated report appear stale despite the same advisory count and the same six observed findings
• final code normalizes both legacy readiness probes, carries focused readiness and concurrent-su CRLF regressions, compares RustSec product semantics rather than volatile global metadata, and fingerprints every relevant advisory record so a newly published fix still fails closed

The final c840347f4 head passed the complete hosted matrix: Kitsune CI run 30699231707 passed source, release/debug build, JVM/lint/artifact, API 23/29/35, and aggregate Product gate; security run 30699231663 passed the upstream, license/SBOM, historical-submodule, signature, and RustSec ledger. The PR-only UBSan job is intentionally skipped; scheduled/local parser evidence remains recorded in the roadmap.

Important limitations

• no writable target has completed persistent System Mode install, three cold boots, upgrade/reinstall, power-loss recovery, uninstall, and stock/snapshot restoration; release System Mode therefore remains unreachable
• in-process rollback is improved but no persistent ownership journal yet makes the full System Mode transaction power-loss atomic
• internal MagiskHide worked in a measured namespace test; NeoZygisk v2.3 recognized canonical denylist rows and loaded Vector/CorePatch, but its clean namespace still exposed the Kitsune-specific /system/bin overlay, so universal provider/SuList parity is not claimed
• a production release still needs a protected production key and transition rule, a project-owned update service, a qualified provider contract, the stable-base forward-port, and full commercial-emulator/physical recovery matrices

After merge, the next engineering unit is roadmap PR5A: qualify one exact writable, snapshot-capable target by restoring the same baseline between the released comparison and hardened artifact. PR5B is conditional on what that lifecycle proves.

Detailed rationale and evidence are in DEVELOPMENT_ROADMAP.md; concise current claims remain in docs/status.md.