Audit the Cromite Android source candidate

Author: phucnguyen1707

.github/workflows/android-engine.yml

@@ -54,7 +54,18 @@ jobs:
           pnpm install --frozen-lockfile
 
       - name: Validate scaffold and report release blockers
-        run: node scripts/preflight.mjs --mode scaffold
+        run: |
+          set -o pipefail
+          report="$RUNNER_TEMP/android-engine-preflight.json"
+          node scripts/preflight.mjs --mode scaffold --json | tee "$report"
+          jq -e '.status == "ready" or .status == "blocked"' "$report" > /dev/null
+
+      - name: Validate recorded Android source candidate
+        run: |
+          set -o pipefail
+          report="$RUNNER_TEMP/android-engine-candidate.json"
+          node scripts/audit-candidate.mjs --mode record --json | tee "$report"
+          jq -e '.status == "ready" or .status == "blocked"' "$report" > /dev/null
 
       - name: Android engine checks
         working-directory: .

apps/android-engine/README.md

@@ -17,6 +17,9 @@ path toward an Ungoogled Chromium engine and optional bundled Tor, built as an
 - ✅ Guarded pipeline and a tested release-readiness preflight.
 - ✅ Source evaluation and conditional recommendation documented in
   [ADR 0002](../../docs/adr/0002-android-engine-source-strategy.md).
+- ✅ A pinned Cromite candidate snapshot and offline adoption gate record
+  license, release-lag, freshness, and extension-support decisions without
+  treating external attestations as a verified build.
 - ⬜ Patch bodies (`chromium/patches/tronbrowser-android/*.patch`), real
   Android branding assets, and pinned/checksummed Tor artifacts.
 - ⬜ Current Chromium security pin and first real compile (Linux x64, at least
@@ -30,6 +33,9 @@ See [`chromium/README.md`](chromium/README.md). TL;DR (Linux host):
 ```bash
 cd apps/android-engine/chromium
 node scripts/preflight.mjs --mode scaffold
+# Validate the recorded source snapshot without claiming it is adoptable.
+node scripts/audit-candidate.mjs --mode record
+node scripts/audit-candidate.mjs --mode adopt  # fails while decisions are open
 # Checkout mode checks the host and reports release blockers before downloading.
 node scripts/preflight.mjs --mode checkout
 # Release mode additionally requires every patch, asset, and Tor input.
@@ -40,9 +46,10 @@ TB_RUN=1 ./scripts/build.sh && TB_RUN=1 ./scripts/package.sh
 ```
 
 CI ([`.github/workflows/android-engine.yml`](../../.github/workflows/android-engine.yml))
-validates the scaffold on every push. The manual heavy-build dispatch fails
-until the strict release preflight is clean; local source checkout remains
-available so the missing overlay can be developed and rebased.
+validates the scaffold and candidate-record structure on every push. The manual
+heavy-build dispatch fails until the strict release preflight is clean; local
+source checkout remains available so the missing overlay can be developed and
+rebased.
 
 ## Distinct app id
 

apps/android-engine/chromium/README.md

@@ -17,6 +17,7 @@ Track 3.
 chromium/
   config/
     version.json        # pinned chromium + ungoogled versions, targets, tor
+    cromite-candidate.json # attested downstream snapshot + adoption policy
     gn-args/            # common.gni + android.gni (privacy + branding)
   branding/             # product strings + APK icon assets
   patches/              # required TronBrowser Android overlay (after ungoogled)
@@ -29,6 +30,8 @@ chromium/
 node scripts/preflight.mjs --mode scaffold
 node scripts/preflight.mjs --mode checkout
 node scripts/preflight.mjs --mode release
+node scripts/audit-candidate.mjs --mode record
+node scripts/audit-candidate.mjs --mode adopt
 ```
 
 Scaffold mode validates configuration and reports unresolved release inputs.
@@ -37,6 +40,27 @@ requiring release approval, so maintainers can develop patches against a real
 checkout. Release mode refuses to continue while the Chromium pin, required
 patches, branding assets, or pinned Tor integration are unapproved or missing.
 
+Candidate `record` mode validates the pinned downstream snapshot and reports
+licensing, release-lag, freshness, security-SLA, and extension-support blockers
+without failing CI merely because a product decision remains open. `adopt` mode
+fails closed until every blocker is resolved. Both modes are offline: repository
+tags, commits, releases, and patch metadata are recorded attestations, not live
+network verification, and must be refreshed from primary upstream sources before
+an adoption decision. A stale or malformed attestation fails both modes.
+Refresh the record at least every `policy.maximumRecordAgeDays` (currently 30):
+re-check the candidate tag, commit, version, and release date; the recorded stable
+version and source; and the extension patch URL, blob SHA, reviewer, and date.
+
+Use `--json` for machine-readable output. `--as-of YYYY-MM-DD` is available only
+in `record` mode for reproducing a historical snapshot; `adopt` always evaluates
+against the current UTC date. The audit exits with status 0 for a valid record
+(including unresolved product blockers in `record` mode), 1 for invalid evidence
+or a blocked adoption, and 2 for invalid command-line usage.
+
+Cromite release tags contain a 40-character build identifier after the Chromium
+version. That identifier is not assumed to be a Git commit: `commitSha`
+independently pins the tag's resolved Git target.
+
 ## Build (100GB+ free disk, 16GB+ RAM recommended, hours, Linux x64)
 
 Scripts are **guarded**: they dry-run unless `TB_RUN=1`. Source lands outside the

apps/android-engine/chromium/config/cromite-candidate.json

@@ -0,0 +1,43 @@
+{
+  "$schemaVersion": 1,
+  "$comment": "Offline adoption record for the Cromite Android-engine candidate. The tag suffix is Cromite's build identifier; commitSha is the independently pinned Git tag-target commit. Upstream facts are attested snapshots, not live verification.",
+  "candidate": {
+    "name": "Cromite",
+    "repository": "https://github.com/uazo/cromite",
+    "tag": "v148.0.7778.168-cb3baf14f52eb4365d017f640f85310735c19b79",
+    "commitSha": "cdf415cc86c8aa17faa26edf51e12f2fd49a274f",
+    "chromiumVersion": "148.0.7778.168",
+    "publishedAt": "2026-05-21T16:26:34Z"
+  },
+  "snapshot": {
+    "observedOn": "2026-08-17",
+    "recordedBy": "phucnguyen1707",
+    "chromeAndroidStable": {
+      "chromiumVersion": "151.0.7922.71",
+      "sourceUrl": "https://chromereleases.googleblog.com/2026/07/chrome-for-android-update_01846374933.html"
+    }
+  },
+  "policy": {
+    "maximumMajorLag": 1,
+    "maximumReleaseAgeDays": 35,
+    "maximumRecordAgeDays": 30,
+    "emergencySecurityUpdateSlaHours": null
+  },
+  "license": {
+    "spdxId": "GPL-3.0",
+    "sourceUrl": "https://github.com/uazo/cromite/blob/cdf415cc86c8aa17faa26edf51e12f2fd49a274f/LICENSE",
+    "decision": "pending",
+    "decidedBy": null,
+    "decidedOn": null
+  },
+  "extensionSupport": {
+    "requirement": "undecided",
+    "status": "experimental",
+    "enabledByDefault": false,
+    "patchPath": "build/patches/Experimental-support-for-extensions-on-Android.patch",
+    "patchUrl": "https://github.com/uazo/cromite/blob/v148.0.7778.168-cb3baf14f52eb4365d017f640f85310735c19b79/build/patches/Experimental-support-for-extensions-on-Android.patch",
+    "patchBlobSha": "5058d366e52954b10dbea33369562d1a3f0556c0",
+    "attestedBy": "phucnguyen1707",
+    "attestedOn": "2026-08-17"
+  }
+}