Document the Android Chromium source decision

.github/workflows/android-engine.yml

@@ -16,6 +16,10 @@ on:
       - '.github/workflows/android-engine.yml'
   workflow_dispatch:
     inputs:
+      verify_live:
+        description: 'Read GitHub API and verify the recorded Cromite release facts'
+        type: boolean
+        default: false
       real_build:
         description: 'Run the REAL Chromium build (needs a large/self-hosted Linux runner)'
         type: boolean
@@ -67,6 +71,10 @@ jobs:
           node scripts/audit-candidate.mjs --mode record --json | tee "$report"
           jq -e '.status == "ready" or .status == "blocked"' "$report" > /dev/null
 
+      - name: Live-verify recorded Cromite release facts
+        if: github.event_name == 'workflow_dispatch' && inputs.verify_live
+        run: node scripts/audit-candidate.mjs --mode record --live --explain
+
       - name: Android engine checks
         working-directory: .
         run: |

apps/android-engine/README.md

@@ -20,6 +20,8 @@ path toward an Ungoogled Chromium engine and optional bundled Tor, built as an
 - ✅ A pinned Cromite candidate snapshot and offline adoption gate record
   license, release-lag, freshness, and extension-support decisions without
   treating external attestations as a verified build.
+- ✅ An opt-in, read-only GitHub verification mode for the pinned release tag,
+  commit, LICENSE blob, extension patch blob, and release freshness.
 - ⬜ Patch bodies (`chromium/patches/tronbrowser-android/*.patch`), real
   Android branding assets, and pinned/checksummed Tor artifacts.
 - ⬜ Current Chromium security pin and first real compile (Linux x64, at least
@@ -35,6 +37,7 @@ cd apps/android-engine/chromium
 node scripts/preflight.mjs --mode scaffold
 # Validate the recorded source snapshot without claiming it is adoptable.
 node scripts/audit-candidate.mjs --mode record
+node scripts/audit-candidate.mjs --mode record --live --explain
 node scripts/audit-candidate.mjs --mode adopt  # fails while decisions are open
 # Checkout mode checks the host and reports release blockers before downloading.
 node scripts/preflight.mjs --mode checkout

apps/android-engine/chromium/README.md

@@ -31,6 +31,7 @@ node scripts/preflight.mjs --mode scaffold
 node scripts/preflight.mjs --mode checkout
 node scripts/preflight.mjs --mode release
 node scripts/audit-candidate.mjs --mode record
+node scripts/audit-candidate.mjs --mode record --live --explain
 node scripts/audit-candidate.mjs --mode adopt
 ```
 
@@ -43,15 +44,23 @@ patches, branding assets, or pinned Tor integration are unapproved or missing.
 Candidate `record` mode validates the pinned downstream snapshot and reports
 licensing, release-lag, freshness, security-SLA, and extension-support blockers
 without failing CI merely because a product decision remains open. `adopt` mode
-fails closed until every blocker is resolved. Both modes are offline: repository
-tags, commits, releases, and patch metadata are recorded attestations, not live
-network verification, and must be refreshed from primary upstream sources before
-an adoption decision. A stale or malformed attestation fails both modes.
+fails closed until every blocker is resolved. Both modes are offline by default:
+repository tags, commits, releases, and patch metadata remain recorded
+attestations unless `--live` is explicitly supplied. Live mode reads only the
+canonical GitHub API, resolves lightweight or annotated release tags, and checks
+the recorded commit and release timestamp, the LICENSE and extension patch blobs
+read at that resolved release commit, and locally computed release age. It never
+changes the record. `--explain` prints
+the exact recorded and observed values when they differ. A stale, malformed, or
+live-mismatched attestation fails closed.
 Refresh the record at least every `policy.maximumRecordAgeDays` (currently 30):
 re-check the candidate tag, commit, version, and release date; the recorded stable
-version and source; and the extension patch URL, blob SHA, reviewer, and date.
+version and source; the license blob SHA; and the extension patch URL, blob SHA,
+reviewer, and date.
 
-Use `--json` for machine-readable output. `--as-of YYYY-MM-DD` is available only
+Use `--json` for machine-readable output. The manual Android-engine workflow can
+run the same read-only check with its `verify_live` input; push and pull-request
+workflows never opt into network verification. `--as-of YYYY-MM-DD` is available only
 in `record` mode for reproducing a historical snapshot; `adopt` always evaluates
 against the current UTC date. The audit exits with status 0 for a valid record
 (including unresolved product blockers in `record` mode), 1 for invalid evidence

apps/android-engine/chromium/config/cromite-candidate.json

@@ -26,6 +26,7 @@
   "license": {
     "spdxId": "GPL-3.0",
     "sourceUrl": "https://github.com/uazo/cromite/blob/cdf415cc86c8aa17faa26edf51e12f2fd49a274f/LICENSE",
+    "blobSha": "f288702d2fa16d3cdf0035b15a9fcbc552cd88e7",
     "decision": "pending",
     "decidedBy": null,
     "decidedOn": null