See it run
What runs today
Every app below is an unmodified upstream APK, pinned by
hash, running on AOSP's app_process and ART over the Leanux
kernel. Each is checked by a script that boots it and reads back what it
actually did: the pixels on the screen, the bytes in its database, the
samples in its audio buffer.
- Firefox: the real multi-process Gecko engine, loading HTTPS sites over TLS 1.3.
- Calculator: ordinary Android views and touch input.
- Clock: animation paced by vsync, set from the real-time clock.
- Particles: OpenGL ES rendering.
- Editor: files written, listed and read back.
- Currency: DNS, HTTPS and certificate validation from Java.
- Signal generator: audio through Android's AudioTrack.
- uNote: SQLite with POSIX file locking.
- Termux: a terminal, as a non-root app, on a real pseudo-terminal.
Below the apps: preemptive scheduling across cores, isolated user processes, Binder IPC, shared memory, a network stack, and a framebuffer console. BusyBox's shell runs unmodified too.
Why Lean
In Lean a proof and a program are the same kind of thing, checked by the same compiler. So a kernel property can be a theorem that sits next to the code it is about, rather than a comment that nothing checks. Two that are proved: every pixel of an accepted rectangle lies inside the framebuffer, and a directory listing split across pages misses no entry.
Even the C underneath is going the same way. Runtime functions are written as Lean data describing C, proved correct against a model of C in which every undefined behaviour is an error, and only then printed as the C that gets compiled.
The rule is to prove where it pays and measure everywhere else. Every claim the project makes about itself is checked on every commit by something that can fail, and the checks are themselves tested by deliberately breaking what they watch.
The hard part: real hardware
Everything so far runs on QEMU's virt machine. The target is
a OnePlus 6T (Snapdragon 845): fast, cheap, easy
to unlock, and the phone chip with the most reverse-engineering behind it.
That matters, because Qualcomm publishes no datasheet.
The debug serial port is on test points inside the case, so the first thing Leanux says on the phone it will say in pixels, drawn into the framebuffer the bootloader leaves running. That console already exists and is checked on QEMU, so the bring-up starts with an instrument.