Sovereign phone in thirty minutes.
Step 1 · Pick the hardware.
Three lanes, three trade-offs. Google's Pixel line is the mainstream sweet spot — GrapheneOS was written for it, verified boot works end to end. PinePhone Pro is the fully sovereign option with real hardware kill switches. /e/OS ships pre-installed if you want no flashing at all.
Pixel 8a / 8 / 9
Pixel 6a / 7a (used)
PinePhone Pro
Murena / Fairphone (/e/OS)
Step 2 · Flash GrapheneOS.
The GrapheneOS web installer runs in any Chromium browser (Chrome, Edge, Brave). No root, no Android tools, no command line. It uses WebUSB to talk to your Pixel over cable. About 15 minutes end-to-end.
· A USB-C cable that actually carries data (charging-only cables will fail silently)
· A charged Pixel with all setup skipped — do not sign into a Google account
· A desktop Chromium browser on Windows / macOS / Linux
The five things you will do
- Enable Developer Options on the Pixel (tap "Build number" seven times in About)
- Enable OEM Unlocking and USB Debugging
- Boot into bootloader (hold Volume-Down while powering on)
- Click Unlock bootloader → Download release → Flash release → Lock bootloader in the installer
- Verify the boot screen shows "yellow" state then re-locks to a clean verified boot
· "No device" — try a different cable first, not a different port.
· "Bootloader unlock failed" — carrier-locked Pixels (US networks especially) cannot be unlocked. Buy unlocked or SIM-free UK stock.
Step 3 · Carry your identity across.
Your FallID keypair lives in this desktop browser's IndexedDB. To keep the same DID across devices, we encrypt it with a passphrase you type once, wrap it in a QR, and let the phone scan it. The keypair never touches a server.
On the phone
- Open Vanadium (GrapheneOS's browser) and visit sjgant80-hub.github.io/fallid
- Tap Import from QR → allow camera → point at this screen
- Enter the same passphrase → your DID imports
- Confirm the DID string matches this desktop's DID before continuing
Step 4 · Install the estate.
Every AI-Native Solutions tool ships as a Progressive Web App — one tap to add to home screen, works offline after first load, no app-store review board deciding what you may run. This list comes live from the FallHarbor manifest.
Step 5 · Verify the posture.
Six checks. Tap each one after you've done it on the phone. The final ceremony — you're not "trusting" the setup, you're witnessing it.
Location off by default
Settings → Location → toggle off. Apps that need it can ask per-session.
Cellular modem sandboxed
GrapheneOS runs the baseband firmware inside its own sandbox with no filesystem access. Confirm you're on a stock GrapheneOS build (Settings → About).
Google Play (if any) is sandboxed
If you installed sandboxed Play Services for banking apps, it runs as a regular app with no special privileges. If you skipped Play entirely, tick this anyway.
Vanadium is the default browser
Hardened Chromium. Settings → Apps → Default apps → Browser → Vanadium.
FallShell installed as PWA
Your estate portal lives on the home screen. Opens offline. First launch after install to prime the cache.
FallID DID matches desktop
Open FallID on the phone → copy DID → compare to desktop's DID. Identical string means the QR transfer worked.