Real-device lifecycle
Install, scan, quarantine, restore and upgrade paths need evidence on actual supported devices.
Scan apps and files without pretending Android is a desktop OS.
Android 0.1.0 is the current Production Candidate, with installed-app and APK/file scanning, encrypted quarantine, signed production Threat DB verification and DNS-focused web protection.
Official: aq.kingai.work
Two distribution flavors
The Play and Direct builds keep permission boundaries explicit. Broad shared-storage access belongs only to the Direct flavor; both support installed-app visibility required by the product design.
Current capabilities
Android protection with platform-specific honesty.
✓
Installed-app scanningChecks base and split APK hashes plus application metadata and risk signals.
✓
APK and file scansInspect packages and files before opening, including VIEW/SEND scan flows.
✓
AES-GCM quarantineEncrypted recovery copy is verified before source deletion and again before cleanup after restore.
✓
Signed Threat DBHTTPS + ECDSA P-256 + SHA-256, strict schema, expiry, minimum engine version and rollback high-water protection.
✓
DNS-only local VPNBlocks known-bad destinations without installing a certificate authority or decrypting HTTPS traffic.
✓
Limited when intelligence is bootstrap-onlyThe embedded database is not treated as full production coverage.
Release status
What still separates candidate from Commercial Stable.
VPN transition testing
Network switching, failover and OEM-specific behavior must be validated rather than assumed.
Play policy review
Restricted-permission policy review is a gate; review evidence is not the same as store acceptance.
Production feed verification
The actual release job must validate the live Threat DB manifest, exact schema/types, P-256 signature and time window before signing builds.
Track the Android release path.
Review current status before installing a build.
aq.kingai.work