- CacheResolverClient/SpkiPinning: resolve component downloads through
os.pawlet.cache's IPawletCacheService when available (SPKI-pinned),
falling back to the origin URL otherwise. sepolicy domain (bg_upd.te,
seapp_contexts) for the new binder client + apps.php dispatcher.
- PolicyReader: read the policy PawletProfiled/pawletprofiled's
software-update MDM payload handler writes to
/data/system/pawletos/software_update_policy.json (previously unread on
either platform). Wired into the scheduled JobService and UpdateExecutor:
autoCheck=false skips the periodic check outright; autoDownload/
autoInstall=false stages found updates instead of silently installing
them; deferDays holds a staged update until it's been pending that long
(new pending_first_seen_at column, DB v2 -> v3). Explicit user/MDM-
triggered checks and installs are unaffected — the policy only throttles
the automatic path, matching the payload's own field names.
oxmc
a1ff8098cc