Add optional source-built pdx235 vold timeout module

.github/schedules/grapheneos-shiba.toml

@@ -20,4 +20,6 @@ MAGISK_PREINIT = "sda10"
 # These modules are only supported on LineageOS pdx235, not GrapheneOS.
 'ADDITIONALS[EXFATPROGS_FSCK]' = false
 'ADDITIONALS[FSCK_SYSFS_SEPOLICY]' = false
+# Vold remains disabled until an independently qualified binary is pinned.
+'ADDITIONALS[LINEAGE_VOLD_EXFAT_TIMEOUT]' = false
 FORCE_UPDATE = false

.github/schedules/lineageos-pdx235.toml

@@ -20,4 +20,6 @@ MAGISK_PREINIT = "sda47"
 'ADDITIONALS[MAS_COMPATIBLE_SEPOLICY]' = true
 'ADDITIONALS[EXFATPROGS_FSCK]' = true
 'ADDITIONALS[FSCK_SYSFS_SEPOLICY]' = true
+# Vold remains disabled until an independently qualified binary is pinned.
+'ADDITIONALS[LINEAGE_VOLD_EXFAT_TIMEOUT]' = false
 FORCE_UPDATE = false

.github/workflows/build-rom.yml

@@ -72,6 +72,11 @@ on:
         required: false
         type: boolean
         default: false
+      lineage-vold-exfat-timeout:
+        description: Replace pdx235 vold with an independently qualified and SHA-pinned source-built binary
+        required: false
+        type: boolean
+        default: false
       update-channel:
         required: true
         type: string
@@ -152,6 +157,7 @@ env:
   ADDITIONALS_SHIZUKU: ${{ inputs.shizuku }}
   ADDITIONALS_EXFATPROGS_FSCK: ${{ inputs.exfatprogs-fsck }}
   ADDITIONALS_FSCK_SYSFS_SEPOLICY: ${{ inputs.fsck-sysfs-sepolicy }}
+  ADDITIONALS_LINEAGE_VOLD_EXFAT_TIMEOUT: ${{ inputs.lineage-vold-exfat-timeout }}
   ADDITIONALS_BOOT_ANIMATION: ${{ inputs.boot-animation }}
 
 # Publishing inherits the caller job's permission ceiling. A reusable
@@ -178,6 +184,11 @@ jobs:
           DEVICE_CANDIDATE_RECIPIENT_BASE64: ${{ inputs.device-candidate-recipient-base64 }}
           PUBLISH_REQUEST: ${{ inputs.publish }}
         run: |
+          if [[ "${ADDITIONALS_LINEAGE_VOLD_EXFAT_TIMEOUT:-false}" == true ]] &&
+            [[ "${ROM_FAMILY}" != lineageos || "${DEVICE_NAME}" != pdx235 ]]; then
+            echo '::error::Source-built vold is supported only for LineageOS pdx235'
+            exit 1
+          fi
           if [[ "${EXPORT_DEVICE_CANDIDATE}" == true ]]; then
             [[ ("${DEVELOPMENT_PROFILE}" == care-map-pdx235 ||
                  "${DEVELOPMENT_PROFILE}" == care-map-pdx235-lineage24) &&
@@ -229,6 +240,17 @@ jobs:
           fetch-depth: 0
           persist-credentials: ${{ inputs.publish && inputs.release-type != 'build-only' }}
 
+      - name: Download approved source-built vold artifact
+        if: inputs.lineage-vold-exfat-timeout
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          python3 src/ci/fetch_lineage_vold_artifact.py --output-dir "${RUNNER_TEMP}/lineage-vold-artifact"
+          echo "PIXENEOS_VOLD_ARTIFACT_DIR=${RUNNER_TEMP}/lineage-vold-artifact" >> "${GITHUB_ENV}"
+          echo "PIXENEOS_VOLD_BASE_BUILD_ID=lineage-24.0-20261016-nightly-pdx235-signed" >> "${GITHUB_ENV}"
+
       - name: Build and verify exfatprogs corresponding-source bundle
         if: inputs.exfatprogs-fsck && inputs.publish && inputs.release-type != 'build-only' && inputs.rom-family == 'lineageos' && inputs.device-id == 'pdx235'
         shell: bash

.github/workflows/ci.yml

@@ -99,6 +99,15 @@ jobs:
       - name: Test exfatprogs image metadata diagnostics
         run: python3 tests/exfat_adapter_metadata_test.py
 
+      - name: Test source-built Vold module contract
+        run: python3 tests/lineage_vold_contract_test.py
+
+      - name: Test byte-exact unmodified Vold reproduction contract
+        run: python3 tests/lineage_vold_baseline_test.py
+
+      - name: Test source-built Vold workflow routing
+        run: python3 tests/lineage_vold_workflow_contract_test.py
+
       - name: Test pdx235 Custota metadata preparation
         run: bash tests/pdx235_custota_metadata_test.sh
 
@@ -171,3 +180,96 @@ jobs:
       signing-mode: disposable
       release-type: build-only
       publish: false
+
+  # Manual opt-in on the owned review branch only. No publishing keys, release
+  # credentials, rootless/Magisk patching, or binary-injection paths are used.
+  # The runner must have a large isolated scratch volume and Android build deps.
+  lineage_vold_exact_baseline:
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.head_ref == 'codex/lineage-vold-exfat-timeout-pr' && vars.MODOS_VOLD_BASELINE_RUNNER_READY == 'true' && vars.MODOS_LINEAGE_LARGE_SCRATCH != '' }}
+    runs-on: [self-hosted, linux, x64, modos-lineage-large]
+    timeout-minutes: 360
+    permissions:
+      contents: read
+    concurrency:
+      group: lineage-vold-unmodified-baseline
+      cancel-in-progress: false
+    env:
+      MODOS_LINEAGE_LARGE_SCRATCH: ${{ vars.MODOS_LINEAGE_LARGE_SCRATCH }}
+    steps:
+      - name: Checkout exact PR source without retained credentials
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Check isolated build host and initialize scratch workspace
+        shell: bash
+        run: |
+          set -euo pipefail
+          for tool in repo avbroot unzip debugfs curl openssl python3 git; do
+            command -v "${tool}" >/dev/null || { echo "::error::Missing host tool: ${tool}"; exit 1; }
+          done
+          scratch="${MODOS_LINEAGE_LARGE_SCRATCH}"
+          [[ "${scratch}" == /* && -d "${scratch}" && ! -L "${scratch}" ]] ||
+            { echo "::error::A real absolute large scratch directory is required"; exit 1; }
+          scratch="$(realpath -e -- "${scratch}")"
+          echo "MODOS_LINEAGE_LARGE_SCRATCH=${scratch}" >> "${GITHUB_ENV}"
+          free="$(df -PB1 -- "${scratch}" | awk 'END {print $4}')"
+          (( free >= 220000000000 )) ||
+            { echo "::error::Baseline source build needs at least 220GB available"; exit 1; }
+          work="$(mktemp -d -- "${scratch}/modos-vold-baseline.XXXXXXXX")"
+          echo "VOLD_BASELINE_WORK=${work}" >> "${GITHUB_ENV}"
+
+      - name: Resolve exact authenticated 2026-10-16 OTA or reviewed archive
+        id: official
+        shell: bash
+        run: python3 src/ci/resolve_lineage_vold_ota.py --output "${GITHUB_OUTPUT}"
+
+      - name: Download, authenticate and extract original OTA vold
+        shell: bash
+        env:
+          OTA_URL: ${{ steps.official.outputs.ota_url }}
+          OTA_SHA256: ${{ steps.official.outputs.ota_sha256 }}
+        run: |
+          set -euo pipefail
+          [[ "${OTA_SHA256}" =~ ^[0-9a-f]{64}$ ]] || exit 1
+          curl --fail --location --retry 3 --proto '=https' --proto-redir '=https' \
+            --output "${VOLD_BASELINE_WORK}/source.zip" "${OTA_URL}"
+          bash src/ci/prepare_lineage_vold_reference.sh \
+            "${VOLD_BASELINE_WORK}/source.zip" "${VOLD_BASELINE_WORK}/reference" "${OTA_SHA256}"
+
+      - name: Sync full immutable LineageOS source manifest
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 src/ci/build_lineage_vold.py sync \
+            --source-root "${VOLD_BASELINE_WORK}/source" --jobs 4
+
+      - name: Reproduce unmodified vold and check byte-exact OTA identity
+        shell: bash
+        env:
+          OTA_SHA256: ${{ steps.official.outputs.ota_sha256 }}
+        run: |
+          set -euo pipefail
+          python3 src/ci/build_lineage_vold.py baseline \
+            --source-root "${VOLD_BASELINE_WORK}/source" \
+            --reference-vold "${VOLD_BASELINE_WORK}/reference/reference-vold" \
+            --source-ota-sha256 "${OTA_SHA256}" \
+            --output-dir "${VOLD_BASELINE_WORK}/baseline" --jobs 4
+
+      - name: Preserve comparison receipt only (no signed or patched OTA)
+        if: always() && env.VOLD_BASELINE_WORK != ''
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: lineage-pdx235-original-vold-baseline-report
+          path: ${{ env.VOLD_BASELINE_WORK }}/baseline/baseline-report.json
+          if-no-files-found: warn
+          retention-days: 14
+
+      - name: Erase isolated source and extracted images
+        if: always() && env.VOLD_BASELINE_WORK != ''
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "${VOLD_BASELINE_WORK}" == "${MODOS_LINEAGE_LARGE_SCRATCH}"/modos-vold-baseline.* ]] || exit 1
+          rm -rf -- "${VOLD_BASELINE_WORK}"

.github/workflows/release-lineage.yml

@@ -70,6 +70,11 @@ on:
         required: false
         type: boolean
         default: false
+      lineage-vold-exfat-timeout:
+        description: Use the independently qualified, hash-pinned pdx235 vold (requires approved staging artifact)
+        required: false
+        type: boolean
+        default: false
       disable-system-updater:
         description: Remove the stock ROM updater app (use with Custota)
         required: false
@@ -145,6 +150,7 @@ jobs:
       compatible_sepolicy_patching: ${{ steps.definition.outputs.compatible_sepolicy_patching }}
       exfatprogs_fsck: ${{ steps.definition.outputs.exfatprogs_fsck }}
       fsck_sysfs_sepolicy: ${{ steps.definition.outputs.fsck_sysfs_sepolicy }}
+      lineage_vold_exfat_timeout: ${{ steps.definition.outputs.lineage_vold_exfat_timeout }}
       should_build: ${{ steps.existing.outputs.should_build }}
     steps:
       - name: Checkout code
@@ -179,6 +185,16 @@ jobs:
         shell: bash
         run: python3 src/ci/build_exfatprogs_source_bundle.py --output-dir "${RUNNER_TEMP}/exfatprogs-source" --check-deterministic
 
+      - name: Download approved vold artifact for scheduled preflight
+        if: steps.definition.outputs.lineage_vold_exfat_timeout == 'true'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          python3 src/ci/fetch_lineage_vold_artifact.py --output-dir "${RUNNER_TEMP}/lineage-vold-artifact"
+          echo "PIXENEOS_VOLD_ARTIFACT_DIR=${RUNNER_TEMP}/lineage-vold-artifact" >> "${GITHUB_ENV}"
+          echo "PIXENEOS_VOLD_BASE_BUILD_ID=lineage-24.0-20261016-nightly-pdx235-signed" >> "${GITHUB_ENV}"
+
       - name: Check for an already-published matching OTA pair
         id: existing
         shell: bash
@@ -212,6 +228,7 @@ jobs:
       compatible-sepolicy-patching: ${{ needs.schedule_config.outputs.compatible_sepolicy_patching == 'true' }}
       exfatprogs-fsck: ${{ needs.schedule_config.outputs.exfatprogs_fsck == 'true' }}
       fsck-sysfs-sepolicy: ${{ needs.schedule_config.outputs.fsck_sysfs_sepolicy == 'true' }}
+      lineage-vold-exfat-timeout: ${{ needs.schedule_config.outputs.lineage_vold_exfat_timeout == 'true' }}
       allow-unauthorized-adb: false
       boot-animation: ${{ needs.schedule_config.outputs.boot_animation == 'true' }}
       release-type: default
@@ -236,6 +253,7 @@ jobs:
       shizuku: ${{ inputs.shizuku }}
       exfatprogs-fsck: ${{ inputs.exfatprogs-fsck }}
       fsck-sysfs-sepolicy: ${{ inputs.fsck-sysfs-sepolicy }}
+      lineage-vold-exfat-timeout: ${{ inputs.lineage-vold-exfat-timeout }}
       disable-system-updater: ${{ inputs.disable-system-updater }}
       boot-animation: ${{ inputs.boot-animation }}
       export-device-candidate: ${{ inputs.export-device-candidate }}

README.md

@@ -292,6 +292,29 @@ any new OTA assets. Local-unpublished builds do not require source publication.
 The recorded signed APT metadata is audit provenance; builds verify the lock's
 package URL, size, and SHA-256, but do not repeat the APT signature check.
 
+### Source-built vold timeout for LineageOS pdx235
+
+The experimental `lineage-vold-exfat-timeout` module aims to raise only the
+exFAT fsck timeout from 45 to 120 seconds. **It is default-off and has not
+passed a real unmodified-binary reproduction test.** Before compiling a patched
+`vold`, the dedicated, nonpublishing large-runner CI must build **unmodified
+`vold`** from the locked 1,243-project LineageOS 2026-10-16 manifest and
+demonstrate a *byte-for-byte match* against the executable extracted from the
+publisher-authenticated official OTA. A matching ABI or source revision is
+not sufficient. A mismatch blocks all subsequent patched builds.
+
+After that baseline gate passes, the separate `build` command requires the
+baseline report, exact unmodified binary and OTA reference before applying
+the isolated exFAT timeout patch. System/product identity, ELF dependencies,
+root ownership, actual `vold_exec` metadata, and independently approved
+binary SHA-256 are also checked prior to production use. Public scheduled
+LineageOS and manual selectors remain **disabled**, and GrapheneOS is excluded.
+
+See [`docs/lineage-vold-exfat-timeout.md`](docs/lineage-vold-exfat-timeout.md)
+for the complete CI runner setup, baseline-first acceptance sequence,
+provenance requirements and remaining device qualification gates. No vold OTA
+has been authorized for force-publish.
+
 ### Custom boot animation (enabled by default)
 
 All builds use the checked-in `custom/boot-animation/bootanimation.zip` by