Record Waydroid experiment and return app diagnostics on failure

Author: andre487

app/src/androidTest/java/net/megaproxy487/WaydroidSmokeInstrumentation.kt

@@ -11,6 +11,7 @@ import net.megaproxy487.model.GlobalConnectionSettings
 import net.megaproxy487.model.ProxyConfig
 import net.megaproxy487.model.ProxyType
 import net.megaproxy487.vpn.ProxyVpnService
+import net.megaproxy487.vpn.PersistentDiagnosticLog
 import java.net.InetSocketAddress
 import java.net.Socket
 import java.util.UUID
@@ -71,6 +72,7 @@ class WaydroidSmokeInstrumentation : Instrumentation() {
         } catch (error: Exception) {
             result.putString("smoke", "failed")
             result.putString("reason", error.javaClass.simpleName + ": " + error.message)
+            result.putString("diagnostics", PersistentDiagnosticLog.readTail(16_384))
             resultCode = Activity.RESULT_CANCELED
         } finally {
             ProxyVpnService.stop(targetContext)

docs/reviews/waydroid-2026-10-06.md

@@ -0,0 +1,54 @@
+# Waydroid CI experiment — 2026-10-06
+
+This is an experimental snapshot, not evidence of completed VPN coverage.
+The workflow is separate from required pull-request CI.
+
+## Setup and test
+
+GitHub-hosted Ubuntu 24.04, stock Azure kernel 6.17.0-1022-azure,
+Binder from the matching Ubuntu `linux-modules-extra` package, official
+Waydroid VANILLA image, software rendering, headless Weston and PulseAudio.
+No KVM, custom kernel or third-party kernel module was used.
+
+`bundle exec fastlane android waydroid_smoke` builds debug and instrumentation
+APKs and runs a platform Instrumentation test. It writes a disposable SSH profile
+through real ConfigStore/Keystore, starts the production VpnService and requires
+an exact HTTP echo through JNI/TUN and OpenSSH. Docker supplies an isolated
+origin and disposable credentials. A host firewall rule blocks direct origin
+access; the test first verifies that a direct connection fails.
+
+## Observed runs
+
+- [Kernel preflight](https://github.com/andre487/AndroidMegaProxy/actions/runs/37470332052)
+  passed after installing the matching modules package.
+- [First full run](https://github.com/andre487/AndroidMegaProxy/actions/runs/37471254591)
+  built APKs but could not boot Android: Waydroid attempted to bind-mount a missing
+  PulseAudio socket. The setup now starts PulseAudio before the Android session.
+- [Second full run](https://github.com/andre487/AndroidMegaProxy/actions/runs/37472951377)
+  booted Android, installed both APKs and ran instrumentation. The direct-access
+  assertion passed, but the production service did not reach its connected state
+  within 45 seconds. Android repeatedly created and removed `tun0`; logcat also
+  contained netd/iptables errors, including an unavailable `quota2` match and
+  an IPv6 filter table. The SSH server logged no connections. These observations
+  do not establish the cause: app diagnostics were not yet collected.
+- A follow-up run adds the app's persistent diagnostic log and a three-minute
+  instrumentation timeout. Its result must be evaluated before claiming success.
+
+Local instrumentation compilation, shell syntax, actionlint and
+`bundle exec fastlane android_checks` passed (184 JVM tests, lint, debug build,
+verified unsigned release build). The ordinary GitHub CI also passed.
+
+## Limits and decision
+
+Keep this optional until forwarding works and repeated runs establish useful
+reliability. A booted Android container alone does not prove VPN/JNI coverage.
+Do not change production code merely to accommodate this test environment.
+
+VPN and notification permission UI are bypassed deliberately. This setup does
+not test API 26, physical radios, OEM policies, reboot recovery, DNS leaks or
+the complete release checklist. Sessions, Docker fixtures and the firewall rule
+are removed on exit; uploaded logs have seven-day retention.
+
+No maintained setup action was identified in the search. The repository
+[waydroid-action-test](https://github.com/ikuaki1009/waydroid-action-test) provides
+an older example workflow, but its custom kernel-module approach was not reused.