S1 — real Android app; captured 2026-10-28 UTC
Head APK; root A absent. Public Tailscale leaf/full chain and matching DNS hostname. Proxy system-ca listener logs the successful HTTPS and WSS. A saved private route is visible but cannot pass TLS without root A; active route is the public system-ca listener. Synthetic localhost driver renames project to System trust; app reads the new title.

Redaction: no query strings, headers, tokens, pairing codes or message payloads. TLS errors are observed at the server after the client aborts trust validation. Method/path/status retained; WS generations are proxy-local identifiers. Canary RPC responses contain synthetic data only.

{"time": "2026-10-28T00:44:23.295Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0A4B232057F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:25.353Z", "type": "TLS_ACCEPT", "label": "system-ca", "protocol": "TLSv1.3", "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:25.383Z", "type": "HTTP", "label": "system-ca", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:25.757Z", "type": "HTTP", "label": "system-ca", "method": "POST", "path": "/oauth/token", "status": 200, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:26.702Z", "type": "HTTP", "label": "system-ca", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:27.226Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0A4B232057F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:27.359Z", "type": "HTTP", "label": "system-ca", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:27.878Z", "type": "HTTP", "label": "system-ca", "method": "POST", "path": "/api/auth/websocket-ticket/rpc", "status": 200, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:27.977Z", "type": "HTTP", "label": "system-ca", "method": "GET", "path": "/.well-known/t3/environment", "status": 200, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:28.158Z", "type": "HTTP", "label": "system-ca", "method": "GET", "path": "/api/auth/session", "status": 200, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:28.176Z", "type": "TLS_ACCEPT", "label": "system-ca", "protocol": "TLSv1.3", "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:28.203Z", "type": "WS_UPGRADE", "label": "system-ca", "path": "/ws", "status": 101, "generation": 1, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:28.241Z", "type": "HTTP", "label": "system-ca", "method": "GET", "path": "/api/auth/session", "status": 200, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:28.837Z", "type": "HTTP", "label": "system-ca", "method": "GET", "path": "/api/orchestration/shell", "status": 200, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:28.844Z", "type": "TLS_ACCEPT", "label": "system-ca", "protocol": "TLSv1.3", "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:28.900Z", "type": "HTTP", "label": "system-ca", "method": "GET", "path": "/api/auth/session", "status": 200, "source": "TLS-proxy"}
{"time": "2026-10-28T00:44:46.654Z", "operation": "rename", "result": {"_tag": "Exit", "requestId": "fa5cf49c-3150-492a-b5d5-5d8bea83127f", "exit": {"_tag": "Success", "value": {"id": "android-ca-proof", "title": "Android CA proof — System trust", "workspaceRoot": "/tmp/lead-25730-r1/evidence/synthetic-project", "repositoryIdentity": null, "faviconPath": null, "projectIcon": null, "defaultModelSelection": null, "defaultThreadEnvMode": null, "autoPull": false, "scripts": [], "createdAt": "2026-10-28T00:26:23.590Z", "updatedAt": "2026-10-28T00:44:46.642Z", "deletedAt": null}}}, "source": "authenticated-localhost-seed-driver"}
{"time": "2026-10-28T00:45:29.298Z", "type": "TLS_REJECT", "label": "private-ca", "code": "ERR_SSL_SSL/TLS_ALERT_CERTIFICATE_UNKNOWN", "message": "C0A4B232057F0000:error:0A000416:SSL routines:ssl3_read_bytes:ssl/tls alert certificate unknown:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:918:SSL alert number 46 ", "source": "TLS-proxy"}