SUN IB-C67-URL-01 — ICU over Shizuku into Arena, then native reader #151

Execution update — 2026-10-24

SUN IB-READER-APK-FINISH-01 remains INCOMPLETE. No usable URL-reader APK has been published.

• isomorphisms/ib PR #155, “Stream authorized Shizuku ICU responses into app-private canonical Arena via Binder PFD” now adds a metadata-aware paired-frame publisher at 801dba2. It validates ICU framing/observations, generation, exact bytes and hashes, commits only body bytes through canonical appendfat, reopens them, and writes Arena v2. The body-only v1 path remains unadmitted. All current-head workflows pass, including ICK host execution and ARM32/ARM64 builds: https://github.com/isomorphisms/ib/actions/runs/40103215403. The artifact and embedded hashes were independently rechecked, and the actual host test reran successfully. Its ICU metadata source is synthetic; it is not Android Binder/Shizuku or real HTTPS acceptance.
• isomorphisms/android-NDK PR #30, “Canonicalize DEX/JNI and execute checked recursive calls” restores the separately qualified object-construction and explicit Activity-lifecycle path at 976890d72a3c880e57aafb94898225c4f2c9b9fa, alongside the existing casts and create/action adapter. The unchanged Material screen emits byte-identical DEX b2ce30b0af52bc52beffd167fcbac331d447eeb7ac4a13db0e068662be2d0c17. Local host/decoder/refusal/production-mutation tests pass; fresh current-head hosted/ART checks are pending.
• The actual unchanged NativeSourceProjection consumer against current IB main 0f3d8dc still fails with the rebuilt checked backend: source constructor _builtin.NIL in checked helper IB.Information.tokenize_chars, exit 1, no reader.dex. This is a missing changing-list/runtime representation, not a request to handwrite application DEX or substitute Java.

Required work remains: reusable heap/list/record/helper lowering and actual checked-reader ART execution; app-owned private Binder capability lifecycle and wiring; real ICU HTTPS to native view; links, Back, exact selection/copy and durable restart; signing/update-compatible C67 APK and permanent release. Current ICU capture supplies only redirect count and an unobserved charset in some responses; neither is silently upgraded to full redirect provenance or UTF-8 admission. Physical C67 access/acceptance is unavailable here and remains pending.

The previously merged main source/PFD integration is preserved. Both continuations remain draft, with no merge, release or completion claim.

Execution update — 2026-10-19

The bounded metadata-aware ICU → Arena v2 → PFD source slice was reviewed and merged to main via #158 at 14ea8a3. All six candidate checks passed; its 25 imported blobs exactly match the separately accepted source branches. The current main tip was independently re-read after merge. A local two-process descriptor/refusal test also passed; this is host evidence only.

The existing private ingress draft #155 was repaired at d6904a7: reconciled the v2 parent, preserved metadata capture separately from body-only stdout, repaired invocation counting and PIE linkage, and required the v2 HTML reader to refuse v1 body-only receipts. All six fresh exact-head checks passed, including canonical ICK execution and Android ARM32/ARM64 cross-builds: https://github.com/isomorphisms/ib/actions/runs/39268429009.

Product blocker: the private ingress publisher still has no observed HTTP metadata and emits v1/navigation_admitted=NO. It cannot feed the admitted HTML reader. App-side private Binder capability lifecycle and checked Idriç reader wiring are also absent. No URL-capable C67 APK, real Shizuku/Binder transaction, graphical navigation or physical acceptance is claimed. Keep this job open.

Goal

Make a pasted URL in the physical MIRO C67 IB reader load through Binder/Shizuku worker → ICU fetch → committed Arena source → Idriç Prepaint → native Android views, never through a direct Android-reader HTTP client or a WebView fetch.

Observed device state (2026-10-14)

User installed org.isomorphisms.ib.material3 v1 from the checked PR #129 artifact (APK SHA-256 6794bf03fc06d023e354db954d8d58f853f3f8058d4e9fea36332d6275fcf448) on MIRO C67 and reports it loads without issue. The APK displays only a pinned README snapshot; it provides no working URL acquisition. This is user-reported physical launch evidence, not independently instrumented C67 acceptance, successful network navigation or a functional browser.

Reuse, no rival stack

• Native checked Idriç/DEX Material reader: Build a checked native Material 3 reader screen #129, PR Remove Java application paths and add a checked direct-DEX reader #147's Java removal; preserve working width reflow and selectable text.
• ICU: dilapidated-shed/icu, command icu get URL, Idric-Net request types and its native transport. ICU has a bounded Android armeabi-v7a transport build. Its current response evidence does not yet expose the full final URL/redirect chain: extend ICU's own response owner as described in SUN IB-X64-04 — Connect ICU acquisition and durable navigation #142, rather than guessing.
• Android process boundary: IB Binder provider (Make Binder the Android host boundary #112); Shizuku is the replaceable current provider. Grease supervises invoking ICU and streaming captured bytes. Shizuku authorization must be checked, and denied/missing Shizuku must be reported, not silently replaced with a reader-owned HTTP stack.
• Storage: Define ordinary-file and future appendfat storage contracts without pretending the filesystem exists #97 userspace append Arena / ordinary-file committed publication, not a claim that kernel appendfat is present. Preserve Cauldron source identity/provenance and Pensieve's derived representations (Retain source generations and rebuild source-linked Pensieve views #46); do not create another canonical store. No hard-coded universal pathname or reliance on shared Android UID access.

Executable slice

1. Checked Idriç URL input, Go, back and current source identity; send a bounded navigation request through the existing Binder/Shizuku provider. Keep network permission out of the reader APK.
2. Grease/worker executes pinned ICU. Stream binary response and bounded metadata to Arena with private file descriptor/ContentProvider or equivalent scoped capability, not a giant textual stdout or world-readable /data/local/tmp file. Preserve requested/resolved URL, redirect, status, MIME/charset, bytes, digest, attempt ID and provenance. Commit source generation only after checked write/sync; failure leaves the previous generation intact.
3. Reader reopens the committed Arena result, verifies source digest/length and navigation generation, and consumes a source-linked Idriç extraction/Prepaint projection. Renderer has no fetch or persistent tab/history authority. Preserve last valid page on error; link traversal creates a new browser-owned navigation event. Source-backed image loads similarly.
4. First milestone: enter https://example.com/, observe the independently executed ICU HTTPS response, committed Arena bytes, the rendered document and a working link to another committed source. Show actual requested/resolved URLs; mark unsupported dynamic HTML explicitly.

Required independent verification

• CI source/ABI and actual Android runtime (ARM32 armeabi-v7a, C67 also supports 64-bit) are separate; emulator x86-64 acceptance is not C67 acceptance.
• Physical C67: record getprop ABI, Shizuku identity/auth, worker UID, ICU/compiler APK/source digests, actual HTTPS URL/body digest, Arena commit, reopened identical bytes, rendered output, and copied text. No private token or credential in public logs.
• Negative controls: denied Shizuku, ICU absent, TLS failure, redirect/credential protection, timeout/oversize, partial write, source corruption, worker/renderer death, stale/out-of-order completion and arena access denial; previous good page remains readable. Reboot/read-after-restart separately.
• No Java/Kotlin application logic, browser-owned HttpURLConnection, direct WebView fetch, or silent fallback.
• Independently qualified APK and hashes; maintain the known v1 test-signature/update compatibility where possible. Do not call anything delivered/physical PASS unless executed.

Related owners

IB #142 ICU acquisition/navigation (Linux parity), #141 semantic reflow, #143 durable storage/supervision, #97 Arena/backend storage, #112 Binder/Shizuku boundary, PR #129 native reader, PR #147 Java removal, ICU Android transport. Coordinate exact dependency SHAs and AI-CI acceptance. Do not close on documentation or a fixed README APK.

Status: REQUIREMENT RECORDED / NOT IMPLEMENTED / NO URL-CAPABLE C67 APK YET.