Well then you install apps.

You are just reinventing LineageOS here basically, patching the defects of AOSP to make it work on real phones

I am really not sure what you are trying to say. GrapheneOS is AOSP + stuff. LineageOS is AOSP + stuff. Certified Google Android is AOSP + stuff.

What comes from AOSP goes into GrapheneOS, LineageOS and Certified Google Android. So obviously it makes sense to compare them.

It doesn't because AOSP itself is unusable on a modern phone.

It's just a low level technical building block nowadays and everybody is chosing the parts they want.

Comparing your OS to AOSP itself made sense in 2016, it doesn't anymore in 2026.

It make sense to compare the OS between each other, what you can actually install and use on the phone.

Do we agree that the Android security model is baked into AOSP? Or would you say that the Play Services bring the security model to Google-certified Android, GrapheneOS implements its own security model from scratch, and LineageOS as well?

Assuming they share a big part of the security model, how would it "not make sense" to compare them? If AOSP is the baseline, saying that /e/OS is often weakening the security model and GrapheneOS is hardening it is a way to compare them. That makes complete sense to me.

> Or would you say that the Play Services bring the security model to Google-certified Android, GrapheneOS implements its own security model from scratch, and LineageOS as well?

Yes I would say that most of the security decisions are not baked into AOSP and every rom brings their own decisions.

That's really a weird position, since the SELinux-based app sandbox is in AOSP.