This prototype is not an audited sandbox. APKs are untrusted binary inputs; the host process still has the user's permissions. Use trusted APKs.
Compressed/expanded APK totals are capped at 256 MiB, each entry at 64 MiB, entry count at 50,000. Decompression is bounded independently of declared sizes. ZIP traversal/duplicates/symlinks are rejected and no APK data is extracted. Readers check ranges/overflow; XML/layout/encoded-value nesting and reference chains are bounded. DEX header/digests and referenced table indexes are checked.
Guest references are typed handles, not FFI pointers. Register/array/object references are checked during execution. Unknown opcodes/classes/framework/native calls fail explicitly. Frame/instruction/string/array/object limits exist but are not a complete process memory or CPU-time sandbox.
Private preferences and SQLite use a host-selected apps root with directory capabilities per validated package. No-follow directory/file access, package identity checks, case-distinct preference filenames, Unix hard-link rejection, bounded JSON and atomic writes have regressions. Damaged files fail without reset. See storage behavior and limits. ACTION_OPEN_DOCUMENT_TREE is a separate explicit host choice: the native folder chooser retains a directory descriptor for the selected tree and returns an opaque content URI. Grants last only for the current runtime session, with a 64-grant ceiling. URI parsing grants no access. Read-only metadata queries and streams stay confined to the selected tree's open directory descriptor. Traversal, foreign/unknown grants, symlinks, special files and hard-linked files are rejected; unsafe child entries are omitted from enumeration. Intermediate directories and final files are opened without following links. Streams verify the opened file and bound declared and actual length to 64 MiB. Enumeration is capped at 4,096 entries and path depth at 64. Grants disappear on runtime close/restart; writes, persistent permissions, other providers and ambient file URIs remain unavailable.
Environment's virtual external directory maps to a separate subtree inside the current package capability. It grants no shared host volume or cross-package access. Directory traversal and symlinks are checked by the same storage boundary.
FileInputStream snapshots regular files only within the package capability, with no-follow opens, hard-link rejection and a 64 MiB read ceiling. Its input channel shares the snapshot's position and close state without granting a host descriptor. Output streams, transfer/mapping/locking and general file channels remain unavailable.
Network, clipboard, camera, microphone, location, process and native-library APIs are unavailable. Inspected manifest permissions grant no host capabilities. Native controls handle explicit user input/paste, while the AppKit bridge consumes trusted Rust structures on the main thread. UI strings with NUL fail C conversion; callback errors stop execution rather than faking success.
No signature trust policy, full verifier, out-of-process isolation, OS sandbox, adversarial review or continuous coverage-guided fuzz campaign has been completed. Native codecs/JNI/JIT each require new boundary review before exposure. Future host I/O must be confined to per-package capabilities; sensitive desktop access must remain explicit. Package-name impersonation, host modification of data and concurrent processes are outside the current storage trust model.