[PR #3581] feat(apktool): harden AAPT2 inspection and rebuild experiment #5838

New issue

Open

opened 2026-10-31 01:09:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:09:48 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3581
Author: @3QL
Created: 10/14/2026
Status: 🔄 Open

Base: main ← Head: feat/apktool-aapt2

📝 Commits (7)

14524b6 test(apktool): prototype aapt2 inspection and rebuild workflows
a80ad37 Merge branch 'morluto:main' into feat/apktool-aapt2
ee0af67 fix(experiments): keep command history and honor cancellation in AAPT2 probe
3f0df37 fix(experiments): retain failure facts and verify child exit
6b923a8 fix(experiments): harden AAPT2 receipts and final cleanup
7b1f9c3 fix(experiments): retain early settled command failures
79cbe9e fix(ci): refresh main with typed process evidence assertions

📊 Changes

9 files changed (+1611 additions, -0 deletions)

View changed files

➕ experiments/aapt2/README.md (+157 -0)
➕ experiments/aapt2/fixture/AndroidManifest.xml (+4 -0)
➕ experiments/aapt2/fixture/res/layout/main.xml (+3 -0)
➕ experiments/aapt2/fixture/res/values-de/strings.xml (+4 -0)
➕ experiments/aapt2/fixture/res/values/strings.xml (+4 -0)
➕ experiments/aapt2/prototype.test.mjs (+397 -0)
➕ experiments/aapt2/verify.mjs (+413 -0)
➕ experiments/command-scope.mjs (+172 -0)
➕ experiments/command-scope.test.mjs (+457 -0)

📄 Description

Summary

Harden the fixture-only AAPT2 inspection, compile/link and Apktool rebuild
experiment under experiments/. Follows #717; split-set scope relates to #1813.

Not a production provider: public CLI/MCP registration and package inclusion
remain disabled pending a maintainer scope decision.

Change and scope

Retain receipts and failure details, including preflight and early child failures.
Keep cancellation protection active through final cleanup.
Select the correct build flags for Apktool 2.x and 3.x.

Validation performed

At 79cbe9ea3:

Exact-head CI passed.
798 tests passed, one conditional PCAP skip, across 43 files.
15/15 tests passed in each enabled real-tool lane: Apktool 2.7.0-dirty and 3.0.3.
Build, static checks, docs, package verification and formatting passed.

New regression cases failed before the fixes and passed afterward. Real Linux
runs checked resource round trips, input preservation, malformed-input refusal
and existing decode CLI/MCP parity.

Compatibility, safety, and release

Coverage is limited to small resource-only fixtures. Large/code-bearing APKs,
native macOS/Windows and natural OS cleanup denial remain unverified.

Host tools run with operator authority, not in a sandbox. The experiment creates
new unsigned outputs; it does not sign, install, execute or edit an input APK in
place. General project admission and production publication remain unresolved.

Additional review details and preserved declarations

Problem and expected behavior

Failures could lose receipts or child errors, and signals could interrupt final
cleanup. The fixes retain known outcomes and unresolved cleanup ownership.
Apktool 3.0.3's removed-flag failure was also reproduced before protocol selection.

Contract and boundary impact

Experiment receipts and command lifetime own the changes; existing production
file/process/version owners are reused. No shipped contract or dependency changes.
Selected fixture/framework/tool identities and output digests remain preserved.
No protection recovery is included. Future production authority is still pending.

Evidence and regression coverage

Verified matrix: Linux, SDK AAPT2 2.19-10229193, Android 35 framework, JDK
17.0.20.1, Node 24.18.0/npm 11.16.0, and the two Apktool versions above.
The focused PCAP skip is separate from the fully enabled real-tool lanes.

See the experiment README
for reproduction commands and measurement limits. Historical memory evidence was
a payload-exit cgroup peak including its observer, not a final whole-family peak.
No performance improvement is claimed.

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

The following human declarations and maintainer note are unchanged, not
re-attested. The maintainer note records the earlier 3f0df377 head.

Author readiness

Human owner: @3QL

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3581 **Author:** [@3QL](https://github.com/3QL) **Created:** 10/14/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feat/apktool-aapt2` --- ### 📝 Commits (7) - [`14524b6`](https://github.com/morluto/rea/commit/14524b67752e88e0e62fb198e5a4a408341d35f8) test(apktool): prototype aapt2 inspection and rebuild workflows - [`a80ad37`](https://github.com/morluto/rea/commit/a80ad379faf5f66c090e43e0c48294d96e4bc146) Merge branch 'morluto:main' into feat/apktool-aapt2 - [`ee0af67`](https://github.com/morluto/rea/commit/ee0af6751e5c10035b59f30df1c8e10be288eb59) fix(experiments): keep command history and honor cancellation in AAPT2 probe - [`3f0df37`](https://github.com/morluto/rea/commit/3f0df377c3d4c79e4e51eb8da56c1aada4cd5892) fix(experiments): retain failure facts and verify child exit - [`6b923a8`](https://github.com/morluto/rea/commit/6b923a88f31dfae97f1268e22fa35b3f48fc38a6) fix(experiments): harden AAPT2 receipts and final cleanup - [`7b1f9c3`](https://github.com/morluto/rea/commit/7b1f9c32220a2b3ad55c21a7f341b938d1f7557c) fix(experiments): retain early settled command failures - [`79cbe9e`](https://github.com/morluto/rea/commit/79cbe9ea3fbf0eb7f860e363369a7e48624830b7) fix(ci): refresh main with typed process evidence assertions ### 📊 Changes **9 files changed** (+1611 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `experiments/aapt2/README.md` (+157 -0) ➕ `experiments/aapt2/fixture/AndroidManifest.xml` (+4 -0) ➕ `experiments/aapt2/fixture/res/layout/main.xml` (+3 -0) ➕ `experiments/aapt2/fixture/res/values-de/strings.xml` (+4 -0) ➕ `experiments/aapt2/fixture/res/values/strings.xml` (+4 -0) ➕ `experiments/aapt2/prototype.test.mjs` (+397 -0) ➕ `experiments/aapt2/verify.mjs` (+413 -0) ➕ `experiments/command-scope.mjs` (+172 -0) ➕ `experiments/command-scope.test.mjs` (+457 -0) </details> ### 📄 Description ## Summary Harden the fixture-only AAPT2 inspection, compile/link and Apktool rebuild experiment under `experiments/`. Follows #717; split-set scope relates to #1813. **Not a production provider:** public CLI/MCP registration and package inclusion remain disabled pending a maintainer scope decision. ## Change and scope - Retain receipts and failure details, including preflight and early child failures. - Keep cancellation protection active through final cleanup. - Select the correct build flags for Apktool 2.x and 3.x. ## Validation performed At `79cbe9ea3`: - [Exact-head CI passed](https://github.com/morluto/rea/actions/runs/39854456621). - **798 tests passed, one conditional PCAP skip**, across 43 files. - **15/15 tests passed in each enabled real-tool lane:** Apktool 2.7.0-dirty and 3.0.3. - Build, static checks, docs, package verification and formatting passed. New regression cases failed before the fixes and passed afterward. Real Linux runs checked resource round trips, input preservation, malformed-input refusal and existing decode CLI/MCP parity. ## Compatibility, safety, and release Coverage is limited to small resource-only fixtures. Large/code-bearing APKs, native macOS/Windows and natural OS cleanup denial remain unverified. Host tools run with operator authority, not in a sandbox. The experiment creates new unsigned outputs; it does not sign, install, execute or edit an input APK in place. General project admission and production publication remain unresolved. <details> <summary>Additional review details and preserved declarations</summary> ## Problem and expected behavior Failures could lose receipts or child errors, and signals could interrupt final cleanup. The fixes retain known outcomes and unresolved cleanup ownership. Apktool 3.0.3's removed-flag failure was also reproduced before protocol selection. ## Contract and boundary impact Experiment receipts and command lifetime own the changes; existing production file/process/version owners are reused. No shipped contract or dependency changes. Selected fixture/framework/tool identities and output digests remain preserved. No protection recovery is included. Future production authority is still pending. ## Evidence and regression coverage Verified matrix: Linux, SDK AAPT2 `2.19-10229193`, Android 35 framework, JDK `17.0.20.1`, Node `24.18.0`/npm `11.16.0`, and the two Apktool versions above. The focused PCAP skip is separate from the fully enabled real-tool lanes. See the [experiment README](https://github.com/morluto/rea/blob/79cbe9ea3fbf0eb7f860e363369a7e48624830b7/experiments/aapt2/README.md) for reproduction commands and measurement limits. Historical memory evidence was a payload-exit cgroup peak including its observer, not a final whole-family peak. No performance improvement is claimed. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. The following human declarations and maintainer note are unchanged, not re-attested. The maintainer note records the earlier `3f0df377` head. </detail> ## Author readiness Human owner: @3QL - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-31 01:09:48 +00:00

bsakaguchi referenced this issue

2026-11-01 21:45:21 +00:00

[PR #5875] [MERGED] fix(reconstruction)!: summarize obligation ledgers by cited Evidence authority #7097