Managed Android signed release · 0.18.6

Set up a factory-reset test phone.

This QR asks Android to download one exact, release-signed ChildPhone APK, verify its checksum, and make ChildPhone the visible Device Owner. It does not contain a family pairing key or turn on monitoring.

On the spare phone

Enroll in six visible steps

  1. Confirm it is a spare Android 10+ phone.Charge it, remove personal accounts, and save anything you need elsewhere.
  2. Factory reset the phone.Return to the first Android welcome screen. Do not add a Google account first.
  3. Open Android's QR enrollment scanner.On most supported phones, tap the same blank area of the welcome screen six times, then connect to Wi-Fi.
  4. Scan the ChildPhone QR.Android downloads the signed release APK and verifies the pinned package checksum before installation.
  5. Review the ChildPhone setup screen.Finish only after reading that pairing can send an encrypted bounded launcher-app list while GPS, communication inspection, and permissions remain separate choices.
  6. Open ChildPhone and check setup readiness.The report must say Enrollment core: PASS. Pair the parent dashboard only if you are testing encrypted delivery.
Open parent dashboardRun guided field test

No-phone check

Verify the download before you reset again.

Run this read-only check on a computer to confirm that the QR payload, HTTPS APK, checksum, Device Owner receiver, and signed Managed release agree before touching the spare phone.

Download the 11-check enrollment preflight
Run from any computersh childphone-managed-0.18.6-enrollment-preflight-v2.shPASS means the endpoint is ready. It does not require USB debugging or change the phone.

If QR setup shows an error

Stop and reset the enrollment state.

Device Owner enrollment is allowed only from Android's unprovisioned welcome flow. If this phone has already reached its home screen, had a work profile, or has a previous device administrator, the QR scanner may stop with a generic error. Do not continue testing on that phone as-is.

  1. Factory reset the spare phone again.Use the manufacturer's full erase option, not a settings reset that preserves a work profile or device-management state.
  2. Return to the first welcome screen.Do not add a Google account, restore a backup, install an APK, or finish setup before scanning.
  3. Connect to stable Wi-Fi, then scan again.The setup flow must download the checksum-pinned APK before it can finish.
  4. If it still fails, stop the test.Record the phone model, Android/ColorOS version, and the exact visible error. Do not sideload or enroll an everyday phone.

Android's provisioning requirements are described in the Android Open Source Project documentation. Before retrying, you can also run the read-only enrollment-endpoint preflight from a computer.

Device Owner enables app controls

It lets ChildPhone block selected apps or allow only approved apps during active windows while protecting Android system and emergency components.

Sensor permissions stay local

Enrollment opts out of silent sensor permission grants. Location and Notification Access still require visible, separate action on the phone.

No parent secrets in this QR

The QR contains only the admin component, public APK URL, checksum, and a setting that leaves Android system apps enabled.

APK SHA-256c5a401262d2de5ca467e77f2c0b3e0e451d9bb13f1e8bbb9854aade97f215332
Android package checksumxaQBJi0t5cpGfnfywLPg5FHZuxPx6Lu5hUqt6X8hUzI
Release signing certificate SHA-256111129763a0d29cbc2e9110babe2ef231a0beba9293c5f002e3b626afa0f911a
CycloneDX SBOM SHA-25612e0decf33d29ced7d2b487c09767c6236655b62b7814b80765ad861d5cbb7ef
Download the same Managed APK directlyDownload the release SBOM

Signed enrollment is ready for a physical-phone test.

The signed APK, QR payload, and Android provisioning activities pass automated checks. A current Android 16 stable-release smoke also passed the exact 0.18.6 APK and certificate, Device Owner, child-visible launcher, process restart, reboot persistence, and a bounded no-crash/ANR check. The earlier deep feature rehearsal used a development build, so app rules, pairing, GPS, communication inspection, revocation, and cleanup must still be repeated on this signed release. Hardware setup screens vary by manufacturer, so the exact QR flow still needs confirmation on a factory-reset spare phone before any family pilot.

Open the guided field-test and recovery checklist