ANDROID ARCHITECTURE.
LAYER BY LAYER.
Click any layer below to inspect its exact purpose, responsibilities, security boundaries, dependencies, implementation status, and source tree location.
Purpose: User-facing security, privacy, diagnostics, and update interfaces developed exclusively by Cyronix Dev & Security.
Responsibilities: Security Center 2.0 posture verification, Diagnostics hardware sensor monitoring, System Update resumable package management, LatinIME custom keyboard themes, and 6 procedural AMOLED wallpapers.
Security: Strict minimal privilege allowlist in packages/apps/CyronixSecurityCenter; zero analytics beacons; zero network permissions except System Update (which contacts only the Cyronix update server).
Source Location: packages/apps/Cyronix*, vendor/cyronix/
Purpose: Sandboxed runtime environment for user applications.
Responsibilities: Runs APKs, isolates user IDs, enforces runtime permission dialogs, enforces per-app network firewall cutoffs.
Security: Android UID sandbox, SELinux untrusted_app domain isolation, no root helper access on release builds.
Source Location: Standard AOSP application runtime.
Purpose: The primary graphical shell, notifications panel, quick settings tiles, and lockscreen.
Responsibilities: Status bar tabular clocks, Quick Settings tile toggles, lock-screen notification privacy masking, volume panels, and power menu.
Security: Sensitive notification content remains masked until biometric or PIN unlock; USB restricted mode indicator in notification shade.
Source Location: vendor/cyronix/overlay/common/frameworks/base/packages/SystemUI
Purpose: Core background system orchestrators running inside system_server.
Responsibilities: ActivityManagerService, PackageManagerService, DevicePolicyManager (auto-wipe on 10 failed unlocks), Netd, Vold, and Keystore.
Security: Privileged permissions guarded by framework allowlists; device-policy auto-reset engine active.
Source Location: frameworks/base/services/, system/vold/
Purpose: The Java/Kotlin API layer exposed to application developers.
Responsibilities: Window management, view hierarchy, audio routing, resource resolution, and 1.6.0 Design System token distribution.
Security: Android permissions architecture, package visibility enforcement, sandboxed IPC via Binder.
Source Location: frameworks/base/core/
Purpose: Standardized C++ interfaces connecting Android framework services to hardware-specific drivers.
Responsibilities: Audio HAL, Camera HAL, Gatekeeper (passcode hashing), Keymaster (cryptographic keys), Fingerprint HAL (FPC1020), Sensors HAL.
Security: Isolated HAL userspace processes guarded by distinct SELinux types (hal_audio_default, hal_camera_default, hal_fingerprint_default).
Source Location: hardware/interfaces/, hardware/qcom/
Purpose: Compiled proprietary libraries required for Qualcomm MSM8996pro hardware peripherals.
Responsibilities: Qualcomm Adreno 530 GPU drivers, hexDSP firmware, modem RIL radio interface, and GPS satellite tracking.
Security: Constrained by vendor partition boundaries and strict SELinux domain confinement; vendor security patch level 2019-10-01 honestly reported.
Source Location: vendor/oneplus/oneplus3/
Purpose: Device configuration manifests, partition layout definitions, init scripts, and hardware overlay tokens.
Responsibilities: Defines partition table (boot, recovery, system, cache, userdata), mounts FDE encrypted userdata, configures init rc services.
Security: Hardened sysctls loaded on early-boot; mount flags with nosuid, nodev, noatime on user partitions.
Source Location: device/oneplus/oneplus3/
Purpose: Core operating system kernel managing CPU scheduling, memory management, IPC, and peripheral bus drivers.
Responsibilities: Memory protection, hardware crypto engine acceleration, netfilter firewall routing, USB controller gating.
Security: Yama LSM ptrace restriction, Software Privileged Access Never (PAN), Spectre v2 mitigation, PANIC_ON_OOPS, removal of Magic SysRq and crash memory dump modes.
Source Location: kernel/oneplus/msm8996/, vendor/cyronix/kernel/cyronix_hardening.config
Purpose: Physical silicon (Snapdragon 821, Adreno 530, Optic AMOLED, UFS 2.0 storage) and Qualcomm secondary bootloader (SBL).
Responsibilities: Power-on execution, DRAM initialization, modem baseband launch, transition to boot or recovery image.
Security Limitations: Bootloader unlock is required for installation. Android Verified Boot (AVB 2.0) is not available due to 2016 bootloader design lacking vbmeta partition.
Status: Physical hardware, production validated.