diff --git a/core/Makefile b/core/Makefile
index 399b07a..e9340f7 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -3288,8 +3288,8 @@
 
 endif # BUILDING_SYSTEM_IMAGE
 
-.PHONY: sync syncsys
-sync syncsys: $(INTERNAL_SYSTEMIMAGE_FILES)
+.PHONY: sync syncsys sync_system
+sync syncsys sync_system: $(INTERNAL_SYSTEMIMAGE_FILES)
 
 # -----------------------------------------------------------------
 # Old PDK fusion targets
@@ -3617,7 +3617,8 @@
 vendorimage-nodeps vnod: | $(INTERNAL_USERIMAGES_DEPS)
 	$(build-vendorimage-target)
 
-sync: $(INTERNAL_VENDORIMAGE_FILES)
+.PHONY: sync_vendor
+sync sync_vendor: $(INTERNAL_VENDORIMAGE_FILES)
 
 else ifdef BOARD_PREBUILT_VENDORIMAGE
 INSTALLED_VENDORIMAGE_TARGET := $(PRODUCT_OUT)/vendor.img
@@ -3681,7 +3682,8 @@
 productimage-nodeps pnod: | $(INTERNAL_USERIMAGES_DEPS)
 	$(build-productimage-target)
 
-sync: $(INTERNAL_PRODUCTIMAGE_FILES)
+.PHONY: sync_product
+sync sync_product: $(INTERNAL_PRODUCTIMAGE_FILES)
 
 else ifdef BOARD_PREBUILT_PRODUCTIMAGE
 INSTALLED_PRODUCTIMAGE_TARGET := $(PRODUCT_OUT)/product.img
@@ -3743,7 +3745,8 @@
 systemextimage-nodeps senod: | $(INTERNAL_USERIMAGES_DEPS)
 	$(build-system_extimage-target)
 
-sync: $(INTERNAL_SYSTEM_EXTIMAGE_FILES)
+.PHONY: sync_system_ext
+sync sync_system_ext: $(INTERNAL_SYSTEM_EXTIMAGE_FILES)
 
 else ifdef BOARD_PREBUILT_SYSTEM_EXTIMAGE
 INSTALLED_SYSTEM_EXTIMAGE_TARGET := $(PRODUCT_OUT)/system_ext.img
@@ -3824,7 +3827,8 @@
 odmimage-nodeps onod: | $(INTERNAL_USERIMAGES_DEPS)
 	$(build-odmimage-target)
 
-sync: $(INTERNAL_ODMIMAGE_FILES)
+.PHONY: sync_odm
+sync sync_odm: $(INTERNAL_ODMIMAGE_FILES)
 
 else ifdef BOARD_PREBUILT_ODMIMAGE
 INSTALLED_ODMIMAGE_TARGET := $(PRODUCT_OUT)/odm.img
@@ -3885,7 +3889,8 @@
 vendor_dlkmimage-nodeps vdnod: | $(INTERNAL_USERIMAGES_DEPS)
 	$(build-vendor_dlkmimage-target)
 
-sync: $(INTERNAL_VENDOR_DLKMIMAGE_FILES)
+.PHONY: sync_vendor_dlkm
+sync sync_vendor_dlkm: $(INTERNAL_VENDOR_DLKMIMAGE_FILES)
 
 else ifdef BOARD_PREBUILT_VENDOR_DLKMIMAGE
 INSTALLED_VENDOR_DLKMIMAGE_TARGET := $(PRODUCT_OUT)/vendor_dlkm.img
@@ -3946,7 +3951,8 @@
 odm_dlkmimage-nodeps odnod: | $(INTERNAL_USERIMAGES_DEPS)
 	$(build-odm_dlkmimage-target)
 
-sync: $(INTERNAL_ODM_DLKMIMAGE_FILES)
+.PHONY: sync_odm_dlkm
+sync sync_odm_dlkm: $(INTERNAL_ODM_DLKMIMAGE_FILES)
 
 else ifdef BOARD_PREBUILT_ODM_DLKMIMAGE
 INSTALLED_ODM_DLKMIMAGE_TARGET := $(PRODUCT_OUT)/odm_dlkm.img
@@ -4009,7 +4015,8 @@
 system_dlkmimage-nodeps sdnod: | $(INTERNAL_USERIMAGES_DEPS)
 	$(build-system_dlkmimage-target)
 
-sync: $(INTERNAL_SYSTEM_DLKMIMAGE_FILES)
+.PHONY: sync_system_dlkm
+sync sync_system_dlkm: $(INTERNAL_SYSTEM_DLKMIMAGE_FILES)
 
 else ifdef BOARD_PREBUILT_SYSTEM_DLKMIMAGE
 INSTALLED_SYSTEM_DLKMIMAGE_TARGET := $(PRODUCT_OUT)/system_dlkm.img
@@ -5273,7 +5280,7 @@
 
 # -----------------------------------------------------------------
 #  fastboot-info.txt
-FASTBOOT_INFO_VERSION = 1.0
+FASTBOOT_INFO_VERSION = 1
 
 INSTALLED_FASTBOOT_INFO_TARGET := $(PRODUCT_OUT)/fastboot-info.txt
 
@@ -5308,13 +5315,13 @@
 	$(hide) echo "flash vendor_boot" >> $@
 endif
 ifneq (,$(strip $(BOARD_AVB_VBMETA_CUSTOM_PARTITIONS)))
-	$(hide) $(foreach partition,$(BOARD_AVB_VBMETA_CUSTOM_PARTITIONS),\
-	  $(hide) echo "flash --apply-vbmeta vbmeta_$(partition)" >> $@;)
+	$(hide) $(foreach partition,$(BOARD_AVB_VBMETA_CUSTOM_PARTITIONS), \
+	  echo "flash --apply-vbmeta vbmeta_$(partition)" >> $@;)
 endif
 endif # BOARD_AVB_ENABLE
 	$(hide) echo "reboot fastboot" >> $@
 	$(hide) echo "update-super" >> $@
-	$(foreach partition,$(BOARD_SUPER_PARTITION_PARTITION_LIST), \
+	$(hide) $(foreach partition,$(BOARD_SUPER_PARTITION_PARTITION_LIST), \
 	  echo "flash $(partition)" >> $@;)
 ifdef BUILDING_SYSTEM_OTHER_IMAGE
 	$(hide) echo "flash --slot-other system system_other.img" >> $@
@@ -5763,6 +5770,8 @@
     echo "virtual_ab_compression_method=$(PRODUCT_VIRTUAL_AB_COMPRESSION_METHOD)" >> $(1))
   $(if $(filter true,$(PRODUCT_VIRTUAL_AB_OTA_RETROFIT)), \
     echo "virtual_ab_retrofit=true" >> $(1))
+  $(if $(PRODUCT_VIRTUAL_AB_COW_VERSION), \
+    echo "virtual_ab_cow_version=$(PRODUCT_VIRTUAL_AB_COW_VERSION)" >> $(1))
 endef
 
 # By conditionally including the dependency of the target files package on the
diff --git a/core/board_config.mk b/core/board_config.mk
index fae7aaa..7969b25 100644
--- a/core/board_config.mk
+++ b/core/board_config.mk
@@ -256,7 +256,7 @@
   endif
 
   $(shell build/soong/scripts/update_out $(OUT_DIR)/rbc/rbc_board_config_results.mk \
-    $(OUT_DIR)/rbcrun RBC_OUT="make" $(OUT_DIR)/rbc/boardlauncher.rbc)
+    $(OUT_DIR)/rbcrun $(OUT_DIR)/rbc/boardlauncher.rbc)
   ifneq ($(.SHELLSTATUS),0)
     $(error board configuration runner failed: $(.SHELLSTATUS))
   endif
diff --git a/core/product.mk b/core/product.mk
index e90e27b..818aac2 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -404,6 +404,10 @@
 #   supports it
 _product_single_value_vars += PRODUCT_ENABLE_UFFD_GC
 
+# Specifies COW version to be used by update_engine and libsnapshot. If this value is not
+# specified we default to COW version 2 in update_engine for backwards compatibility
+_product_single_value_vars += PRODUCT_VIRTUAL_AB_COW_VERSION
+
 _product_list_vars += PRODUCT_AFDO_PROFILES
 
 .KATI_READONLY := _product_single_value_vars _product_list_vars
diff --git a/core/product_config.mk b/core/product_config.mk
index 9db881f..6a27613 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -223,7 +223,7 @@
 endif
 
 ifeq (,$(current_product_makefile))
-  $(error Can not locate config makefile for product "$(TARGET_PRODUCT)")
+  $(error Cannot locate config makefile for product "$(TARGET_PRODUCT)")
 endif
 
 ifneq (,$(filter $(TARGET_PRODUCT),$(products_using_starlark_config)))
@@ -236,14 +236,22 @@
   $(shell mkdir -p $(OUT_DIR)/rbc)
   $(call dump-variables-rbc, $(OUT_DIR)/rbc/make_vars_pre_product_config.mk)
 
-  $(shell build/soong/scripts/update_out \
-    $(OUT_DIR)/rbc/rbc_product_config_results.mk \
-    build/soong/scripts/rbc-run \
-    $(current_product_makefile) \
-    $(OUT_DIR)/rbc/make_vars_pre_product_config.mk)
+  $(shell $(OUT_DIR)/mk2rbc \
+    --mode=write -r --outdir $(OUT_DIR)/rbc \
+    --launcher=$(OUT_DIR)/rbc/launcher.rbc \
+    --input_variables=$(OUT_DIR)/rbc/make_vars_pre_product_config.mk \
+    --makefile_list=$(OUT_DIR)/.module_paths/configuration.list \
+    $(current_product_makefile))
   ifneq ($(.SHELLSTATUS),0)
     $(error product configuration converter failed: $(.SHELLSTATUS))
   endif
+
+  $(shell build/soong/scripts/update_out $(OUT_DIR)/rbc/rbc_product_config_results.mk \
+    $(OUT_DIR)/rbcrun $(OUT_DIR)/rbc/launcher.rbc)
+  ifneq ($(.SHELLSTATUS),0)
+    $(error product configuration runner failed: $(.SHELLSTATUS))
+  endif
+
   include $(OUT_DIR)/rbc/rbc_product_config_results.mk
 endif
 
diff --git a/core/product_config.rbc b/core/product_config.rbc
index a5e5721..e594894 100644
--- a/core/product_config.rbc
+++ b/core/product_config.rbc
@@ -54,25 +54,16 @@
     if value == None:
         return
     if type(value) == "list":
-        if _options.rearrange:
-            value = __printvars_rearrange_list(value)
-        if _options.format == "pretty":
-            print(attr, "=", repr(value))
-        elif _options.format == "make":
-            value = list(value)
-            for i, x in enumerate(value):
-                if type(x) == "tuple" and len(x) == 1:
-                    value[i] = "@inherit:" + x[0] + ".mk"
-                elif type(x) != "string":
-                    fail("Wasn't a list of strings:", attr, " value:", value)
-            print(attr, ":=", " ".join(value))
-    elif _options.format == "pretty":
-        print(attr, "=", repr(value))
-    elif _options.format == "make":
+        value = list(value)
+        for i, x in enumerate(value):
+            if type(x) == "tuple" and len(x) == 1:
+                value[i] = "@inherit:" + x[0] + ".mk"
+            elif type(x) != "string":
+                fail("Wasn't a list of strings:", attr, " value:", value)
+        print(attr, ":=", " ".join(value))
+    else:
         # Trim all spacing to a single space
         print(attr, ":=", _mkstrip(value))
-    else:
-        fail("bad output format", _options.format)
 
 def _printvars(state):
     """Prints configuration and global variables."""
@@ -83,8 +74,7 @@
             for nsname, nsvars in sorted(val.items()):
                 # Define SOONG_CONFIG_<ns> for Make, othewise
                 # it cannot be added to .KATI_READONLY list
-                if _options.format == "make":
-                    print("SOONG_CONFIG_" + nsname, ":=", " ".join(nsvars.keys()))
+                print("SOONG_CONFIG_" + nsname, ":=", " ".join(nsvars.keys()))
                 for var, val in sorted(nsvars.items()):
                     if val:
                         __print_attr("SOONG_CONFIG_%s_%s" % (nsname, var), val)
@@ -105,11 +95,6 @@
         elif attr not in globals_base or globals_base[attr] != val:
             __print_attr(attr, val)
 
-def __printvars_rearrange_list(value_list):
-    """Rearrange value list: return only distinct elements, maybe sorted."""
-    seen = {item: 0 for item in value_list}
-    return sorted(seen.keys()) if _options.rearrange == "sort" else seen.keys()
-
 def __sort_pcm_names(pcm_names):
     # We have to add an extension back onto the pcm names when sorting,
     # or else the sort order could be wrong when one is a prefix of another.
@@ -695,16 +680,8 @@
     rblf_log(file, "warning", message, sep = ':')
 
 def _mk2rbc_error(loc, message):
-    """Prints a message about conversion error and stops.
-
-    If RBC_MK2RBC_CONTINUE environment variable is set,
-    the execution will continue after the message is printed.
-    """
-    if _options.mk2rbc_continue:
-        rblf_log(loc, message, sep = ':')
-    else:
-        _mkerror(loc, message)
-
+    """Prints a message about conversion error and stops."""
+    _mkerror(loc, message)
 
 def _mkinfo(file, message = ""):
     """Prints info."""
@@ -877,39 +854,12 @@
             # Cause the variable to appear set like the make version does
             g[v] = ""
 
-
-def __get_options():
-    """Returns struct containing runtime global settings."""
-    settings = dict(
-        format = "pretty",
-        rearrange = "",
-        trace_modules = False,
-        trace_variables = [],
-        mk2rbc_continue = False,
-    )
-    for x in getattr(rblf_cli, "RBC_OUT", "").split(","):
-        if x == "sort" or x == "unique":
-            if settings["rearrange"]:
-                fail("RBC_OUT: either sort or unique is allowed (and sort implies unique)")
-            settings["rearrange"] = x
-        elif x == "pretty" or x == "make":
-            settings["format"] = x
-        elif x == "global":
-            # TODO: Remove this, kept for backwards compatibility
-            pass
-        elif x != "":
-            fail("RBC_OUT: got %s, should be one of: [pretty|make] [sort|unique]" % x)
-    for x in getattr(rblf_cli, "RBC_DEBUG", "").split(","):
-        if x == "!trace":
-            settings["trace_modules"] = True
-        elif x != "":
-            settings["trace_variables"].append(x)
-    if getattr(rblf_cli, "RBC_MK2RBC_CONTINUE", ""):
-        settings["mk2rbc_continue"] = True
-    return struct(**settings)
-
 # Settings used during debugging.
-_options = __get_options()
+_options = struct(
+    trace_modules = False,
+    trace_variables = [],
+)
+
 rblf = struct(
     soong_config_namespace = _soong_config_namespace,
     soong_config_append = _soong_config_append,
diff --git a/core/soong_config.mk b/core/soong_config.mk
index 90a2f75..034d044 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -315,6 +315,10 @@
 
 $(call add_json_list, AfdoProfiles,                $(ALL_AFDO_PROFILES))
 
+$(call add_json_str,  ProductManufacturer, $(PRODUCT_MANUFACTURER))
+$(call add_json_str,  ProductBrand,        $(PRODUCT_BRAND))
+$(call add_json_list, BuildVersionTags,    $(BUILD_VERSION_TAGS))
+
 $(call json_end)
 
 $(file >$(SOONG_VARIABLES).tmp,$(json_contents))
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 9e9e74b..f9175e45 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -104,7 +104,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-    PLATFORM_SECURITY_PATCH := 2023-04-05
+    PLATFORM_SECURITY_PATCH := 2023-05-05
 endif
 
 include $(BUILD_SYSTEM)/version_util.mk
diff --git a/envsetup.sh b/envsetup.sh
index 17d8a5d..916344c 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -804,13 +804,19 @@
 
     export TARGET_BUILD_APPS=
 
-    local product variant_and_version variant version
+    # Support either <product>-<variant> or <product>-<release>-<variant>
+    local product release_and_variant release variant
     product=${selection%%-*} # Trim everything after first dash
-    variant_and_version=${selection#*-} # Trim everything up to first dash
-    if [ "$variant_and_version" != "$selection" ]; then
-        variant=${variant_and_version%%-*}
-        if [ "$variant" != "$variant_and_version" ]; then
-            version=${variant_and_version#*-}
+    release_and_variant=${selection#*-} # Trim everything up to first dash
+    if [ "$release_and_variant" != "$selection" ]; then
+        local first=${release_and_variant%%-*} # Trim everything after first dash
+        if [ "$first" != "$release_and_variant" ]; then
+            # There is a 2nd dash, split into release-variant
+            release=$first # Everything up to the dash
+            variant=${release_and_variant#*-} # Trim everything up to dash
+        else
+            # There is not a 2nd dash, default to variant as the second param
+            variant=$first
         fi
     fi
 
@@ -823,7 +829,7 @@
 
     TARGET_PRODUCT=$product \
     TARGET_BUILD_VARIANT=$variant \
-    TARGET_PLATFORM_VERSION=$version \
+    TARGET_RELEASE=$release \
     build_build_var_cache
     if [ $? -ne 0 ]
     then
@@ -835,10 +841,10 @@
     fi
     export TARGET_PRODUCT=$(get_build_var TARGET_PRODUCT)
     export TARGET_BUILD_VARIANT=$(get_build_var TARGET_BUILD_VARIANT)
-    if [ -n "$version" ]; then
-      export TARGET_PLATFORM_VERSION=$(get_build_var TARGET_PLATFORM_VERSION)
+    if [ -n "$release" ]; then
+      export TARGET_RELEASE=$(get_build_var TARGET_RELEASE)
     else
-      unset TARGET_PLATFORM_VERSION
+      unset TARGET_RELEASE
     fi
     export TARGET_BUILD_TYPE=release
 
diff --git a/target/product/angle.mk b/target/product/angle_default.mk
similarity index 63%
copy from target/product/angle.mk
copy to target/product/angle_default.mk
index 0d7f8cb..bea0be6 100644
--- a/target/product/angle.mk
+++ b/target/product/angle_default.mk
@@ -14,13 +14,10 @@
 # limitations under the License.
 #
 
-# To include ANGLE drivers into the build, add
-# $(call inherit-product, $(SRC_TARGET_DIR)/product/angle.mk) to the Makefile.
+# To enable ANGLE as the default system GLES drivers, add
+# $(call inherit-product, $(SRC_TARGET_DIR)/product/angle_enabled.mk) to the Makefile.
 
-PRODUCT_PACKAGES := \
-    libEGL_angle \
-    libGLESv1_CM_angle \
-    libGLESv2_angle
+$(call inherit-product, $(SRC_TARGET_DIR)/product/angle_supported.mk)
 
-# Set ro.gfx.angle.supported based on if ANGLE is installed in vendor partition
-PRODUCT_VENDOR_PROPERTIES := ro.gfx.angle.supported=true
+PRODUCT_VENDOR_PROPERTIES += \
+    persist.graphics.egl=angle
diff --git a/target/product/angle.mk b/target/product/angle_supported.mk
similarity index 71%
rename from target/product/angle.mk
rename to target/product/angle_supported.mk
index 0d7f8cb..c83ff5f 100644
--- a/target/product/angle.mk
+++ b/target/product/angle_supported.mk
@@ -14,13 +14,14 @@
 # limitations under the License.
 #
 
-# To include ANGLE drivers into the build, add
-# $(call inherit-product, $(SRC_TARGET_DIR)/product/angle.mk) to the Makefile.
+# To include ANGLE into the image build, add
+# $(call inherit-product, $(SRC_TARGET_DIR)/product/angle_supported.mk) to the Makefile.
+# By default, this will allow ANGLE binaries to coexist with native GLES drivers.
 
-PRODUCT_PACKAGES := \
+PRODUCT_PACKAGES += \
     libEGL_angle \
     libGLESv1_CM_angle \
     libGLESv2_angle
 
 # Set ro.gfx.angle.supported based on if ANGLE is installed in vendor partition
-PRODUCT_VENDOR_PROPERTIES := ro.gfx.angle.supported=true
+PRODUCT_VENDOR_PROPERTIES += ro.gfx.angle.supported=true
diff --git a/target/product/virtual_ab_ota/android_t_baseline.mk b/target/product/virtual_ab_ota/android_t_baseline.mk
index 418aaa4..f862485 100644
--- a/target/product/virtual_ab_ota/android_t_baseline.mk
+++ b/target/product/virtual_ab_ota/android_t_baseline.mk
@@ -20,3 +20,5 @@
 #
 # All U+ launching devices should instead use vabc_features.mk.
 $(call inherit-product, $(SRC_TARGET_DIR)/product/virtual_ab_ota/vabc_features.mk)
+
+PRODUCT_VIRTUAL_AB_COW_VERSION := 2
diff --git a/tools/aconfig/.gitignore b/tools/aconfig/.gitignore
new file mode 100644
index 0000000..1b72444
--- /dev/null
+++ b/tools/aconfig/.gitignore
@@ -0,0 +1,2 @@
+/Cargo.lock
+/target
diff --git a/tools/aconfig/Android.bp b/tools/aconfig/Android.bp
new file mode 100644
index 0000000..e762f33
--- /dev/null
+++ b/tools/aconfig/Android.bp
@@ -0,0 +1,37 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+rust_protobuf_host {
+    name: "libaconfig_protos",
+    protos: ["protos/aconfig.proto"],
+    crate_name: "aconfig_protos",
+    source_stem: "aconfig_protos",
+    use_protobuf3: true,
+}
+
+rust_defaults {
+    name: "aconfig.defaults",
+    edition: "2021",
+    clippy_lints: "android",
+    lints: "android",
+    srcs: ["src/main.rs"],
+    rustlibs: [
+        "libaconfig_protos",
+        "libanyhow",
+        "libclap",
+        "libprotobuf",
+        "libserde",
+        "libserde_json",
+    ],
+}
+
+rust_binary_host {
+    name: "aconfig",
+    defaults: ["aconfig.defaults"],
+}
+
+rust_test_host {
+    name: "aconfig.test",
+    defaults: ["aconfig.defaults"],
+}
diff --git a/tools/aconfig/Cargo.toml b/tools/aconfig/Cargo.toml
new file mode 100644
index 0000000..b439858
--- /dev/null
+++ b/tools/aconfig/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "aconfig"
+version = "0.1.0"
+edition = "2021"
+build = "build.rs"
+
+[features]
+default = ["cargo"]
+cargo = []
+
+[dependencies]
+anyhow = "1.0.69"
+clap = { version = "4.1.8", features = ["derive"] }
+protobuf = "3.2.0"
+serde = { version = "1.0.152", features = ["derive"] }
+serde_json = "1.0.93"
+
+[build-dependencies]
+protobuf-codegen = "3.2.0"
diff --git a/tools/aconfig/MODULE_LICENSE_APACHE2 b/tools/aconfig/MODULE_LICENSE_APACHE2
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tools/aconfig/MODULE_LICENSE_APACHE2
diff --git a/tools/aconfig/OWNERS b/tools/aconfig/OWNERS
new file mode 100644
index 0000000..4e05b00
--- /dev/null
+++ b/tools/aconfig/OWNERS
@@ -0,0 +1,5 @@
+amhk@google.com
+jham@google.com
+joeo@google.com
+opg@google.com
+zhidou@google.com
diff --git a/tools/aconfig/PREUPLOAD.cfg b/tools/aconfig/PREUPLOAD.cfg
new file mode 100644
index 0000000..75ed57c
--- /dev/null
+++ b/tools/aconfig/PREUPLOAD.cfg
@@ -0,0 +1,5 @@
+[Builtin Hooks]
+rustfmt = true
+
+[Builtin Hooks Options]
+rustfmt = --config-path=rustfmt.toml
diff --git a/tools/aconfig/build.rs b/tools/aconfig/build.rs
new file mode 100644
index 0000000..5ef5b60
--- /dev/null
+++ b/tools/aconfig/build.rs
@@ -0,0 +1,17 @@
+use protobuf_codegen::Codegen;
+
+fn main() {
+    let proto_files = vec!["protos/aconfig.proto"];
+
+    // tell cargo to only re-run the build script if any of the proto files has changed
+    for path in &proto_files {
+        println!("cargo:rerun-if-changed={}", path);
+    }
+
+    Codegen::new()
+        .pure()
+        .include("protos")
+        .inputs(proto_files)
+        .cargo_out_dir("aconfig_proto")
+        .run_from_script();
+}
diff --git a/tools/aconfig/protos/aconfig.proto b/tools/aconfig/protos/aconfig.proto
new file mode 100644
index 0000000..6eac414
--- /dev/null
+++ b/tools/aconfig/protos/aconfig.proto
@@ -0,0 +1,57 @@
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License
+
+// This is the schema definition for of Aconfig files. Modifications need to be
+// either backwards compatible, or include updates to all Aconfig files in the
+// Android tree.
+
+syntax = "proto2";
+
+package android.aconfig;
+
+enum flag_state {
+  ENABLED = 1;
+  DISABLED = 2;
+}
+
+enum permission {
+  READ_ONLY = 1;
+  READ_WRITE = 2;
+}
+
+message value {
+  required flag_state state = 1;
+  required permission permission = 2;
+  optional uint32 since = 3;
+}
+
+message flag {
+  required string id = 1;
+  required string description = 2;
+  repeated value value = 3;
+};
+
+message android_config {
+  repeated flag flag = 1;
+};
+
+message override {
+  required string id = 1;
+  required flag_state state = 2;
+  required permission permission = 3;
+};
+
+message override_config {
+  repeated override override = 1;
+};
diff --git a/tools/aconfig/rustfmt.toml b/tools/aconfig/rustfmt.toml
new file mode 120000
index 0000000..291e99b
--- /dev/null
+++ b/tools/aconfig/rustfmt.toml
@@ -0,0 +1 @@
+../../../soong/scripts/rustfmt.toml
\ No newline at end of file
diff --git a/tools/aconfig/src/aconfig.rs b/tools/aconfig/src/aconfig.rs
new file mode 100644
index 0000000..f10ca1f
--- /dev/null
+++ b/tools/aconfig/src/aconfig.rs
@@ -0,0 +1,352 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use anyhow::{anyhow, Context, Error, Result};
+use protobuf::{Enum, EnumOrUnknown};
+use serde::{Deserialize, Serialize};
+
+use crate::protos::{
+    ProtoAndroidConfig, ProtoFlag, ProtoFlagState, ProtoOverride, ProtoOverrideConfig,
+    ProtoPermission, ProtoValue,
+};
+
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize, Clone, Copy)]
+pub enum FlagState {
+    Enabled,
+    Disabled,
+}
+
+impl TryFrom<EnumOrUnknown<ProtoFlagState>> for FlagState {
+    type Error = Error;
+
+    fn try_from(proto: EnumOrUnknown<ProtoFlagState>) -> Result<Self, Self::Error> {
+        match ProtoFlagState::from_i32(proto.value()) {
+            Some(ProtoFlagState::ENABLED) => Ok(FlagState::Enabled),
+            Some(ProtoFlagState::DISABLED) => Ok(FlagState::Disabled),
+            None => Err(anyhow!("unknown flag state enum value {}", proto.value())),
+        }
+    }
+}
+
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize, Clone, Copy)]
+pub enum Permission {
+    ReadOnly,
+    ReadWrite,
+}
+
+impl TryFrom<EnumOrUnknown<ProtoPermission>> for Permission {
+    type Error = Error;
+
+    fn try_from(proto: EnumOrUnknown<ProtoPermission>) -> Result<Self, Self::Error> {
+        match ProtoPermission::from_i32(proto.value()) {
+            Some(ProtoPermission::READ_ONLY) => Ok(Permission::ReadOnly),
+            Some(ProtoPermission::READ_WRITE) => Ok(Permission::ReadWrite),
+            None => Err(anyhow!("unknown permission enum value {}", proto.value())),
+        }
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Value {
+    state: FlagState,
+    permission: Permission,
+    since: Option<u32>,
+}
+
+#[allow(dead_code)] // only used in unit tests
+impl Value {
+    pub fn new(state: FlagState, permission: Permission, since: u32) -> Value {
+        Value { state, permission, since: Some(since) }
+    }
+
+    pub fn default(state: FlagState, permission: Permission) -> Value {
+        Value { state, permission, since: None }
+    }
+}
+
+impl TryFrom<ProtoValue> for Value {
+    type Error = Error;
+
+    fn try_from(proto: ProtoValue) -> Result<Self, Self::Error> {
+        let Some(proto_state) = proto.state else {
+            return Err(anyhow!("missing 'state' field"));
+        };
+        let state = proto_state.try_into()?;
+        let Some(proto_permission) = proto.permission else {
+            return Err(anyhow!("missing 'permission' field"));
+        };
+        let permission = proto_permission.try_into()?;
+        Ok(Value { state, permission, since: proto.since })
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Flag {
+    pub id: String,
+    pub description: String,
+
+    // ordered by Value.since; guaranteed to contain at least one item (the default value, with
+    // since == None)
+    pub values: Vec<Value>,
+}
+
+impl Flag {
+    #[allow(dead_code)] // only used in unit tests
+    pub fn try_from_text_proto(text_proto: &str) -> Result<Flag> {
+        let proto: ProtoFlag = crate::protos::try_from_text_proto(text_proto)
+            .with_context(|| text_proto.to_owned())?;
+        proto.try_into()
+    }
+
+    pub fn try_from_text_proto_list(text_proto: &str) -> Result<Vec<Flag>> {
+        let proto: ProtoAndroidConfig = crate::protos::try_from_text_proto(text_proto)
+            .with_context(|| text_proto.to_owned())?;
+        proto.flag.into_iter().map(|proto_flag| proto_flag.try_into()).collect()
+    }
+
+    pub fn resolve(&self, build_id: u32) -> (FlagState, Permission) {
+        let mut state = self.values[0].state;
+        let mut permission = self.values[0].permission;
+        for candidate in self.values.iter().skip(1) {
+            let since = candidate.since.expect("invariant: non-defaults values have Some(since)");
+            if since <= build_id {
+                state = candidate.state;
+                permission = candidate.permission;
+            }
+        }
+        (state, permission)
+    }
+}
+
+impl TryFrom<ProtoFlag> for Flag {
+    type Error = Error;
+
+    fn try_from(proto: ProtoFlag) -> Result<Self, Self::Error> {
+        let Some(id) = proto.id else {
+            return Err(anyhow!("missing 'id' field"));
+        };
+        let Some(description) = proto.description else {
+            return Err(anyhow!("missing 'description' field"));
+        };
+        if proto.value.is_empty() {
+            return Err(anyhow!("missing 'value' field"));
+        }
+
+        let mut values: Vec<Value> = vec![];
+        for proto_value in proto.value.into_iter() {
+            let v: Value = proto_value.try_into()?;
+            if values.iter().any(|w| v.since == w.since) {
+                let msg = match v.since {
+                    None => format!("flag {}: multiple default values", id),
+                    Some(x) => format!("flag {}: multiple values for since={}", id, x),
+                };
+                return Err(anyhow!(msg));
+            }
+            values.push(v);
+        }
+        values.sort_by_key(|v| v.since);
+
+        Ok(Flag { id, description, values })
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct Override {
+    pub id: String,
+    pub state: FlagState,
+    pub permission: Permission,
+}
+
+impl Override {
+    #[allow(dead_code)] // only used in unit tests
+    pub fn try_from_text_proto(text_proto: &str) -> Result<Override> {
+        let proto: ProtoOverride = crate::protos::try_from_text_proto(text_proto)?;
+        proto.try_into()
+    }
+
+    pub fn try_from_text_proto_list(text_proto: &str) -> Result<Vec<Override>> {
+        let proto: ProtoOverrideConfig = crate::protos::try_from_text_proto(text_proto)?;
+        proto.override_.into_iter().map(|proto_flag| proto_flag.try_into()).collect()
+    }
+}
+
+impl TryFrom<ProtoOverride> for Override {
+    type Error = Error;
+
+    fn try_from(proto: ProtoOverride) -> Result<Self, Self::Error> {
+        let Some(id) = proto.id else {
+            return Err(anyhow!("missing 'id' field"));
+        };
+        let Some(proto_state) = proto.state else {
+            return Err(anyhow!("missing 'state' field"));
+        };
+        let state = proto_state.try_into()?;
+        let Some(proto_permission) = proto.permission else {
+            return Err(anyhow!("missing 'permission' field"));
+        };
+        let permission = proto_permission.try_into()?;
+        Ok(Override { id, state, permission })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_flag_try_from_text_proto() {
+        let expected = Flag {
+            id: "1234".to_owned(),
+            description: "Description of the flag".to_owned(),
+            values: vec![
+                Value::default(FlagState::Disabled, Permission::ReadOnly),
+                Value::new(FlagState::Enabled, Permission::ReadWrite, 8),
+            ],
+        };
+
+        let s = r#"
+        id: "1234"
+        description: "Description of the flag"
+        value {
+            state: DISABLED
+            permission: READ_ONLY
+        }
+        value {
+            state: ENABLED
+            permission: READ_WRITE
+            since: 8
+        }
+        "#;
+        let actual = Flag::try_from_text_proto(s).unwrap();
+
+        assert_eq!(expected, actual);
+    }
+
+    #[test]
+    fn test_flag_try_from_text_proto_bad_input() {
+        let s = r#"
+        id: "a"
+        description: "Description of the flag"
+        "#;
+        let error = Flag::try_from_text_proto(s).unwrap_err();
+        assert_eq!(format!("{:?}", error), "missing 'value' field");
+
+        let s = r#"
+        description: "Description of the flag"
+        value {
+            state: ENABLED
+            permission: READ_ONLY
+        }
+        "#;
+        let error = Flag::try_from_text_proto(s).unwrap_err();
+        assert!(format!("{:?}", error).contains("Message not initialized"));
+
+        let s = r#"
+        id: "a"
+        description: "Description of the flag"
+        value {
+            state: ENABLED
+            permission: READ_ONLY
+        }
+        value {
+            state: ENABLED
+            permission: READ_ONLY
+        }
+        "#;
+        let error = Flag::try_from_text_proto(s).unwrap_err();
+        assert_eq!(format!("{:?}", error), "flag a: multiple default values");
+    }
+
+    #[test]
+    fn test_flag_try_from_text_proto_list() {
+        let expected = vec![
+            Flag {
+                id: "a".to_owned(),
+                description: "A".to_owned(),
+                values: vec![Value::default(FlagState::Enabled, Permission::ReadOnly)],
+            },
+            Flag {
+                id: "b".to_owned(),
+                description: "B".to_owned(),
+                values: vec![Value::default(FlagState::Disabled, Permission::ReadWrite)],
+            },
+        ];
+
+        let s = r#"
+        flag {
+            id: "a"
+            description: "A"
+            value {
+                state: ENABLED
+                permission: READ_ONLY
+            }
+        }
+        flag {
+            id: "b"
+            description: "B"
+            value {
+                state: DISABLED
+                permission: READ_WRITE
+            }
+        }
+        "#;
+        let actual = Flag::try_from_text_proto_list(s).unwrap();
+
+        assert_eq!(expected, actual);
+    }
+
+    #[test]
+    fn test_override_try_from_text_proto_list() {
+        let expected = Override {
+            id: "1234".to_owned(),
+            state: FlagState::Enabled,
+            permission: Permission::ReadOnly,
+        };
+
+        let s = r#"
+        id: "1234"
+        state: ENABLED
+        permission: READ_ONLY
+        "#;
+        let actual = Override::try_from_text_proto(s).unwrap();
+
+        assert_eq!(expected, actual);
+    }
+
+    #[test]
+    fn test_flag_resolve() {
+        let flag = Flag {
+            id: "a".to_owned(),
+            description: "A".to_owned(),
+            values: vec![
+                Value::default(FlagState::Disabled, Permission::ReadOnly),
+                Value::new(FlagState::Disabled, Permission::ReadWrite, 10),
+                Value::new(FlagState::Enabled, Permission::ReadOnly, 20),
+                Value::new(FlagState::Enabled, Permission::ReadWrite, 30),
+            ],
+        };
+        assert_eq!((FlagState::Disabled, Permission::ReadOnly), flag.resolve(0));
+        assert_eq!((FlagState::Disabled, Permission::ReadOnly), flag.resolve(9));
+        assert_eq!((FlagState::Disabled, Permission::ReadWrite), flag.resolve(10));
+        assert_eq!((FlagState::Disabled, Permission::ReadWrite), flag.resolve(11));
+        assert_eq!((FlagState::Disabled, Permission::ReadWrite), flag.resolve(19));
+        assert_eq!((FlagState::Enabled, Permission::ReadOnly), flag.resolve(20));
+        assert_eq!((FlagState::Enabled, Permission::ReadOnly), flag.resolve(21));
+        assert_eq!((FlagState::Enabled, Permission::ReadOnly), flag.resolve(29));
+        assert_eq!((FlagState::Enabled, Permission::ReadWrite), flag.resolve(30));
+        assert_eq!((FlagState::Enabled, Permission::ReadWrite), flag.resolve(10_000));
+    }
+}
diff --git a/tools/aconfig/src/cache.rs b/tools/aconfig/src/cache.rs
new file mode 100644
index 0000000..94443d7
--- /dev/null
+++ b/tools/aconfig/src/cache.rs
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use anyhow::{anyhow, Result};
+use serde::{Deserialize, Serialize};
+use std::io::{Read, Write};
+
+use crate::aconfig::{Flag, FlagState, Override, Permission};
+use crate::commands::Source;
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct TracePoint {
+    pub source: Source,
+    pub state: FlagState,
+    pub permission: Permission,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct Item {
+    pub id: String,
+    pub description: String,
+    pub state: FlagState,
+    pub permission: Permission,
+    pub trace: Vec<TracePoint>,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+pub struct Cache {
+    build_id: u32,
+    items: Vec<Item>,
+}
+
+impl Cache {
+    pub fn new(build_id: u32) -> Cache {
+        Cache { build_id, items: vec![] }
+    }
+
+    pub fn read_from_reader(reader: impl Read) -> Result<Cache> {
+        serde_json::from_reader(reader).map_err(|e| e.into())
+    }
+
+    pub fn write_to_writer(&self, writer: impl Write) -> Result<()> {
+        serde_json::to_writer(writer, self).map_err(|e| e.into())
+    }
+
+    pub fn add_flag(&mut self, source: Source, flag: Flag) -> Result<()> {
+        if self.items.iter().any(|item| item.id == flag.id) {
+            return Err(anyhow!(
+                "failed to add flag {} from {}: flag already defined",
+                flag.id,
+                source,
+            ));
+        }
+        let (state, permission) = flag.resolve(self.build_id);
+        self.items.push(Item {
+            id: flag.id.clone(),
+            description: flag.description,
+            state,
+            permission,
+            trace: vec![TracePoint { source, state, permission }],
+        });
+        Ok(())
+    }
+
+    pub fn add_override(&mut self, source: Source, override_: Override) -> Result<()> {
+        let Some(existing_item) = self.items.iter_mut().find(|item| item.id == override_.id) else {
+            return Err(anyhow!("failed to override flag {}: unknown flag", override_.id));
+        };
+        existing_item.state = override_.state;
+        existing_item.permission = override_.permission;
+        existing_item.trace.push(TracePoint {
+            source,
+            state: override_.state,
+            permission: override_.permission,
+        });
+        Ok(())
+    }
+
+    pub fn iter(&self) -> impl Iterator<Item = &Item> {
+        self.items.iter()
+    }
+}
+
+impl Item {}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::aconfig::{FlagState, Permission, Value};
+
+    #[test]
+    fn test_add_flag() {
+        let mut cache = Cache::new(1);
+        cache
+            .add_flag(
+                Source::File("first.txt".to_string()),
+                Flag {
+                    id: "foo".to_string(),
+                    description: "desc".to_string(),
+                    values: vec![Value::default(FlagState::Enabled, Permission::ReadOnly)],
+                },
+            )
+            .unwrap();
+        let error = cache
+            .add_flag(
+                Source::File("second.txt".to_string()),
+                Flag {
+                    id: "foo".to_string(),
+                    description: "desc".to_string(),
+                    values: vec![Value::default(FlagState::Disabled, Permission::ReadOnly)],
+                },
+            )
+            .unwrap_err();
+        assert_eq!(
+            &format!("{:?}", error),
+            "failed to add flag foo from second.txt: flag already defined"
+        );
+    }
+
+    #[test]
+    fn test_add_override() {
+        fn check(cache: &Cache, id: &str, expected: (FlagState, Permission)) -> bool {
+            let item = cache.iter().find(|&item| item.id == id).unwrap();
+            item.state == expected.0 && item.permission == expected.1
+        }
+
+        let mut cache = Cache::new(1);
+        let error = cache
+            .add_override(
+                Source::Memory,
+                Override {
+                    id: "foo".to_string(),
+                    state: FlagState::Enabled,
+                    permission: Permission::ReadOnly,
+                },
+            )
+            .unwrap_err();
+        assert_eq!(&format!("{:?}", error), "failed to override flag foo: unknown flag");
+
+        cache
+            .add_flag(
+                Source::File("first.txt".to_string()),
+                Flag {
+                    id: "foo".to_string(),
+                    description: "desc".to_string(),
+                    values: vec![Value::default(FlagState::Enabled, Permission::ReadOnly)],
+                },
+            )
+            .unwrap();
+        dbg!(&cache);
+        assert!(check(&cache, "foo", (FlagState::Enabled, Permission::ReadOnly)));
+
+        cache
+            .add_override(
+                Source::Memory,
+                Override {
+                    id: "foo".to_string(),
+                    state: FlagState::Disabled,
+                    permission: Permission::ReadWrite,
+                },
+            )
+            .unwrap();
+        dbg!(&cache);
+        assert!(check(&cache, "foo", (FlagState::Disabled, Permission::ReadWrite)));
+
+        cache
+            .add_override(
+                Source::Memory,
+                Override {
+                    id: "foo".to_string(),
+                    state: FlagState::Enabled,
+                    permission: Permission::ReadWrite,
+                },
+            )
+            .unwrap();
+        assert!(check(&cache, "foo", (FlagState::Enabled, Permission::ReadWrite)));
+    }
+}
diff --git a/tools/aconfig/src/commands.rs b/tools/aconfig/src/commands.rs
new file mode 100644
index 0000000..73d3357
--- /dev/null
+++ b/tools/aconfig/src/commands.rs
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use anyhow::{Context, Result};
+use clap::ValueEnum;
+use serde::{Deserialize, Serialize};
+use std::fmt;
+use std::io::Read;
+
+use crate::aconfig::{Flag, Override};
+use crate::cache::Cache;
+
+#[derive(Serialize, Deserialize, Clone, Debug)]
+pub enum Source {
+    #[allow(dead_code)] // only used in unit tests
+    Memory,
+    File(String),
+}
+
+impl fmt::Display for Source {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        match self {
+            Self::Memory => write!(f, "<memory>"),
+            Self::File(path) => write!(f, "{}", path),
+        }
+    }
+}
+
+pub struct Input {
+    pub source: Source,
+    pub reader: Box<dyn Read>,
+}
+
+pub fn create_cache(build_id: u32, aconfigs: Vec<Input>, overrides: Vec<Input>) -> Result<Cache> {
+    let mut cache = Cache::new(build_id);
+
+    for mut input in aconfigs {
+        let mut contents = String::new();
+        input.reader.read_to_string(&mut contents)?;
+        let flags = Flag::try_from_text_proto_list(&contents)
+            .with_context(|| format!("Failed to parse {}", input.source))?;
+        for flag in flags {
+            cache.add_flag(input.source.clone(), flag)?;
+        }
+    }
+
+    for mut input in overrides {
+        let mut contents = String::new();
+        input.reader.read_to_string(&mut contents)?;
+        let overrides = Override::try_from_text_proto_list(&contents)
+            .with_context(|| format!("Failed to parse {}", input.source))?;
+        for override_ in overrides {
+            cache.add_override(input.source.clone(), override_)?;
+        }
+    }
+
+    Ok(cache)
+}
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq, ValueEnum)]
+pub enum Format {
+    Text,
+    Debug,
+}
+
+pub fn dump_cache(cache: Cache, format: Format) -> Result<()> {
+    match format {
+        Format::Text => {
+            for item in cache.iter() {
+                println!("{}: {:?}", item.id, item.state);
+            }
+        }
+        Format::Debug => {
+            for item in cache.iter() {
+                println!("{:?}", item);
+            }
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::aconfig::{FlagState, Permission};
+
+    #[test]
+    fn test_create_cache() {
+        let s = r#"
+        flag {
+            id: "a"
+            description: "Description of a"
+            value {
+                state: ENABLED
+                permission: READ_WRITE
+            }
+        }
+        "#;
+        let aconfigs = vec![Input { source: Source::Memory, reader: Box::new(s.as_bytes()) }];
+        let o = r#"
+        override {
+            id: "a"
+            state: DISABLED
+            permission: READ_ONLY
+        }
+        "#;
+        let overrides = vec![Input { source: Source::Memory, reader: Box::new(o.as_bytes()) }];
+        let cache = create_cache(1, aconfigs, overrides).unwrap();
+        let item = cache.iter().find(|&item| item.id == "a").unwrap();
+        assert_eq!(FlagState::Disabled, item.state);
+        assert_eq!(Permission::ReadOnly, item.permission);
+    }
+}
diff --git a/tools/aconfig/src/main.rs b/tools/aconfig/src/main.rs
new file mode 100644
index 0000000..62750ae
--- /dev/null
+++ b/tools/aconfig/src/main.rs
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//! `aconfig` is a build time tool to manage build time configurations, such as feature flags.
+
+use anyhow::Result;
+use clap::{builder::ArgAction, builder::EnumValueParser, Arg, ArgMatches, Command};
+use std::fs;
+
+mod aconfig;
+mod cache;
+mod commands;
+mod protos;
+
+use crate::cache::Cache;
+use commands::{Input, Source};
+
+fn cli() -> Command {
+    Command::new("aconfig")
+        .subcommand_required(true)
+        .subcommand(
+            Command::new("create-cache")
+                .arg(
+                    Arg::new("build-id")
+                        .long("build-id")
+                        .value_parser(clap::value_parser!(u32))
+                        .required(true),
+                )
+                .arg(Arg::new("aconfig").long("aconfig").action(ArgAction::Append))
+                .arg(Arg::new("override").long("override").action(ArgAction::Append))
+                .arg(Arg::new("cache").long("cache").required(true)),
+        )
+        .subcommand(
+            Command::new("dump").arg(Arg::new("cache").long("cache").required(true)).arg(
+                Arg::new("format")
+                    .long("format")
+                    .value_parser(EnumValueParser::<commands::Format>::new())
+                    .default_value("text"),
+            ),
+        )
+}
+
+fn open_zero_or_more_files(matches: &ArgMatches, arg_name: &str) -> Result<Vec<Input>> {
+    let mut opened_files = vec![];
+    for path in matches.get_many::<String>(arg_name).unwrap_or_default() {
+        let file = Box::new(fs::File::open(path)?);
+        opened_files.push(Input { source: Source::File(path.to_string()), reader: file });
+    }
+    Ok(opened_files)
+}
+
+fn main() -> Result<()> {
+    let matches = cli().get_matches();
+    match matches.subcommand() {
+        Some(("create-cache", sub_matches)) => {
+            let build_id = *sub_matches.get_one::<u32>("build-id").unwrap();
+            let aconfigs = open_zero_or_more_files(sub_matches, "aconfig")?;
+            let overrides = open_zero_or_more_files(sub_matches, "override")?;
+            let cache = commands::create_cache(build_id, aconfigs, overrides)?;
+            let path = sub_matches.get_one::<String>("cache").unwrap();
+            let file = fs::File::create(path)?;
+            cache.write_to_writer(file)?;
+        }
+        Some(("dump", sub_matches)) => {
+            let path = sub_matches.get_one::<String>("cache").unwrap();
+            let file = fs::File::open(path)?;
+            let cache = Cache::read_from_reader(file)?;
+            let format = sub_matches.get_one("format").unwrap();
+            commands::dump_cache(cache, *format)?;
+        }
+        _ => unreachable!(),
+    }
+    Ok(())
+}
diff --git a/tools/aconfig/src/protos.rs b/tools/aconfig/src/protos.rs
new file mode 100644
index 0000000..604eca4
--- /dev/null
+++ b/tools/aconfig/src/protos.rs
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// When building with the Android tool-chain
+//
+//   - an external crate `aconfig_protos` will be generated
+//   - the feature "cargo" will be disabled
+//
+// When building with cargo
+//
+//   - a local sub-module will be generated in OUT_DIR and included in this file
+//   - the feature "cargo" will be enabled
+//
+// This module hides these differences from the rest of aconfig.
+
+// ---- When building with the Android tool-chain ----
+#[cfg(not(feature = "cargo"))]
+pub use aconfig_protos::aconfig::Android_config as ProtoAndroidConfig;
+
+#[cfg(not(feature = "cargo"))]
+pub use aconfig_protos::aconfig::Value as ProtoValue;
+
+#[cfg(not(feature = "cargo"))]
+pub use aconfig_protos::aconfig::Flag as ProtoFlag;
+
+#[cfg(not(feature = "cargo"))]
+pub use aconfig_protos::aconfig::Override_config as ProtoOverrideConfig;
+
+#[cfg(not(feature = "cargo"))]
+pub use aconfig_protos::aconfig::Override as ProtoOverride;
+
+#[cfg(not(feature = "cargo"))]
+pub use aconfig_protos::aconfig::Permission as ProtoPermission;
+
+#[cfg(not(feature = "cargo"))]
+pub use aconfig_protos::aconfig::Flag_state as ProtoFlagState;
+
+// ---- When building with cargo ----
+#[cfg(feature = "cargo")]
+include!(concat!(env!("OUT_DIR"), "/aconfig_proto/mod.rs"));
+
+#[cfg(feature = "cargo")]
+pub use aconfig::Android_config as ProtoAndroidConfig;
+
+#[cfg(feature = "cargo")]
+pub use aconfig::Value as ProtoValue;
+
+#[cfg(feature = "cargo")]
+pub use aconfig::Flag as ProtoFlag;
+
+#[cfg(feature = "cargo")]
+pub use aconfig::Override_config as ProtoOverrideConfig;
+
+#[cfg(feature = "cargo")]
+pub use aconfig::Override as ProtoOverride;
+
+#[cfg(feature = "cargo")]
+pub use aconfig::Permission as ProtoPermission;
+
+#[cfg(feature = "cargo")]
+pub use aconfig::Flag_state as ProtoFlagState;
+
+// ---- Common for both the Android tool-chain and cargo ----
+use anyhow::Result;
+
+pub fn try_from_text_proto<T>(s: &str) -> Result<T>
+where
+    T: protobuf::MessageFull,
+{
+    // warning: parse_from_str does not check if required fields are set
+    protobuf::text_format::parse_from_str(s).map_err(|e| e.into())
+}
diff --git a/tools/finalization/environment.sh b/tools/finalization/environment.sh
index b0ed645..9714ac4 100755
--- a/tools/finalization/environment.sh
+++ b/tools/finalization/environment.sh
@@ -7,7 +7,6 @@
 export FINAL_PLATFORM_CODENAME='VanillaIceCream'
 export CURRENT_PLATFORM_CODENAME='VanillaIceCream'
 export FINAL_PLATFORM_CODENAME_JAVA='VANILLA_ICE_CREAM'
-export FINAL_BUILD_PREFIX='VP1A'
 export FINAL_PLATFORM_VERSION='15'
 
 # Set arbitrary large values for CI.
diff --git a/tools/finalization/finalize-aidl-vndk-sdk-resources.sh b/tools/finalization/finalize-aidl-vndk-sdk-resources.sh
index c7c6d3f..fa33986 100755
--- a/tools/finalization/finalize-aidl-vndk-sdk-resources.sh
+++ b/tools/finalization/finalize-aidl-vndk-sdk-resources.sh
@@ -4,13 +4,15 @@
 
 function apply_droidstubs_hack() {
     if ! grep -q 'STOPSHIP: RESTORE THIS LOGIC WHEN DECLARING "REL" BUILD' "$top/build/soong/java/droidstubs.go" ; then
-        git -C "$top/build/soong" apply --allow-empty ../../build/make/tools/finalization/build_soong_java_droidstubs.go.apply_hack.diff
+        local build_soong_git_root="$(readlink -f $top/build/soong)"
+        git -C "$build_soong_git_root" apply --allow-empty ../../build/make/tools/finalization/build_soong_java_droidstubs.go.apply_hack.diff
     fi
 }
 
 function apply_resources_sdk_int_fix() {
     if ! grep -q 'public static final int RESOURCES_SDK_INT = SDK_INT;' "$top/frameworks/base/core/java/android/os/Build.java" ; then
-        git -C "$top/frameworks/base" apply --allow-empty ../../build/make/tools/finalization/frameworks_base.apply_resource_sdk_int.diff
+        local base_git_root="$(readlink -f $top/frameworks/base)"
+        git -C "$base_git_root" apply --allow-empty ../../build/make/tools/finalization/frameworks_base.apply_resource_sdk_int.diff
     fi
 }
 
@@ -118,10 +120,10 @@
     sed -i -e "s/sepolicy_major_vers := .*/sepolicy_major_vers := ${FINAL_PLATFORM_SDK_VERSION}/g" "$top/build/make/core/config.mk"
     cp "$top/build/make/target/product/gsi/current.txt" "$top/build/make/target/product/gsi/$FINAL_PLATFORM_SDK_VERSION.txt"
 
-    # build/soong
-    local codename_version="\"${FINAL_PLATFORM_CODENAME}\":     ${FINAL_PLATFORM_SDK_VERSION}"
-    if ! grep -q "$codename_version" "$top/build/soong/android/api_levels.go" ; then
-        sed -i -e "/:.*$((${FINAL_PLATFORM_SDK_VERSION}-1)),/a \\\t\t$codename_version," "$top/build/soong/android/api_levels.go"
+    # build/bazel
+    local codename_version="\"${FINAL_PLATFORM_CODENAME}\": ${FINAL_PLATFORM_SDK_VERSION}"
+    if ! grep -q "$codename_version" "$top/build/bazel/rules/common/api_constants.bzl" ; then
+        sed -i -e "/:.*$((${FINAL_PLATFORM_SDK_VERSION}-1)),/a \\    $codename_version," "$top/build/bazel/rules/common/api_constants.bzl"
     fi
 
     # cts
diff --git a/tools/finalization/finalize-sdk-rel.sh b/tools/finalization/finalize-sdk-rel.sh
index 84ad2a7..62e5ee5 100755
--- a/tools/finalization/finalize-sdk-rel.sh
+++ b/tools/finalization/finalize-sdk-rel.sh
@@ -34,7 +34,8 @@
     revert_resources_sdk_int_fix
 
     # build/make/core/version_defaults.mk
-    sed -i -e "s/PLATFORM_VERSION_CODENAME.${FINAL_BUILD_PREFIX} := .*/PLATFORM_VERSION_CODENAME.${FINAL_BUILD_PREFIX} := REL/g" "$top/build/make/core/version_defaults.mk"
+    # Mark all versions "released".
+    sed -i 's/\(PLATFORM_VERSION_CODENAME\.[^[:space:]]*\) := [^[:space:]]*/\1 := REL/g' "$top/build/make/core/version_defaults.mk"
 
     # cts
     echo "$FINAL_PLATFORM_VERSION" > "$top/cts/tests/tests/os/assets/platform_versions.txt"
diff --git a/tools/rbcrun/host.go b/tools/rbcrun/host.go
index 32afa45..f2fda4e 100644
--- a/tools/rbcrun/host.go
+++ b/tools/rbcrun/host.go
@@ -223,16 +223,6 @@
 	return starlark.NewList(elems)
 }
 
-// propsetFromEnv constructs a propset from the array of KEY=value strings
-func structFromEnv(env []string) *starlarkstruct.Struct {
-	sd := make(map[string]starlark.Value, len(env))
-	for _, x := range env {
-		kv := strings.SplitN(x, "=", 2)
-		sd[kv[0]] = starlark.String(kv[1])
-	}
-	return starlarkstruct.FromStringDict(starlarkstruct.Default, sd)
-}
-
 func log(thread *starlark.Thread, fn *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
 	sep := " "
 	if err := starlark.UnpackArgs("print", nil, kwargs, "sep?", &sep); err != nil {
@@ -255,12 +245,10 @@
 	return starlark.None, nil
 }
 
-func setup(env []string) {
+func setup() {
 	// Create the symbols that aid makefile conversion. See README.md
 	builtins = starlark.StringDict{
 		"struct":   starlark.NewBuiltin("struct", starlarkstruct.Make),
-		"rblf_cli": structFromEnv(env),
-		"rblf_env": structFromEnv(os.Environ()),
 		// To convert find-copy-subdir and product-copy-files-by pattern
 		"rblf_find_files": starlark.NewBuiltin("rblf_find_files", find),
 		// To convert makefile's $(shell cmd)
@@ -285,11 +273,8 @@
 //   and the name that appears in error messages;
 // * src is an optional source of bytes to use instead of filename
 //   (it can be a string, or a byte array, or an io.Reader instance)
-// * commandVars is an array of "VAR=value" items. They are accessible from
-//   the starlark script as members of the `rblf_cli` propset.
-func Run(filename string, src interface{}, commandVars []string) error {
-	setup(commandVars)
-
+func Run(filename string, src interface{}) error {
+	setup()
 	mainThread := &starlark.Thread{
 		Name:  "main",
 		Print: func(_ *starlark.Thread, msg string) { fmt.Println(msg) },
diff --git a/tools/rbcrun/host_test.go b/tools/rbcrun/host_test.go
index 97f6ce9..e109c02 100644
--- a/tools/rbcrun/host_test.go
+++ b/tools/rbcrun/host_test.go
@@ -53,8 +53,8 @@
 }
 
 // Common setup for the tests: create thread, change to the test directory
-func testSetup(t *testing.T, env []string) *starlark.Thread {
-	setup(env)
+func testSetup(t *testing.T) *starlark.Thread {
+	setup()
 	thread := &starlark.Thread{
 		Load: func(thread *starlark.Thread, module string) (starlark.StringDict, error) {
 			if module == "assert.star" {
@@ -72,14 +72,16 @@
 func dataDir() string {
 	_, thisSrcFile, _, _ := runtime.Caller(0)
 	return filepath.Join(filepath.Dir(thisSrcFile), "testdata")
-
 }
 
 func exerciseStarlarkTestFile(t *testing.T, starFile string) {
 	// In order to use "assert.star" from go/starlark.net/starlarktest in the tests, provide:
 	//  * load function that handles "assert.star"
 	//  * starlarktest.DataFile function that finds its location
-	setup(nil)
+	setup()
+	if err := os.Chdir(dataDir()); err != nil {
+		t.Fatal(err)
+	}
 	thread := &starlark.Thread{
 		Load: func(thread *starlark.Thread, module string) (starlark.StringDict, error) {
 			if module == "assert.star" {
@@ -98,26 +100,9 @@
 	}
 }
 
-func TestCliAndEnv(t *testing.T) {
-	// TODO(asmundak): convert this to use exerciseStarlarkTestFile
-	if err := os.Setenv("TEST_ENVIRONMENT_FOO", "test_environment_foo"); err != nil {
-		t.Fatal(err)
-	}
-	thread := testSetup(t, []string{"CLI_FOO=foo"})
-	if _, err := starlark.ExecFile(thread, "cli_and_env.star", nil, builtins); err != nil {
-		if err, ok := err.(*starlark.EvalError); ok {
-			t.Fatal(err.Backtrace())
-		}
-		t.Fatal(err)
-	}
-}
-
 func TestFileOps(t *testing.T) {
 	// TODO(asmundak): convert this to use exerciseStarlarkTestFile
-	if err := os.Setenv("TEST_DATA_DIR", dataDir()); err != nil {
-		t.Fatal(err)
-	}
-	thread := testSetup(t, nil)
+	thread := testSetup(t)
 	if _, err := starlark.ExecFile(thread, "file_ops.star", nil, builtins); err != nil {
 		if err, ok := err.(*starlark.EvalError); ok {
 			t.Fatal(err.Backtrace())
@@ -128,7 +113,7 @@
 
 func TestLoad(t *testing.T) {
 	// TODO(asmundak): convert this to use exerciseStarlarkTestFile
-	thread := testSetup(t, nil)
+	thread := testSetup(t)
 	thread.Load = func(thread *starlark.Thread, module string) (starlark.StringDict, error) {
 		if module == "assert.star" {
 			return starlarktest.LoadAssertModule()
@@ -148,8 +133,5 @@
 }
 
 func TestShell(t *testing.T) {
-	if err := os.Setenv("TEST_DATA_DIR", dataDir()); err != nil {
-		t.Fatal(err)
-	}
 	exerciseStarlarkTestFile(t, "testdata/shell.star")
 }
diff --git a/tools/rbcrun/rbcrun/rbcrun.go b/tools/rbcrun/rbcrun/rbcrun.go
index 4db6a0b..8dd0f46 100644
--- a/tools/rbcrun/rbcrun/rbcrun.go
+++ b/tools/rbcrun/rbcrun/rbcrun.go
@@ -20,44 +20,25 @@
 	"go.starlark.net/starlark"
 	"os"
 	"rbcrun"
-	"strings"
 )
 
 var (
-	execprog = flag.String("c", "", "execute program `prog`")
 	rootdir  = flag.String("d", ".", "the value of // for load paths")
-	file     = flag.String("f", "", "file to execute")
 	perfFile = flag.String("perf", "", "save performance data")
 )
 
 func main() {
 	flag.Parse()
-	filename := *file
-	var src interface{}
-	var env []string
+	filename := ""
 
-	rc := 0
 	for _, arg := range flag.Args() {
-		if strings.Contains(arg, "=") {
-			env = append(env, arg)
-		} else if filename == "" {
+		if filename == "" {
 			filename = arg
 		} else {
 			quit("only one file can be executed\n")
 		}
 	}
-	if *execprog != "" {
-		if filename != "" {
-			quit("either -c or file name should be present\n")
-		}
-		filename = "<cmdline>"
-		src = *execprog
-	}
 	if filename == "" {
-		if len(env) > 0 {
-			fmt.Fprintln(os.Stderr,
-				"no file to run -- if your file's name contains '=', use -f to specify it")
-		}
 		flag.Usage()
 		os.Exit(1)
 	}
@@ -75,7 +56,8 @@
 		}
 	}
 	rbcrun.LoadPathRoot = *rootdir
-	err := rbcrun.Run(filename, src, env)
+	err := rbcrun.Run(filename, nil)
+	rc := 0
 	if *perfFile != "" {
 		if err2 := starlark.StopProfile(); err2 != nil {
 			fmt.Fprintln(os.Stderr, err2)
diff --git a/tools/rbcrun/testdata/cli_and_env.star b/tools/rbcrun/testdata/cli_and_env.star
deleted file mode 100644
index d6f464a..0000000
--- a/tools/rbcrun/testdata/cli_and_env.star
+++ /dev/null
@@ -1,11 +0,0 @@
-# Tests rblf_env access
-load("assert.star", "assert")
-
-
-def test():
-    assert.eq(rblf_env.TEST_ENVIRONMENT_FOO, "test_environment_foo")
-    assert.fails(lambda: rblf_env.FOO_BAR_BAZ, ".*struct has no .FOO_BAR_BAZ attribute$")
-    assert.eq(rblf_cli.CLI_FOO, "foo")
-
-
-test()
diff --git a/tools/rbcrun/testdata/file_ops.star b/tools/rbcrun/testdata/file_ops.star
index 2ee78fc..b2b907c 100644
--- a/tools/rbcrun/testdata/file_ops.star
+++ b/tools/rbcrun/testdata/file_ops.star
@@ -1,22 +1,21 @@
 # Tests file ops builtins
 load("assert.star", "assert")
 
-
 def test():
     myname = "file_ops.star"
     files = rblf_wildcard("*.star")
     assert.true(myname in files, "expected %s in  %s" % (myname, files))
-    files = rblf_wildcard("*.star", rblf_env.TEST_DATA_DIR)
+    files = rblf_wildcard("*.star")
     assert.true(myname in files, "expected %s in %s" % (myname, files))
     files = rblf_wildcard("*.xxx")
     assert.true(len(files) == 0, "expansion should be empty but contains %s" % files)
     mydir = "testdata"
     myrelname = "%s/%s" % (mydir, myname)
-    files = rblf_find_files(rblf_env.TEST_DATA_DIR + "/../", "*")
+    files = rblf_find_files("../", "*")
     assert.true(mydir in files and myrelname in files, "expected %s and %s in %s" % (mydir, myrelname, files))
-    files = rblf_find_files(rblf_env.TEST_DATA_DIR + "/../", "*", only_files=1)
+    files = rblf_find_files("../", "*", only_files=1)
     assert.true(mydir not in files, "did not expect %s in %s" % (mydir, files))
     assert.true(myrelname in files, "expected %s  in %s" % (myrelname, files))
-    files = rblf_find_files(rblf_env.TEST_DATA_DIR + "/../", "*.star")
+    files = rblf_find_files("../", "*.star")
     assert.true(myrelname in files, "expected %s in %s" % (myrelname, files))
 test()
diff --git a/tools/rbcrun/testdata/shell.star b/tools/rbcrun/testdata/shell.star
index ad10697..dd17375 100644
--- a/tools/rbcrun/testdata/shell.star
+++ b/tools/rbcrun/testdata/shell.star
@@ -1,5 +1,5 @@
 # Tests "queue" data type
 load("assert.star", "assert")
 
-assert.eq("load.star shell.star", rblf_shell("cd %s && ls -1 shell.star load.star 2>&1" % rblf_env.TEST_DATA_DIR))
-assert.eq("shell.star", rblf_shell("cd %s && echo shell.sta*" % rblf_env.TEST_DATA_DIR))
+assert.eq("load.star shell.star", rblf_shell("ls -1 shell.star load.star 2>&1"))
+assert.eq("shell.star", rblf_shell("echo shell.sta*"))