# Текущий статус MVP

## Проверено локально

- Flet web shell starts; Linux desktop bundle builds.
- ARM64 Android APK builds with current Flet/Gradle toolchain.
- `sing-box-lx v1.14.1-lx.8` is fetched with upstream checksum verification and
  packaged as `libbox.so`; the ARM64 APK contains the real native engine.
- Android SignBox starts in-process through `CommandServer`, opens its TUN through
  `PlatformInterface`, and creates SOCKS5/HTTP listeners through sing-box inbounds.
- VPN, proxy-only, and local Both share the same configuration path; proxy-only does
  not call `VpnService` or create a TUN.
- FastAPI backend, one-file admin UI, encrypted-at-rest secrets, device enrollment,
  User-Agent binding and subscription response pass tests and a local HTTP smoke test.
- Python lifecycle, conflict rules, serialization, billing date, proxy settings,
  enrollment URL and port-selection tests pass.

## Deliberately unavailable / device acceptance pending

- A physical-device run with production VLESS and AmneziaWG profiles is still required;
  a successful compile does not prove remote connectivity.
- Proxy-only LocalOnlyHotspot starts listeners on the discovered address. `Both +
  hotspot` is explicitly rejected until one-core startup is coordinated across hotspot
  discovery and `VpnService`.
- `DIRECT` is applied with package exclusion. `VOID` rejects startup as unsupported;
  the fail-closed UID-aware packet classifier is not implemented.
- FreeTurn's reviewed AAR cannot coexist with libbox yet because both ship incompatible
  global gomobile runtime classes. The libbox-first APK excludes FreeTurn rather than
  risking JNI crashes.
- Backend sync is a reusable client contract with injected secret storage; wiring
  it to Android Keystore, an enrollment screen and automatic profile refresh remains.

These are functional blockers, not cosmetic polish. A successful APK build is only a
build/integration milestone; it is not evidence that the missing data path works.

## Device acceptance still required

Use `docs/android-manual-tests.md` on a physical Android API 26+ device. In particular test VPN
consent, screen lock/UI death, service conflict, backend crash, hotspot permissions,
actual interface address, laptop SOCKS/HTTP traffic and the aggressive VPN-detection
VOID case.