OnePlus 8T Mobile Lab System Map

The phone is not a bag of unrelated tools. It is one recoverable, composable, and verifiable mobile experiment runtime.

System map of the OnePlus 8T mobile lab, covering platform engineering, real-device automation, authorized security, and AI

View or download the original 1536×1024 artwork.

The current artwork uses Chinese labels. This page carries the complete architecture in English so the information remains searchable and accessible without reading text embedded in the image.

How to read the map

Hub: oneplus-8t-mobile-lab holds the field guide, capability map, integration labs, and reviewed public evidence.
Shared runtime: LineageOS, Magisk, Termux, and Kali PRoot run on the same OnePlus 8T, but they do not have the same privileges.
Four capability families: platform and recovery engineering, real-device automation, authorized security work, and AI agents with model routing can run independently or as one bounded experiment.
Evidence loop: every combination follows observe → hypothesize → run the smallest experiment → collect evidence → review. Starting a tool is not itself a conclusion.

Repository boundaries

Repository	Owns	Does not own
`oneplus-8t-mobile-lab`	Hub, teaching material, device baseline, integration labs, and public evidence	Private configuration, credentials, firmware, or large backups
`pocket-pentest`	Methods for authorized mobile security, CTF, networking, and hardware labs	Unapproved targets or instructions that bypass scope controls
`android-device-test`	ADB/UI automation, stability, performance, and reproducible device evidence	Treating one screenshot as complete acceptance evidence
`android-ai-stack`	OpenCode, Claude Code, Happy, model routing, on-device inference, plus the Mobile Lab Control Skills, Android source, and release APK	Publishing real tokens, endpoint URLs, local provider profiles, or signing keys
`xiaohei-phone-agent`	User-facing assistant product: invocation, short voice sessions, risk policy, notification drafts, and observable Android actions	Advertising CPU KWS as DSP, background message sending, or requiring ordinary users to install root/pentest environments
`happy-relay-deploy`	Optional remote relay, TLS, and Tailnet deployment	A mandatory dependency for the phone-local workflow

Six useful compositions

Composition	What it enables	Boundary to preserve
AI + testing	Draft cases, drive a real device, localize failures, and structure reports	Model suggestions never replace assertions and device evidence
AI + security	Plan authorized labs, invoke tools, interpret output, and write postmortems	A person confirms scope, targets, and stop conditions
Assistant + AI runtime	Xiaohei uses deterministic commands first and selects a model profile only for bounded complex tasks	The model suggests a plan; Xiaohei still owns local policy, confirmation, and final action
Local + cloud	Use a small model for offline triage, then route difficult work to a cloud model	Keep model selection separate from service lifecycle; never publish credentials
Phone + remote	Stay self-contained on the phone, then connect a workstation or relay only when needed	Default to loopback; remote exposure needs explicit authentication and encryption
Labs + Wiki	Compile real cases into guides, failure records, and cross-linked knowledge	Separate facts, inferences, and unverified hypotheses

Mobile Lab Control separates the phone control surface into three independent widgets: Happy service, llama.cpp service, and model profiles. Each widget shows its own current state; service buttons manage lifecycle, while model buttons only change configuration. The app has no Internet permission, does not read tokens, endpoints, or the CC Switch database, and can invoke only fixed allow-listed actions through its Termux bridge. Browse the Android source and build guide or download a release-signed APK from GitHub Releases.

xiaohei-phone-agent is the product action layer above this runtime. Manual, Android Assistant, foreground CPU KWS, and validated device DSP entries converge on one short-command contract before local policy selects an Intent, notification, or visible Accessibility action. It can consume adapter-exposed model profiles without starting services on profile change; neither pocket-pentest nor a remote relay is an ordinary-user prerequisite.

Capability is not residency

This is a system architecture map, not evidence that every service is active at once. A hardened resting state keeps unused Happy, llama.cpp, Frida, and debug endpoints stopped. The tiny local model is a low-cost offline fallback, not a claim that the phone can efficiently host desktop-class models. Security work remains limited to owned systems, training targets, or explicitly authorized scope.

Continue with the device baseline, AI toolchain integration lab, or project map.