AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
mobilecritical PriorityID: android-15-fgs-runtime-sandbox-budgeting

Android 15 Foreground Service Runtime Sandbox & Task Budget Partitioning

Android 15 (API 35) introduces strict 6-hour runtime execution caps for dataSync and mediaProcessing foreground services alongside stringent hardware acceleration and memory quota sandboxes. Violations immediately trigger Process Exit Info (REASON_ANR / STATUS_KILLED) via OS watchdog signals. Background architectures must enforce strict task budget partitioning, state checkpointing, and automatic fallback to WorkManager Expedited Jobs before quota exhaustion.

Prohibited Anti-Pattern: Unbounded Long-Running Foreground Services Without Type Partitioning or Sandboxed Time Budgets

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Android 15 Foreground Service Runtime Sandbox & Task Budget Partitioning - Android 15 (API 35) introduces strict 6-hour runtime execution caps for dataSync and mediaProcessing foreground services alongside stringent hardware acceleration and memory quota sandboxes. Violations immediately trigger Process Exit Info (REASON_ANR / STATUS_KILLED) via OS watchdog signals. Background architectures must enforce strict task budget partitioning, state checkpointing, and automatic fallback to WorkManager Expedited Jobs before quota exhaustion.
globs: app/src/main/AndroidManifest.xml, **/*Service.kt, **/*Worker.kt, **/di/*Module.kt
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/android-15-fgs-runtime-sandbox-budgeting"
---

# Android 15 Foreground Service Runtime Sandbox & Task Budget Partitioning

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Unbounded Long-Running Foreground Services Without Type Partitioning or Sandboxed Time Budgets

## System Constraints
You are a Principal Mobile Architect enforcing Android 15 Foreground Service Runtime Sandbox contracts. Android 15 terminates services exceeding execution time budgets (notably the 6-hour cumulative timeout for dataSync and mediaProcessing) and enforces hardware acceleration quotas while running in the background. You must ensure all foreground services declare explicit foregroundServiceType tags, register timeout callbacks via Service.onTimeout, implement discrete checkpointing, and offload sustained processing to WorkManager with Expedited Job constraints.

## Strict Guidelines
- Services MUST declare specific, granular `foregroundServiceType` attributes in AndroidManifest.xml; generic or missing types will be rejected by Android 15 at runtime via SecurityException.
- Engineers MUST implement `Service.onTimeout(int, int)` in API 35+ targets to cleanly checkpoint pipeline state and invoke `stopSelf()` within the OS grace period (several seconds) before SIGKILL termination.
- Engineers MUST NOT run unbounded background sync, processing loops, or heavy ML/hardware-accelerated tasks under `dataSync` or `mediaProcessing` types beyond their allotted 24-hour rolling execution budget.
- Background architectures MUST implement WorkManager Expedited Jobs (`OutOfQuotaPolicy.FALLBACK_TO_EXPEDITED_JOB_OR_REGULAR_JOB`) for tasks exceeding predictable execution windows.
- Components NEVER hold WakeLocks or retain hardware-accelerated buffers (e.g., OpenGL/Vulkan contexts, active camera sessions) once background transitions occur without dedicated active FGS lifecycle guarantees.

## Bad vs Good Implementations
### Android 15 Foreground Service Lifecycle with Timeout Checkpointing vs Unbounded FGS

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Fails to declare foregroundServiceType in startForeground, omits the Android 15 Service.onTimeout callback, uses START_STICKY for long-running synchronization, and provides no state checkpointing before the 6-hour hard budget cutoff triggers a hard process kill.
```kotlin
class BadDataSyncService : Service() {
    private val scope = CoroutineScope(Dispatchers.IO + SupervisorJob())

    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
        val notification = NotificationCompat.Builder(this, "CHANNEL_ID")
            .setContentTitle("Syncing unbounded data")
            .build()
        
        // Missing foregroundServiceType bitmask; Android 15 default crashes or limits severely
        startForeground(1001, notification)
        
        scope.launch {
            // Unbounded sync: Crashes with REASON_ANR or OS termination once 6-hour limit hits
            while (isActive) {
                syncLargeDatasetChunk()
            }
        }
        return START_STICKY
    }

    override fun onBind(intent: Intent?): IBinder? = null
}
```

#### Production Standard (Correct)
> **Standard**: Complies with Android 15 sandboxing: declares FOREGROUND_SERVICE_TYPE_DATA_SYNC, implements onTimeout for state persistence before quota exhaustion, stops gracefully, and offloads subsequent processing to WorkManager.
```kotlin
class RobustDataSyncService : Service() {
    private val scope = CoroutineScope(Dispatchers.IO + SupervisorJob())
    private var lastCheckpointId: Long = 0L

    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
        val notification = NotificationCompat.Builder(this, "DATA_SYNC_CHANNEL")
            .setContentTitle("Partitioned Data Sync")
            .setSmallIcon(R.drawable.ic_sync)
            .build()

        // Explicit Android 14+ / Android 15 foreground service type flag
        ServiceCompat.startForeground(
            this,
            NOTIFICATION_ID,
            notification,
            ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC
        )

        scope.launch {
            runPartitionedSync()
        }
        return START_NOT_STICKY
    }

    // Android 15 (API 35) mandatory timeout hook to prevent SIGKILL/ANR
    override fun onTimeout(startId: Int, fgsType: Int) {
        super.onTimeout(startId, fgsType)
        scope.launch {
            saveSyncCheckpoint(lastCheckpointId)
            scheduleWorkManagerContinuation(lastCheckpointId)
            stopSelf(startId)
        }
    }

    private suspend fun runPartitionedSync() {
        while (scope.isActive) {
            lastCheckpointId = processNextChunk(lastCheckpointId)
            if (isComplete(lastCheckpointId)) break
        }
        stopSelf()
    }

    override fun onBind(intent: Intent?): IBinder? = null

    companion object {
        private const val NOTIFICATION_ID = 4001
    }
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Android Build & Manifest Analyzer
Lints AndroidManifest.xml and Gradle build configs to ensure compliant foreground service types and SDK 35 targets.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

ADB FGS Budget Inspector
Runs adb shell cmd activity dump-fgs-quota to inspect real-time rolling execution budgets and trigger simulated timeout signals on connected devices.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Android 15 Foreground Service Runtime Sandbox & Task Budget Partitioning

Android 15 Foreground Service Runtime Sandbox & Task Budget Partitioning defines an industrial-grade behavioral standard for mobile engineering. Android 15 (API 35) introduces strict 6-hour runtime execution caps for dataSync and mediaProcessing foreground services alongside stringent hardware acceleration and memory quota sandboxes. Violations immediately trigger Process Exit Info (REASON_ANR / STATUS_KILLED) via OS watchdog signals. Background architectures must enforce strict task budget partitioning, state checkpointing, and automatic fallback to WorkManager Expedited Jobs before quota exhaustion. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unbounded Long-Running Foreground Services Without Type Partitioning or Sandboxed Time Budgets Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftUnbounded Long-Running Foreground Services Without Type Partitioning or Sandboxed Time BudgetsCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Services MUST declare specific, granular `foregroundServiceType` attributes in AndroidManifest.xml

Services MUST declare specific, granular `foregroundServiceType` attributes in AndroidManifest.xml; generic or missing types will be rejected by Android 15 at runtime via SecurityException.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST implement `Service.onTimeout(int, int)` in API 35+ targets to cleanly checkpoint pipeline state and invoke `stopSelf()` within the OS grace period (several seconds) before SIGKILL termination.

Engineers MUST implement `Service.onTimeout(int, int)` in API 35+ targets to cleanly checkpoint pipeline state and invoke `stopSelf()` within the OS grace period (several seconds) before SIGKILL termination.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST NOT run unbounded background sync, processing loops, or heavy ML/hardware-accelerated tasks under `dataSync` or `mediaProcessing` types beyond their allotted 24-hour rolling execution budget.

Engineers MUST NOT run unbounded background sync, processing loops, or heavy ML/hardware-accelerated tasks under `dataSync` or `mediaProcessing` types beyond their allotted 24-hour rolling execution budget.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Background architectures MUST implement WorkManager Expedited Jobs (`OutOfQuotaPolicy.FALLBACK_TO_EXPEDITED_JOB_OR_REGULAR_JOB`) for tasks exceeding predictable execution windows.

Background architectures MUST implement WorkManager Expedited Jobs (`OutOfQuotaPolicy.FALLBACK_TO_EXPEDITED_JOB_OR_REGULAR_JOB`) for tasks exceeding predictable execution windows.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Components NEVER hold WakeLocks or retain hardware-accelerated buffers (e.g., OpenGL/Vulkan contexts, active camera sessions) once background transitions occur without dedicated active FGS lifecycle guarantees.

Components NEVER hold WakeLocks or retain hardware-accelerated buffers (e.g., OpenGL/Vulkan contexts, active camera sessions) once background transitions occur without dedicated active FGS lifecycle guarantees.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Android 15 Foreground Service Runtime Sandbox & Task Budget Partitioning critical for AI coding assistants?

Android 15 (API 35) introduces strict 6-hour runtime execution caps for dataSync and mediaProcessing foreground services alongside stringent hardware acceleration and memory quota sandboxes. Violations immediately trigger Process Exit Info (REASON_ANR / STATUS_KILLED) via OS watchdog signals. Background architectures must enforce strict task budget partitioning, state checkpointing, and automatic fallback to WorkManager Expedited Jobs before quota exhaustion. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Unbounded Long-Running Foreground Services Without Type Partitioning or Sandboxed Time Budgets) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →
mobile
106

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

mobile
70

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

mobile
58

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Android