Enjoying this issue?
Get tomorrow's AI & engineering digest in your inbox — hand-picked, summarized, and always spam-free.
TLDR
Android's open source code is being released later than the Pixel builds, with developer APIs and security patches shipping to Google's phones first. This is a shift from the historical pattern where all Android code was published simultaneously. The practical effect is that non-Pixel Android builds now face a multi-month delay in receiving new features and security fixes, which breaks the assumption that Android is uniformly open across all devices.
Key points
Google moved all Android development into private branches in March 2025, ending public visibility of day-to-day work.
Starting with Android 16, two of three quarterly feature drops (QPR1 and QPR3) became Pixel exclusives.
Android 17 QPR1 on September 15, 2026 added new developer APIs (android.hardware.hid) only to Pixel phones.
Security patches for shared Android code shipped to Pixels first, skipping the normal monthly bulletin for other devices.
GrapheneOS reported it took over two weeks to get build sources after requesting them on September 1st.
Tools mentioned
Techniques
- backporting
Stop scrolling. Start reading smarter.
Receive the day's most important AI & engineering updates in one concise email. No spam.
Transcript (captions)
This is the page where Android's source code lives. If you've ever flashed a custom ROM, you started right here. You can download it, read every line, and build your own version of the operating
system. Here's the newest release, and here's the piece that isn't there. Everything Google shipped to Pixel phones on September 15th. New developer features went out with no source code
attached. Graphene OS says Android hasn't done that since 2011. So, that's the question. Android is open source. Where's the code? Short answer first, because you deserve front. The code
isn't gone. It's late. By the end, you'll know exactly what shipped, what got held back, and whether Android is closing or just making everyone wait. If you run Graphene OS or any phone that
isn't a Pixel, that missing code just became your problem, not Google's. To see why a few months of delay hurts this much, let's follow how Android's code normally gets from Google onto your
phone. It starts with AOSP, which just means the public code base every version of Android is built from. Think of it as the master recipe. Google writes it, publishes it, and anyone can cook their
own version from it. Google writes Android in-house, then publishes the finished source there at each release, and that publishing step is what the word open is actually resting on. Phone
makers and small volunteer teams take that recipe, add the drivers their hardware needs, and ship a build. The version you're holding started life as this exact code. So, that's how the code
is supposed to travel. Now, watch where it stops. What changed wasn't one dramatic announcement. It came as a series of smaller steps, each easy to shrug off on its own. The first step
landed in March of last year. Google moved all Android development behind closed doors into private branches that people outside the company can no longer watch as the work happens. The reason it
gave was speed. Engineers kept fighting merge conflicts between the internal code and the public tree. So, Google folded everything into the private branch. It promised the source would
still ship at each release. For app developers, nothing broke that day, and that line matters. This was about how the platform gets built, not what you can install or write. But, outside
contributors lost their day-to-day view into how Android gets made. The public tree also started running behind, because when the work is private, you only see the code once Google pushes a
release, sometimes months after it's finished. The second step was the calendar. Android ships one major version a year, plus smaller feature drops every quarter, which insiders call
QPRs. Starting with Android 16, two of those drops, QPR1 and QPR3, stopped landing in the public codebase at all, and became Pixel exclusives. The yearly release and the middle drop still ship
as open source, so this was never Android slamming shut. It was the open slice getting thinner. One release at a time. Two moves so far, development went private, and the quarterly drops split
into a Pixel lane and an everybody else lane. That's the backdrop for the release that finally broke the pattern. September 15th, 2026, Android 17, QPR1. This one didn't just carry Pixel
wallpapers and camera tricks. It added brand new developer APIs, a fresh package called android.hardware.hid, plus changes across 16 other parts of
the system. Here's what a developer API really is. It's like a power outlet the system installs in the wall. Once it's there, every app maker assumes they can plug
in. Google added new outlets, then shipped them to one brand of phone. So, an app you install can now target a feature that runs on Google's phones and nowhere else for months. That cracks the
rule that made the platform work. You write an app once, and it behaves the same on every Android device. That android.hardware.hid package is a plain example. HID means
human interface devices, the plumbing behind game controllers and keyboards. Ordinary support, and now Pixel first. GrapheneOS put the sharp point on it. Adding developer APIs with no source
release hadn't happened since honeycomb Android's tablet release back in 2011. Google held honeycomb source then because it was built for tablets and Andy Rubin said he didn't want it
running badly on phones. A few months later the code opened up anyway. So the one earlier time Android added APIs without source, Google reversed course and the open version won.
This month is the first repeat in 15 years. New features are one thing. Security patches are where the delay actually cuts. Google's September update for Pixel also carried fixes to standard
Android code. The shared parts your phone runs no matter who made it. According to GrapheneOS, those fixes skipped the normal monthly security bulletin that other Android makers rely
on. It's like a recall that reaches one dealership first while the rest of the lot hears next quarter. The rest of the ecosystem waits for the next open drop QPR2 in December. That's a 3-month head
start on security handed to a single brand of phone. GrapheneOS says it asked Google for the build sources on September 1st. Access came more than 2 weeks later and even now the team can't
publish the working port it finished before the release shipped. Instead of shipping that port, they're backporting the changes which means hand carrying the newer Pixel firmware and
drivers into the older Android 17 base. That's real engineering time spent closing a gap Google chose to open and this isn't one project's headache. LineageOS, CalyxOS, and the smaller
brands that ship their own Android all build downstream of that same public source. When it's late, they're late together. There's also a wall most people never see. These forks can't
rebuild everything from source anyway because phones need proprietary drivers from chip makers like Qualcomm locked behind licensing. So a source delay lands on top of a hardware problem that
was already brutal. That combination pushed a routine policy note to over 1,100 points on Hacker News with hundreds of comments. Most of that thread circled one uncomfortable read.
Google won the phone market a long time ago, and a company that already won doesn't need openness as a selling point. So, it's spinning that openness down. Now, the fair part, and it
matters, so I won't soften it. Android is not turning into closed source. December's drop will reach the public code base. The yearly release still ships open, and if you build apps on
standard APIs today, you're not blocked. The code behind all of this will very likely be public within a few months, and on that record, Google has mostly delivered. But, eventually open is a
different promise than open. Line up the steps, and the direction is hard to miss. An exception in 2011 that got reversed, then private development, then
Pixel-only drops, now developer APIs behind the gate. Each step, the delay covers a little more ground. So, here's where I land. Android isn't being closed, it's being rationed. Google
didn't lock the door, it built a waiting room and put its own phone at the front of the line. Watch what a company ships, not what it says. Last year, Google promised it was committed to open
source. This year, it shipped developer APIs to one phone and told the rest of Android to wait until December. If you own a Pixel, none of this hurts you today. But, for the people building
every other version of Android, the whole reason open source mattered here, that delay is the entire bill. So, the code isn't missing, it's sitting in December's release. The only real
question left is whether open in December is what any of us meant by open source. If teardowns like this are your thing, subscribe. One a week.