Traced every code path (CacheOrchestrator, MdnsDiscovery, CentralLookupClient,
PolicyOverride, PawletCacheService) against pawlet_cache.te — no gaps found,
existing rules already match what the code actually does.
The custom pawletcache_vendor_config_file type/label tripped Treble's
coredomain-can't-read-/vendor neverallow, since a hand-rolled
vendor_file_type subtype isn't in that rule's exception list. Dropping the
override lets /vendor/etc/pawletcache fall under AOSP's default
vendor_configs_file labeling, which every domain already has blanket read
access to.
Bound service BgUpd consults before downloading component assets:
discovers a trusted cache server (mDNS and/or central lookup, policy-
configurable), verifies its signed CacheToken against a pinned root key,
and hands back a rewritten URL + TLS pin. Three-tier discovery policy
(runtime MDM override -> vendor-baked default -> compiled default).
Pairs with pawletcache-server (the LAN daemon) and BgUpd (the caller).
oxmc