andashi turns a Pixel running GrapheneOS into six phones in one. Each part, a zone, has its own apps, its own way onto the internet and its own colour, so the app for your 3D printer never sits next to your messages and your passwords. All of it is written down in files and set up from a computer, and the phone answers with what it actually applied, not with the hope that it worked.
Early development, and honestly so: this has only ever run against an emulator, because there is no spare phone to run it against yet. Breaking changes are the normal case.
Dashi is the stock a Japanese kitchen starts from: kombu, katsuobushi, water. You never taste it on its own, it is in everything, and it is the reason the rest works.
That is what a distribution is. It takes software other people make, here GrapheneOS and about forty apps, and decides how it all fits together: which app goes where, what is switched on, what is left out. When it is any good, nobody notices it — you notice the phone, not the files underneath. The an is the Android part, and the mark is the sun those files put on every home screen.
You do not need to know any of this to use the phone. You need it to judge whether the phone is for you.
Android, hardened. A free operating system for Google Pixel phones, made by an independent non-profit project. It runs ordinary Android apps, but Google's services are not built in, and it closes holes an ordinary phone leaves open. Where an app really needs Google Play, Play can run as a normal app in a box, without special powers. andashi builds on GrapheneOS; it is not part of that project.
A separate user on the phone, as if a second person had an account on it: its own apps, its own files, its own encryption key and its own network route. An app in one zone cannot look into another. andashi sets up six, and decides for each one what may live there.
Instead of tapping through settings for an afternoon, you describe the phone in a few text files on a computer, and a script sets it up over a USB cable. Run it again and you get the same phone. Change one line and only that line changes. Afterwards the script reads the phone back and complains if the phone disagrees.
A default nobody chose is still a choice: an app that comes with the system, a permission nobody took away, a search engine the launcher puts under every query. andashi makes each of those choices on purpose, writes it into a file, and keeps the reason next to it. The rest of this page is those choices.
The zones are not set up by hand and then described — they are described and then set up. Six files hold the phone: what a zone is, which apps live in it, what they may reach, how it looks. Every deterministic setting is a key in one of them.
config/profiles.jsonconfig/apps.jsonconfig/settings.jsonconfig/theming.jsonconfig/features.jsonconfig/launcher/*.json{
"key": "anon",
"label": "Anon",
"browser": "org.torproject.torbrowser",
"runtime": "stopped",
"vpn": "orbot",
"vpn_pkg": "org.torproject.android",
"vpn_lockdown": true,
"vpn_note": "Mandatory: without it, traffic leaves past Tor.",
"play": "none",
"unlock": "password only, no fingerprint"
}A zone in profiles.json, shortened. The lockdown flag is not a preference — for Anon it is the difference between Tor and a leak. The browser line is the other half: it decides which app a link opens in.
{
"schemaVersion": 2,
"appearance": {
"glass": { "blur": 24, "tint": 0.12, "searchWallpaperBlur": true },
"wallpaper": { "image": "home.jpg", "target": "both" }
},
"home": {
"searchBar": { "position": "bottom" },
"favorites": [
{ "packageName": "com.android.dialer" },
{ "packageName": "app.vanadium.browser" }
]
},
"search": {
"barPosition": "top",
"contacts": true,
"actions": [ { "type": "call" }, { "type": "message" }, … ]
}
}An excerpt of Home's home screen, generated from the same sources and pushed per Android user: the glass, the wallpaper, the two favourites, where the search bar sits, and which chips a search may offer.
# push the config into the launcher of Android user N
adb shell content write --user N \
--uri content://org.andashi.home.config-ingest/launcher.json < launcher.json
# ask it to reload
adb shell am broadcast --user N -a org.andashi.home.action.RELOAD_CONFIG \
-n org.andashi.home/de.mm20.launcher2.config.service.ReloadConfigReceiver
# read back what it loaded, and what it made of it
adb shell content query --user N --uri content://org.andashi.home.state/diagnostics
adb shell content query --user N --uri content://org.andashi.home.state/configHow it reaches the phone. Per Android user, without root.
Re-running is the normal case, not the emergency: every step checks before it writes, and pushing an unchanged file changes nothing. A zone can be changed long after it was created — its apps, permissions, settings, VPN, theme and home screen are all re-applied in place. You may still move things around on the phone itself: the next run notices and refuses to overwrite an arrangement it has not seen.
Think of a house where the guests, the delivery people and the family each get their own door. The question when installing an app is never “do I want this app?” but “which zone is this app allowed to do damage in?”. Android allows exactly one VPN per profile, so the assignment is enforced by the phone itself rather than by discipline.
Your own life: messages, photos, passwords, the house. Nothing from Google in it, ever.
The actual life: messaging, secrets, the self-hosted services, maps without Google. No Play services — a hard rule, not a preference.
The apps that insist on Google, like maps, video and the car key, kept in a room of their own.
Where Google may live: maps, video, Play allowed, and the DNS filter watching. Plus the hosted password manager, reachable from anywhere. No path to the self-hosted side — this zone's one VPN slot is the filter.
The vendor apps for the printer, the treadmill, the smart plug. Started when needed, filtered hard.
Vendor apps for a fitness machine or a 3D printer. Not hardened despite them — hardened because of them.
Tools for running servers. Switched off and locked until you need them.
Admin tooling: a cloud console, an SSH client, a second tailnet. Stopped means the keys are evicted — encrypted at rest, not merely in the background.
An empty room for trying an app you do not trust yet, and for clearing out afterwards.
Deliberately empty, no VPN, started when needed. What breaks here reaches nothing else.
Everything through Tor. Switched off when unused, opened by password only.
Everything through Tor. Lockdown is mandatory: without it, traffic leaves past Tor silently.
The network terms come from how careful people split a home network: a trusted LAN for their own devices, a DMZ for what faces the internet, a separate VLAN for gadgets that should not see the rest. andashi applies the same split to one phone.
Work is not a zone of its own: it is a managed profile inside Home, with its own VPN and lockdown, and its apps show badged in Home's launcher. It is the one place where someone else holds authority — an employer's agent may enforce policy there, and it sees that zone, not the phone.
Files cross a zone border one at a time and by hand: you share a photo or a link out of Home into another zone through Inter Profile Sharing. That is the only bridge, it is measured end to end, and it is honest about what it does — it opens a border that is otherwise closed. The self-hosted services stay in Home, behind a private network that does not exist from the outside.
Two things hold across all of them. Eleven of Home's apps have no internet permission at all: the cameras, the keyboard, the launcher, the two-factor authenticator and two AI chat apps that run on the phone itself do not need one, so they do not get one. An AI that cannot phone home is not a promise, it is a missing permission. And the launcher, the keyboard and the icon pack are identical in every zone — also without internet — so switching zones changes what you may reach, never how the phone works.
Each zone's home screen is its own wallpaper and a search bar where your thumb is. The picture tells you which zone you are in before you touch anything; so does the colour of the quick settings, the icons and the keyboard. Home is the colourless one, because colour means you are not home.
Tap the bar and it glides to the top of the screen. The wallpaper blurs behind a list you can read: your favourites, then every app in the zone, with a Work tab in Home. Type three letters and the best match sits right under the bar.
The bar starts at the bottom because that is where the thumb reaches, and moves up because in search the keyboard owns the bottom. That order was chosen from screen recordings of three variants, not on paper.
Type a phone number and search offers Call, Message and Add to contact. An address or a time brings Email, Alarm, Timer, Calendar or Website. Those are the only chips there are, and they appear only when the query looks like one of those things.
Kvaesitso, the launcher andashi's home screen is forked from, puts Web search, YouTube and Google under every query, in every zone. andashi's launcher no longer seeds YouTube and Google, and on a phone set up by andashi none of the three appears: provisioning writes the list of chips explicitly. The launcher has no internet permission in any zone, so what you type into it stays on the phone. Contact search exists only in Home, the one zone that holds contacts; the other zones do not nag for a permission they should not have.
Anon is the zone where everything goes through Tor, the network that hides where you are. Until recently that was only half true. The traffic went through Tor, but a link tapped in a message opened in Vanadium, the phone's everyday browser — because Vanadium comes with the system, every zone gets it, and nobody had said otherwise. Tor hid the address; the browser gave websites everything else.
Now Anon names its browser. Links there open in Tor Browser, the setup reads back where a plain link actually lands, and it refuses to name a browser the zone does not contain. Its search drops Website, Message and Contact, and it has no Play services and no contacts to find. Nothing here is new software. It is a decision that had not been made, made on purpose.
On a Pixel Fold the favourites move into a column on the right edge, where the right thumb rests, on the outer screen and on the inner one alike. Open the phone and the inner home screen appears in one step, dock already in its place. The hard cut in the recording is Android switching displays; the only processing restores the outer screen's proportions, which the recorder had stretched.
On the big screen search splits into two panes that never cross the hinge: apps sit in the half the outer screen also shows, shortcuts and results in the other.
All of this was recorded on emulators, on a laptop. Without recording, the launcher there draws a frame in 16 ms at the median while search opens and you type; the recorder itself costs frames, so the videos look a little less smooth than the launcher is. Those are numbers for comparing launcher versions with each other, not a claim about a real Fold. Recordings from real hardware come when the hardware does.
Configuring Android as code usually means root, a privileged system app, or an accessibility service that can read the screen. Each of them is a master key, and all three open a hole in exactly the place GrapheneOS closes. So none of them is used.
A cable and Android's own developer commands, per Android user. No root, no Magisk, no system app, no accessibility service, nothing left running on the device that could be talked into anything later.
The launcher takes its configuration through a content provider into its own files directory. It holds no system powers and needs no permissions to be configured — the config can only reach the launcher, never the platform.
Provisioning does not trust an exit code. It writes, triggers a reload, reads the effective state and the diagnostics of that reload back off the device, and fails when they disagree with the file. The same goes for Anon's browser: it checks where a plain link actually lands.
Every app is pinned to its signing certificate, and a pin is only worth as much as its witness. Most are confirmed by a second distributor, not only by whoever served the download. The ones that are not, among them the launcher, which only andashi signs, are named in the repository rather than averaged away.
Two apps are built here: the launcher and the updater that keeps every
other app current. Android lets an app be replaced only by a build
carrying the same signer, so these two fingerprints are the roots of
trust. The same values are pinned in provisioning's
apks/certs/, from where the laptop pushes them into every
zone, and the updater's is in that repository's README; this page is
the place meant for a person to compare against.
org.andashi.home — the launchere42da3c2cf9e682d67b96f3655b2adf1bb22488a064b6ff833520b3c43f2a5eeorg.andashi.updater — the updater0d0334f0a1237ed0b449d0d408e6be3ad113c9542fbaf9912dff31cf0362e1d3
SHA-256 of the signing certificate, as apksigner verify --print-certs prints it.
The updater's releases are built twice on independent runners and signed
only when both builds agree; the signing job refuses to publish under
any other key.
A hardening project that only lists advantages is not credible. These are the limits, and they are not going to be buried in a FAQ.
This is not an installer yet. Today it asks for a computer and for being at ease in a terminal. If that is not you, it is fine to watch for now.
A supported Pixel with GrapheneOS already installed and set up. That install is the step that unlocks the bootloader and clears the device.
Anything with adb and jq. No agent runs on the phone for the setup; keeping the apps current afterwards is the updater's job, one of the apps it installs.
241 seconds for all six zones, set up and verified, measured on 24 September on the Fold emulator from a clean snapshot, with the apps coming from copies on the computer. On a real phone it will differ. Running it again is the normal case, not the emergency.
No newsletter, no Discord. Watching the repositories is the way to follow this.