diff --git a/core/Makefile b/core/Makefile
index 4f85b7d..3da1894 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -5315,13 +5315,13 @@
 	$(hide) echo "flash vendor_boot" >> $@
 endif
 ifneq (,$(strip $(BOARD_AVB_VBMETA_CUSTOM_PARTITIONS)))
-	$(hide) $(foreach partition,$(BOARD_AVB_VBMETA_CUSTOM_PARTITIONS),\
-	  $(hide) echo "flash --apply-vbmeta vbmeta_$(partition)" >> $@;)
+	$(hide) $(foreach partition,$(BOARD_AVB_VBMETA_CUSTOM_PARTITIONS), \
+	  echo "flash --apply-vbmeta vbmeta_$(partition)" >> $@;)
 endif
 endif # BOARD_AVB_ENABLE
 	$(hide) echo "reboot fastboot" >> $@
 	$(hide) echo "update-super" >> $@
-	$(foreach partition,$(BOARD_SUPER_PARTITION_PARTITION_LIST), \
+	$(hide) $(foreach partition,$(BOARD_SUPER_PARTITION_PARTITION_LIST), \
 	  echo "flash $(partition)" >> $@;)
 ifdef BUILDING_SYSTEM_OTHER_IMAGE
 	$(hide) echo "flash --slot-other system system_other.img" >> $@
@@ -5770,6 +5770,8 @@
     echo "virtual_ab_compression_method=$(PRODUCT_VIRTUAL_AB_COMPRESSION_METHOD)" >> $(1))
   $(if $(filter true,$(PRODUCT_VIRTUAL_AB_OTA_RETROFIT)), \
     echo "virtual_ab_retrofit=true" >> $(1))
+  $(if $(PRODUCT_VIRTUAL_AB_COW_VERSION), \
+    echo "virtual_ab_cow_version=$(PRODUCT_VIRTUAL_AB_COW_VERSION)" >> $(1))
 endef
 
 # By conditionally including the dependency of the target files package on the
diff --git a/core/product.mk b/core/product.mk
index e90e27b..818aac2 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -404,6 +404,10 @@
 #   supports it
 _product_single_value_vars += PRODUCT_ENABLE_UFFD_GC
 
+# Specifies COW version to be used by update_engine and libsnapshot. If this value is not
+# specified we default to COW version 2 in update_engine for backwards compatibility
+_product_single_value_vars += PRODUCT_VIRTUAL_AB_COW_VERSION
+
 _product_list_vars += PRODUCT_AFDO_PROFILES
 
 .KATI_READONLY := _product_single_value_vars _product_list_vars
diff --git a/target/board/generic/BoardConfig.mk b/target/board/generic/BoardConfig.mk
index 6720ddb..87c16da 100644
--- a/target/board/generic/BoardConfig.mk
+++ b/target/board/generic/BoardConfig.mk
@@ -30,3 +30,20 @@
 TARGET_CPU_ABI2 := armeabi
 
 include build/make/target/board/BoardConfigGsiCommon.mk
+
+ifndef BUILDING_GSI
+include build/make/target/board/BoardConfigEmuCommon.mk
+
+BOARD_USERDATAIMAGE_PARTITION_SIZE := 576716800
+
+# Wifi.
+BOARD_WLAN_DEVICE           := emulator
+BOARD_HOSTAPD_DRIVER        := NL80211
+BOARD_WPA_SUPPLICANT_DRIVER := NL80211
+BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
+BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
+WPA_SUPPLICANT_VERSION      := VER_0_8_X
+WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
+WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
+WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
+endif
diff --git a/target/board/generic/device.mk b/target/board/generic/device.mk
index 76edf6b..76242c9 100644
--- a/target/board/generic/device.mk
+++ b/target/board/generic/device.mk
@@ -14,3 +14,5 @@
 # limitations under the License.
 #
 
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
diff --git a/target/board/generic_64bitonly_x86_64/BoardConfig.mk b/target/board/generic_64bitonly_x86_64/BoardConfig.mk
index a129ea0..a240eab 100644
--- a/target/board/generic_64bitonly_x86_64/BoardConfig.mk
+++ b/target/board/generic_64bitonly_x86_64/BoardConfig.mk
@@ -28,3 +28,23 @@
 TARGET_PRELINK_MODULE := false
 
 include build/make/target/board/BoardConfigGsiCommon.mk
+
+ifndef BUILDING_GSI
+include build/make/target/board/BoardConfigEmuCommon.mk
+
+BOARD_USERDATAIMAGE_PARTITION_SIZE := 576716800
+
+BOARD_SEPOLICY_DIRS += device/generic/goldfish/sepolicy/x86
+
+# Wifi.
+BOARD_WLAN_DEVICE           := emulator
+BOARD_HOSTAPD_DRIVER        := NL80211
+BOARD_WPA_SUPPLICANT_DRIVER := NL80211
+BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
+BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
+WPA_SUPPLICANT_VERSION      := VER_0_8_X
+WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
+WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
+WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
+
+endif # !BUILDING_GSI
diff --git a/target/board/generic_x86/BoardConfig.mk b/target/board/generic_x86/BoardConfig.mk
index 26bede8..47fd384 100644
--- a/target/board/generic_x86/BoardConfig.mk
+++ b/target/board/generic_x86/BoardConfig.mk
@@ -19,3 +19,23 @@
 TARGET_ARCH_VARIANT := x86
 
 include build/make/target/board/BoardConfigGsiCommon.mk
+
+ifndef BUILDING_GSI
+include build/make/target/board/BoardConfigEmuCommon.mk
+
+# Resize to 4G to accomodate ASAN and CTS
+BOARD_USERDATAIMAGE_PARTITION_SIZE := 4294967296
+
+BOARD_SEPOLICY_DIRS += device/generic/goldfish/sepolicy/x86
+
+# Wifi.
+BOARD_WLAN_DEVICE           := emulator
+BOARD_HOSTAPD_DRIVER        := NL80211
+BOARD_WPA_SUPPLICANT_DRIVER := NL80211
+BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
+BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
+WPA_SUPPLICANT_VERSION      := VER_0_8_X
+WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
+WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
+WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
+endif
diff --git a/target/board/generic_x86/device.mk b/target/board/generic_x86/device.mk
index 60f0cc3..5ad008f 100644
--- a/target/board/generic_x86/device.mk
+++ b/target/board/generic_x86/device.mk
@@ -14,6 +14,9 @@
 # limitations under the License.
 #
 
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
+
 ifdef NET_ETH0_STARTONBOOT
   PRODUCT_VENDOR_PROPERTIES += net.eth0.startonboot=1
 endif
diff --git a/target/board/generic_x86_64/BoardConfig.mk b/target/board/generic_x86_64/BoardConfig.mk
index 2385579..e7f2ae0 100755
--- a/target/board/generic_x86_64/BoardConfig.mk
+++ b/target/board/generic_x86_64/BoardConfig.mk
@@ -26,3 +26,23 @@
 TARGET_DYNAMIC_64_32_MEDIASERVER := true
 
 include build/make/target/board/BoardConfigGsiCommon.mk
+
+ifndef BUILDING_GSI
+include build/make/target/board/BoardConfigEmuCommon.mk
+
+BOARD_USERDATAIMAGE_PARTITION_SIZE := 576716800
+
+BOARD_SEPOLICY_DIRS += device/generic/goldfish/sepolicy/x86
+
+# Wifi.
+BOARD_WLAN_DEVICE           := emulator
+BOARD_HOSTAPD_DRIVER        := NL80211
+BOARD_WPA_SUPPLICANT_DRIVER := NL80211
+BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
+BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
+WPA_SUPPLICANT_VERSION      := VER_0_8_X
+WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
+WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
+WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
+
+endif # !BUILDING_GSI
diff --git a/target/board/generic_x86_64_arm64/BoardConfig.mk b/target/board/generic_x86_64_arm64/BoardConfig.mk
index 818ec44..f528294 100755
--- a/target/board/generic_x86_64_arm64/BoardConfig.mk
+++ b/target/board/generic_x86_64_arm64/BoardConfig.mk
@@ -13,6 +13,7 @@
 # limitations under the License.
 #
 
+# x86_64 emulator specific definitions
 TARGET_CPU_ABI := x86_64
 TARGET_ARCH := x86_64
 TARGET_ARCH_VARIANT := x86_64
@@ -36,9 +37,23 @@
 TARGET_PRELINK_MODULE := false
 
 include build/make/target/board/BoardConfigMainlineCommon.mk
+include build/make/target/board/BoardConfigEmuCommon.mk
 
 # the settings differ from BoardConfigMainlineCommon.mk
 BOARD_USES_SYSTEM_OTHER_ODEX :=
 
 # Resize to 4G to accommodate ASAN and CTS
 BOARD_USERDATAIMAGE_PARTITION_SIZE := 4294967296
+
+BOARD_SEPOLICY_DIRS += device/generic/goldfish/sepolicy/x86
+
+# Wifi.
+BOARD_WLAN_DEVICE           := emulator
+BOARD_HOSTAPD_DRIVER        := NL80211
+BOARD_WPA_SUPPLICANT_DRIVER := NL80211
+BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
+BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
+WPA_SUPPLICANT_VERSION      := VER_0_8_X
+WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
+WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
+WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
diff --git a/target/board/generic_x86_64_arm64/device.mk b/target/board/generic_x86_64_arm64/device.mk
index 76edf6b..76242c9 100755
--- a/target/board/generic_x86_64_arm64/device.mk
+++ b/target/board/generic_x86_64_arm64/device.mk
@@ -14,3 +14,5 @@
 # limitations under the License.
 #
 
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
diff --git a/target/board/generic_x86_arm/BoardConfig.mk b/target/board/generic_x86_arm/BoardConfig.mk
index 62bb5eb..f6589b0 100644
--- a/target/board/generic_x86_arm/BoardConfig.mk
+++ b/target/board/generic_x86_arm/BoardConfig.mk
@@ -13,6 +13,7 @@
 # limitations under the License.
 #
 
+# x86 emulator specific definitions
 TARGET_CPU_ABI := x86
 TARGET_ARCH := x86
 TARGET_ARCH_VARIANT := x86
@@ -29,9 +30,23 @@
 # The settings in latter makefiles overwrite those in the former.
 #
 include build/make/target/board/BoardConfigMainlineCommon.mk
+include build/make/target/board/BoardConfigEmuCommon.mk
 
 # the settings differ from BoardConfigMainlineCommon.mk
 BOARD_USES_SYSTEM_OTHER_ODEX :=
 
 # Resize to 4G to accomodate ASAN and CTS
 BOARD_USERDATAIMAGE_PARTITION_SIZE := 4294967296
+
+BOARD_SEPOLICY_DIRS += device/generic/goldfish/sepolicy/x86
+
+# Wifi.
+BOARD_WLAN_DEVICE           := emulator
+BOARD_HOSTAPD_DRIVER        := NL80211
+BOARD_WPA_SUPPLICANT_DRIVER := NL80211
+BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
+BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
+WPA_SUPPLICANT_VERSION      := VER_0_8_X
+WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
+WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
+WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
diff --git a/target/board/generic_x86_arm/device.mk b/target/board/generic_x86_arm/device.mk
index 76edf6b..76242c9 100644
--- a/target/board/generic_x86_arm/device.mk
+++ b/target/board/generic_x86_arm/device.mk
@@ -14,3 +14,5 @@
 # limitations under the License.
 #
 
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
diff --git a/target/product/aosp_64bitonly_x86_64.mk b/target/product/aosp_64bitonly_x86_64.mk
index cf812a2..75fd3c8 100644
--- a/target/product/aosp_64bitonly_x86_64.mk
+++ b/target/product/aosp_64bitonly_x86_64.mk
@@ -51,6 +51,7 @@
 #
 # All components inherited here go to vendor image
 #
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86_64/device.mk)
 
 #
diff --git a/target/product/aosp_arm.mk b/target/product/aosp_arm.mk
index d9c362e..61c1316 100644
--- a/target/product/aosp_arm.mk
+++ b/target/product/aosp_arm.mk
@@ -50,6 +50,7 @@
 # All components inherited here go to vendor image
 #
 $(call inherit-product-if-exists, build/make/target/product/ramdisk_stub.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86/device.mk)
 
 #
diff --git a/target/product/aosp_arm64.mk b/target/product/aosp_arm64.mk
index d3514a5..6c907db 100644
--- a/target/product/aosp_arm64.mk
+++ b/target/product/aosp_arm64.mk
@@ -54,6 +54,7 @@
 #
 # All components inherited here go to vendor or vendor_boot image
 #
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_arm64/device.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/non_ab_device.mk)
 
diff --git a/target/product/aosp_riscv64.mk b/target/product/aosp_riscv64.mk
index fa503ff..270a989 100644
--- a/target/product/aosp_riscv64.mk
+++ b/target/product/aosp_riscv64.mk
@@ -46,6 +46,7 @@
 #
 # All components inherited here go to vendor image
 #
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_riscv64/device.mk)
 
 #
diff --git a/target/product/aosp_x86.mk b/target/product/aosp_x86.mk
index c26a8bf..a2f0390 100644
--- a/target/product/aosp_x86.mk
+++ b/target/product/aosp_x86.mk
@@ -47,6 +47,7 @@
 #
 # All components inherited here go to vendor image
 #
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86/device.mk)
 
 
diff --git a/target/product/aosp_x86_64.mk b/target/product/aosp_x86_64.mk
index 3040dd3..535ee3f 100644
--- a/target/product/aosp_x86_64.mk
+++ b/target/product/aosp_x86_64.mk
@@ -56,6 +56,7 @@
 #
 # All components inherited here go to vendor image
 #
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86_64/device.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/non_ab_device.mk)
 
diff --git a/target/product/aosp_x86_arm.mk b/target/product/aosp_x86_arm.mk
index a103b1a..39ad0d8 100644
--- a/target/product/aosp_x86_arm.mk
+++ b/target/product/aosp_x86_arm.mk
@@ -45,6 +45,7 @@
 #
 # All components inherited here go to vendor image
 #
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86_arm/device.mk)
 
 
diff --git a/target/product/full.manifest.xml b/target/product/full.manifest.xml
deleted file mode 100644
index b8b0d37..0000000
--- a/target/product/full.manifest.xml
+++ /dev/null
@@ -1,2 +0,0 @@
-<manifest version="1.0" type="device" target-level="7">
-</manifest>
diff --git a/target/product/full.mk b/target/product/full.mk
index da04f49..945957f 100644
--- a/target/product/full.mk
+++ b/target/product/full.mk
@@ -20,11 +20,10 @@
 # entirely appropriate to inherit from for on-device configurations.
 
 $(call inherit-product-if-exists, build/make/target/product/ramdisk_stub.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic/device.mk)
 
-DEVICE_MANIFEST_FILE += build/make/target/product/full.manifest.xml
-
 # Enable dynamic partition size
 PRODUCT_USE_DYNAMIC_PARTITION_SIZE := true
 
diff --git a/target/product/full_x86.mk b/target/product/full_x86.mk
index 07f6472..0f3be91 100644
--- a/target/product/full_x86.mk
+++ b/target/product/full_x86.mk
@@ -23,11 +23,10 @@
 # that isn't a wifi connection. This will instruct init.rc to enable the
 # network connection so that you can use it with ADB
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86/device.mk)
 
-DEVICE_MANIFEST_FILE += build/make/target/product/full.manifest.xml
-
 ifdef NET_ETH0_STARTONBOOT
   PRODUCT_VENDOR_PROPERTIES += net.eth0.startonboot=1
 endif
diff --git a/target/product/generic.mk b/target/product/generic.mk
index fd3b3fb..fb5b727 100644
--- a/target/product/generic.mk
+++ b/target/product/generic.mk
@@ -14,6 +14,9 @@
 # limitations under the License.
 #
 
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
+
 # This is a generic phone product that isn't specialized for a specific device.
 # It includes the base Android platform.
 
diff --git a/target/product/virtual_ab_ota/android_t_baseline.mk b/target/product/virtual_ab_ota/android_t_baseline.mk
index 418aaa4..f862485 100644
--- a/target/product/virtual_ab_ota/android_t_baseline.mk
+++ b/target/product/virtual_ab_ota/android_t_baseline.mk
@@ -20,3 +20,5 @@
 #
 # All U+ launching devices should instead use vabc_features.mk.
 $(call inherit-product, $(SRC_TARGET_DIR)/product/virtual_ab_ota/vabc_features.mk)
+
+PRODUCT_VIRTUAL_AB_COW_VERSION := 2
diff --git a/tools/aconfig/protos/aconfig.proto b/tools/aconfig/protos/aconfig.proto
index 65817ca..6eac414 100644
--- a/tools/aconfig/protos/aconfig.proto
+++ b/tools/aconfig/protos/aconfig.proto
@@ -20,9 +20,20 @@
 
 package android.aconfig;
 
+enum flag_state {
+  ENABLED = 1;
+  DISABLED = 2;
+}
+
+enum permission {
+  READ_ONLY = 1;
+  READ_WRITE = 2;
+}
+
 message value {
-  required bool value = 1;
-  optional uint32 since = 2;
+  required flag_state state = 1;
+  required permission permission = 2;
+  optional uint32 since = 3;
 }
 
 message flag {
@@ -37,7 +48,8 @@
 
 message override {
   required string id = 1;
-  required bool value = 2;
+  required flag_state state = 2;
+  required permission permission = 3;
 };
 
 message override_config {
diff --git a/tools/aconfig/src/aconfig.rs b/tools/aconfig/src/aconfig.rs
index 22fcb88..f10ca1f 100644
--- a/tools/aconfig/src/aconfig.rs
+++ b/tools/aconfig/src/aconfig.rs
@@ -15,25 +15,65 @@
  */
 
 use anyhow::{anyhow, Context, Error, Result};
+use protobuf::{Enum, EnumOrUnknown};
+use serde::{Deserialize, Serialize};
 
 use crate::protos::{
-    ProtoAndroidConfig, ProtoFlag, ProtoOverride, ProtoOverrideConfig, ProtoValue,
+    ProtoAndroidConfig, ProtoFlag, ProtoFlagState, ProtoOverride, ProtoOverrideConfig,
+    ProtoPermission, ProtoValue,
 };
 
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize, Clone, Copy)]
+pub enum FlagState {
+    Enabled,
+    Disabled,
+}
+
+impl TryFrom<EnumOrUnknown<ProtoFlagState>> for FlagState {
+    type Error = Error;
+
+    fn try_from(proto: EnumOrUnknown<ProtoFlagState>) -> Result<Self, Self::Error> {
+        match ProtoFlagState::from_i32(proto.value()) {
+            Some(ProtoFlagState::ENABLED) => Ok(FlagState::Enabled),
+            Some(ProtoFlagState::DISABLED) => Ok(FlagState::Disabled),
+            None => Err(anyhow!("unknown flag state enum value {}", proto.value())),
+        }
+    }
+}
+
+#[derive(Debug, PartialEq, Eq, Serialize, Deserialize, Clone, Copy)]
+pub enum Permission {
+    ReadOnly,
+    ReadWrite,
+}
+
+impl TryFrom<EnumOrUnknown<ProtoPermission>> for Permission {
+    type Error = Error;
+
+    fn try_from(proto: EnumOrUnknown<ProtoPermission>) -> Result<Self, Self::Error> {
+        match ProtoPermission::from_i32(proto.value()) {
+            Some(ProtoPermission::READ_ONLY) => Ok(Permission::ReadOnly),
+            Some(ProtoPermission::READ_WRITE) => Ok(Permission::ReadWrite),
+            None => Err(anyhow!("unknown permission enum value {}", proto.value())),
+        }
+    }
+}
+
 #[derive(Debug, PartialEq, Eq)]
 pub struct Value {
-    value: bool,
+    state: FlagState,
+    permission: Permission,
     since: Option<u32>,
 }
 
 #[allow(dead_code)] // only used in unit tests
 impl Value {
-    pub fn new(value: bool, since: u32) -> Value {
-        Value { value, since: Some(since) }
+    pub fn new(state: FlagState, permission: Permission, since: u32) -> Value {
+        Value { state, permission, since: Some(since) }
     }
 
-    pub fn default(value: bool) -> Value {
-        Value { value, since: None }
+    pub fn default(state: FlagState, permission: Permission) -> Value {
+        Value { state, permission, since: None }
     }
 }
 
@@ -41,10 +81,15 @@
     type Error = Error;
 
     fn try_from(proto: ProtoValue) -> Result<Self, Self::Error> {
-        let Some(value) = proto.value else {
-            return Err(anyhow!("missing 'value' field"));
+        let Some(proto_state) = proto.state else {
+            return Err(anyhow!("missing 'state' field"));
         };
-        Ok(Value { value, since: proto.since })
+        let state = proto_state.try_into()?;
+        let Some(proto_permission) = proto.permission else {
+            return Err(anyhow!("missing 'permission' field"));
+        };
+        let permission = proto_permission.try_into()?;
+        Ok(Value { state, permission, since: proto.since })
     }
 }
 
@@ -72,15 +117,17 @@
         proto.flag.into_iter().map(|proto_flag| proto_flag.try_into()).collect()
     }
 
-    pub fn resolve_value(&self, build_id: u32) -> bool {
-        let mut value = self.values[0].value;
+    pub fn resolve(&self, build_id: u32) -> (FlagState, Permission) {
+        let mut state = self.values[0].state;
+        let mut permission = self.values[0].permission;
         for candidate in self.values.iter().skip(1) {
             let since = candidate.since.expect("invariant: non-defaults values have Some(since)");
             if since <= build_id {
-                value = candidate.value;
+                state = candidate.state;
+                permission = candidate.permission;
             }
         }
-        value
+        (state, permission)
     }
 }
 
@@ -119,7 +166,8 @@
 #[derive(Debug, PartialEq, Eq)]
 pub struct Override {
     pub id: String,
-    pub value: bool,
+    pub state: FlagState,
+    pub permission: Permission,
 }
 
 impl Override {
@@ -142,10 +190,15 @@
         let Some(id) = proto.id else {
             return Err(anyhow!("missing 'id' field"));
         };
-        let Some(value) = proto.value else {
-            return Err(anyhow!("missing 'value' field"));
+        let Some(proto_state) = proto.state else {
+            return Err(anyhow!("missing 'state' field"));
         };
-        Ok(Override { id, value })
+        let state = proto_state.try_into()?;
+        let Some(proto_permission) = proto.permission else {
+            return Err(anyhow!("missing 'permission' field"));
+        };
+        let permission = proto_permission.try_into()?;
+        Ok(Override { id, state, permission })
     }
 }
 
@@ -158,17 +211,22 @@
         let expected = Flag {
             id: "1234".to_owned(),
             description: "Description of the flag".to_owned(),
-            values: vec![Value::default(false), Value::new(true, 8)],
+            values: vec![
+                Value::default(FlagState::Disabled, Permission::ReadOnly),
+                Value::new(FlagState::Enabled, Permission::ReadWrite, 8),
+            ],
         };
 
         let s = r#"
         id: "1234"
         description: "Description of the flag"
         value {
-            value: false
+            state: DISABLED
+            permission: READ_ONLY
         }
         value {
-            value: true
+            state: ENABLED
+            permission: READ_WRITE
             since: 8
         }
         "#;
@@ -189,7 +247,8 @@
         let s = r#"
         description: "Description of the flag"
         value {
-            value: true
+            state: ENABLED
+            permission: READ_ONLY
         }
         "#;
         let error = Flag::try_from_text_proto(s).unwrap_err();
@@ -199,10 +258,12 @@
         id: "a"
         description: "Description of the flag"
         value {
-            value: true
+            state: ENABLED
+            permission: READ_ONLY
         }
         value {
-            value: true
+            state: ENABLED
+            permission: READ_ONLY
         }
         "#;
         let error = Flag::try_from_text_proto(s).unwrap_err();
@@ -215,12 +276,12 @@
             Flag {
                 id: "a".to_owned(),
                 description: "A".to_owned(),
-                values: vec![Value::default(true)],
+                values: vec![Value::default(FlagState::Enabled, Permission::ReadOnly)],
             },
             Flag {
                 id: "b".to_owned(),
                 description: "B".to_owned(),
-                values: vec![Value::default(false)],
+                values: vec![Value::default(FlagState::Disabled, Permission::ReadWrite)],
             },
         ];
 
@@ -229,14 +290,16 @@
             id: "a"
             description: "A"
             value {
-                value: true
+                state: ENABLED
+                permission: READ_ONLY
             }
         }
         flag {
             id: "b"
             description: "B"
             value {
-                value: false
+                state: DISABLED
+                permission: READ_WRITE
             }
         }
         "#;
@@ -247,11 +310,16 @@
 
     #[test]
     fn test_override_try_from_text_proto_list() {
-        let expected = Override { id: "1234".to_owned(), value: true };
+        let expected = Override {
+            id: "1234".to_owned(),
+            state: FlagState::Enabled,
+            permission: Permission::ReadOnly,
+        };
 
         let s = r#"
         id: "1234"
-        value: true
+        state: ENABLED
+        permission: READ_ONLY
         "#;
         let actual = Override::try_from_text_proto(s).unwrap();
 
@@ -259,26 +327,26 @@
     }
 
     #[test]
-    fn test_resolve_value() {
+    fn test_flag_resolve() {
         let flag = Flag {
             id: "a".to_owned(),
             description: "A".to_owned(),
             values: vec![
-                Value::default(true),
-                Value::new(false, 10),
-                Value::new(true, 20),
-                Value::new(false, 30),
+                Value::default(FlagState::Disabled, Permission::ReadOnly),
+                Value::new(FlagState::Disabled, Permission::ReadWrite, 10),
+                Value::new(FlagState::Enabled, Permission::ReadOnly, 20),
+                Value::new(FlagState::Enabled, Permission::ReadWrite, 30),
             ],
         };
-        assert!(flag.resolve_value(0));
-        assert!(flag.resolve_value(9));
-        assert!(!flag.resolve_value(10));
-        assert!(!flag.resolve_value(11));
-        assert!(!flag.resolve_value(19));
-        assert!(flag.resolve_value(20));
-        assert!(flag.resolve_value(21));
-        assert!(flag.resolve_value(29));
-        assert!(!flag.resolve_value(30));
-        assert!(!flag.resolve_value(10_000));
+        assert_eq!((FlagState::Disabled, Permission::ReadOnly), flag.resolve(0));
+        assert_eq!((FlagState::Disabled, Permission::ReadOnly), flag.resolve(9));
+        assert_eq!((FlagState::Disabled, Permission::ReadWrite), flag.resolve(10));
+        assert_eq!((FlagState::Disabled, Permission::ReadWrite), flag.resolve(11));
+        assert_eq!((FlagState::Disabled, Permission::ReadWrite), flag.resolve(19));
+        assert_eq!((FlagState::Enabled, Permission::ReadOnly), flag.resolve(20));
+        assert_eq!((FlagState::Enabled, Permission::ReadOnly), flag.resolve(21));
+        assert_eq!((FlagState::Enabled, Permission::ReadOnly), flag.resolve(29));
+        assert_eq!((FlagState::Enabled, Permission::ReadWrite), flag.resolve(30));
+        assert_eq!((FlagState::Enabled, Permission::ReadWrite), flag.resolve(10_000));
     }
 }
diff --git a/tools/aconfig/src/cache.rs b/tools/aconfig/src/cache.rs
index d27459d..94443d7 100644
--- a/tools/aconfig/src/cache.rs
+++ b/tools/aconfig/src/cache.rs
@@ -18,18 +18,26 @@
 use serde::{Deserialize, Serialize};
 use std::io::{Read, Write};
 
-use crate::aconfig::{Flag, Override};
+use crate::aconfig::{Flag, FlagState, Override, Permission};
 use crate::commands::Source;
 
-#[derive(Serialize, Deserialize)]
+#[derive(Serialize, Deserialize, Debug)]
+pub struct TracePoint {
+    pub source: Source,
+    pub state: FlagState,
+    pub permission: Permission,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
 pub struct Item {
     pub id: String,
     pub description: String,
-    pub value: bool,
-    pub debug: Vec<String>,
+    pub state: FlagState,
+    pub permission: Permission,
+    pub trace: Vec<TracePoint>,
 }
 
-#[derive(Serialize, Deserialize)]
+#[derive(Serialize, Deserialize, Debug)]
 pub struct Cache {
     build_id: u32,
     items: Vec<Item>,
@@ -56,12 +64,13 @@
                 source,
             ));
         }
-        let value = flag.resolve_value(self.build_id);
+        let (state, permission) = flag.resolve(self.build_id);
         self.items.push(Item {
             id: flag.id.clone(),
             description: flag.description,
-            value,
-            debug: vec![format!("{}:{}", source, value)],
+            state,
+            permission,
+            trace: vec![TracePoint { source, state, permission }],
         });
         Ok(())
     }
@@ -70,8 +79,13 @@
         let Some(existing_item) = self.items.iter_mut().find(|item| item.id == override_.id) else {
             return Err(anyhow!("failed to override flag {}: unknown flag", override_.id));
         };
-        existing_item.value = override_.value;
-        existing_item.debug.push(format!("{}:{}", source, override_.value));
+        existing_item.state = override_.state;
+        existing_item.permission = override_.permission;
+        existing_item.trace.push(TracePoint {
+            source,
+            state: override_.state,
+            permission: override_.permission,
+        });
         Ok(())
     }
 
@@ -85,7 +99,7 @@
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::aconfig::Value;
+    use crate::aconfig::{FlagState, Permission, Value};
 
     #[test]
     fn test_add_flag() {
@@ -96,7 +110,7 @@
                 Flag {
                     id: "foo".to_string(),
                     description: "desc".to_string(),
-                    values: vec![Value::default(true)],
+                    values: vec![Value::default(FlagState::Enabled, Permission::ReadOnly)],
                 },
             )
             .unwrap();
@@ -106,7 +120,7 @@
                 Flag {
                     id: "foo".to_string(),
                     description: "desc".to_string(),
-                    values: vec![Value::default(false)],
+                    values: vec![Value::default(FlagState::Disabled, Permission::ReadOnly)],
                 },
             )
             .unwrap_err();
@@ -118,13 +132,21 @@
 
     #[test]
     fn test_add_override() {
-        fn check_value(cache: &Cache, id: &str, expected: bool) -> bool {
-            cache.iter().find(|&item| item.id == id).unwrap().value == expected
+        fn check(cache: &Cache, id: &str, expected: (FlagState, Permission)) -> bool {
+            let item = cache.iter().find(|&item| item.id == id).unwrap();
+            item.state == expected.0 && item.permission == expected.1
         }
 
         let mut cache = Cache::new(1);
         let error = cache
-            .add_override(Source::Memory, Override { id: "foo".to_string(), value: true })
+            .add_override(
+                Source::Memory,
+                Override {
+                    id: "foo".to_string(),
+                    state: FlagState::Enabled,
+                    permission: Permission::ReadOnly,
+                },
+            )
             .unwrap_err();
         assert_eq!(&format!("{:?}", error), "failed to override flag foo: unknown flag");
 
@@ -134,20 +156,36 @@
                 Flag {
                     id: "foo".to_string(),
                     description: "desc".to_string(),
-                    values: vec![Value::default(true)],
+                    values: vec![Value::default(FlagState::Enabled, Permission::ReadOnly)],
                 },
             )
             .unwrap();
-        assert!(check_value(&cache, "foo", true));
+        dbg!(&cache);
+        assert!(check(&cache, "foo", (FlagState::Enabled, Permission::ReadOnly)));
 
         cache
-            .add_override(Source::Memory, Override { id: "foo".to_string(), value: false })
+            .add_override(
+                Source::Memory,
+                Override {
+                    id: "foo".to_string(),
+                    state: FlagState::Disabled,
+                    permission: Permission::ReadWrite,
+                },
+            )
             .unwrap();
-        assert!(check_value(&cache, "foo", false));
+        dbg!(&cache);
+        assert!(check(&cache, "foo", (FlagState::Disabled, Permission::ReadWrite)));
 
         cache
-            .add_override(Source::Memory, Override { id: "foo".to_string(), value: true })
+            .add_override(
+                Source::Memory,
+                Override {
+                    id: "foo".to_string(),
+                    state: FlagState::Enabled,
+                    permission: Permission::ReadWrite,
+                },
+            )
             .unwrap();
-        assert!(check_value(&cache, "foo", true));
+        assert!(check(&cache, "foo", (FlagState::Enabled, Permission::ReadWrite)));
     }
 }
diff --git a/tools/aconfig/src/commands.rs b/tools/aconfig/src/commands.rs
index 76b853b..73d3357 100644
--- a/tools/aconfig/src/commands.rs
+++ b/tools/aconfig/src/commands.rs
@@ -23,7 +23,7 @@
 use crate::aconfig::{Flag, Override};
 use crate::cache::Cache;
 
-#[derive(Clone, Serialize, Deserialize)]
+#[derive(Serialize, Deserialize, Clone, Debug)]
 pub enum Source {
     #[allow(dead_code)] // only used in unit tests
     Memory,
@@ -80,12 +80,12 @@
     match format {
         Format::Text => {
             for item in cache.iter() {
-                println!("{}: {}", item.id, item.value);
+                println!("{}: {:?}", item.id, item.state);
             }
         }
         Format::Debug => {
             for item in cache.iter() {
-                println!("{}: {} ({:?})", item.id, item.value, item.debug);
+                println!("{:?}", item);
             }
         }
     }
@@ -95,6 +95,7 @@
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::aconfig::{FlagState, Permission};
 
     #[test]
     fn test_create_cache() {
@@ -103,7 +104,8 @@
             id: "a"
             description: "Description of a"
             value {
-                value: true
+                state: ENABLED
+                permission: READ_WRITE
             }
         }
         "#;
@@ -111,12 +113,14 @@
         let o = r#"
         override {
             id: "a"
-            value: false
+            state: DISABLED
+            permission: READ_ONLY
         }
         "#;
         let overrides = vec![Input { source: Source::Memory, reader: Box::new(o.as_bytes()) }];
         let cache = create_cache(1, aconfigs, overrides).unwrap();
-        let value = cache.iter().find(|&item| item.id == "a").unwrap().value;
-        assert!(!value);
+        let item = cache.iter().find(|&item| item.id == "a").unwrap();
+        assert_eq!(FlagState::Disabled, item.state);
+        assert_eq!(Permission::ReadOnly, item.permission);
     }
 }
diff --git a/tools/aconfig/src/main.rs b/tools/aconfig/src/main.rs
index 3ce9747..62750ae 100644
--- a/tools/aconfig/src/main.rs
+++ b/tools/aconfig/src/main.rs
@@ -17,7 +17,7 @@
 //! `aconfig` is a build time tool to manage build time configurations, such as feature flags.
 
 use anyhow::Result;
-use clap::{builder::ArgAction, builder::EnumValueParser, Arg, Command};
+use clap::{builder::ArgAction, builder::EnumValueParser, Arg, ArgMatches, Command};
 use std::fs;
 
 mod aconfig;
@@ -53,25 +53,22 @@
         )
 }
 
+fn open_zero_or_more_files(matches: &ArgMatches, arg_name: &str) -> Result<Vec<Input>> {
+    let mut opened_files = vec![];
+    for path in matches.get_many::<String>(arg_name).unwrap_or_default() {
+        let file = Box::new(fs::File::open(path)?);
+        opened_files.push(Input { source: Source::File(path.to_string()), reader: file });
+    }
+    Ok(opened_files)
+}
+
 fn main() -> Result<()> {
     let matches = cli().get_matches();
     match matches.subcommand() {
         Some(("create-cache", sub_matches)) => {
-            let mut aconfigs = vec![];
             let build_id = *sub_matches.get_one::<u32>("build-id").unwrap();
-            for path in
-                sub_matches.get_many::<String>("aconfig").unwrap_or_default().collect::<Vec<_>>()
-            {
-                let file = Box::new(fs::File::open(path)?);
-                aconfigs.push(Input { source: Source::File(path.to_string()), reader: file });
-            }
-            let mut overrides = vec![];
-            for path in
-                sub_matches.get_many::<String>("override").unwrap_or_default().collect::<Vec<_>>()
-            {
-                let file = Box::new(fs::File::open(path)?);
-                overrides.push(Input { source: Source::File(path.to_string()), reader: file });
-            }
+            let aconfigs = open_zero_or_more_files(sub_matches, "aconfig")?;
+            let overrides = open_zero_or_more_files(sub_matches, "override")?;
             let cache = commands::create_cache(build_id, aconfigs, overrides)?;
             let path = sub_matches.get_one::<String>("cache").unwrap();
             let file = fs::File::create(path)?;
diff --git a/tools/aconfig/src/protos.rs b/tools/aconfig/src/protos.rs
index 3c156b3..604eca4 100644
--- a/tools/aconfig/src/protos.rs
+++ b/tools/aconfig/src/protos.rs
@@ -42,6 +42,12 @@
 #[cfg(not(feature = "cargo"))]
 pub use aconfig_protos::aconfig::Override as ProtoOverride;
 
+#[cfg(not(feature = "cargo"))]
+pub use aconfig_protos::aconfig::Permission as ProtoPermission;
+
+#[cfg(not(feature = "cargo"))]
+pub use aconfig_protos::aconfig::Flag_state as ProtoFlagState;
+
 // ---- When building with cargo ----
 #[cfg(feature = "cargo")]
 include!(concat!(env!("OUT_DIR"), "/aconfig_proto/mod.rs"));
@@ -61,6 +67,12 @@
 #[cfg(feature = "cargo")]
 pub use aconfig::Override as ProtoOverride;
 
+#[cfg(feature = "cargo")]
+pub use aconfig::Permission as ProtoPermission;
+
+#[cfg(feature = "cargo")]
+pub use aconfig::Flag_state as ProtoFlagState;
+
 // ---- Common for both the Android tool-chain and cargo ----
 use anyhow::Result;
 
diff --git a/tools/finalization/environment.sh b/tools/finalization/environment.sh
index b0ed645..9714ac4 100755
--- a/tools/finalization/environment.sh
+++ b/tools/finalization/environment.sh
@@ -7,7 +7,6 @@
 export FINAL_PLATFORM_CODENAME='VanillaIceCream'
 export CURRENT_PLATFORM_CODENAME='VanillaIceCream'
 export FINAL_PLATFORM_CODENAME_JAVA='VANILLA_ICE_CREAM'
-export FINAL_BUILD_PREFIX='VP1A'
 export FINAL_PLATFORM_VERSION='15'
 
 # Set arbitrary large values for CI.
diff --git a/tools/finalization/finalize-aidl-vndk-sdk-resources.sh b/tools/finalization/finalize-aidl-vndk-sdk-resources.sh
index d977a65..fa33986 100755
--- a/tools/finalization/finalize-aidl-vndk-sdk-resources.sh
+++ b/tools/finalization/finalize-aidl-vndk-sdk-resources.sh
@@ -4,13 +4,15 @@
 
 function apply_droidstubs_hack() {
     if ! grep -q 'STOPSHIP: RESTORE THIS LOGIC WHEN DECLARING "REL" BUILD' "$top/build/soong/java/droidstubs.go" ; then
-        git -C "$top/build/soong" apply --allow-empty ../../build/make/tools/finalization/build_soong_java_droidstubs.go.apply_hack.diff
+        local build_soong_git_root="$(readlink -f $top/build/soong)"
+        git -C "$build_soong_git_root" apply --allow-empty ../../build/make/tools/finalization/build_soong_java_droidstubs.go.apply_hack.diff
     fi
 }
 
 function apply_resources_sdk_int_fix() {
     if ! grep -q 'public static final int RESOURCES_SDK_INT = SDK_INT;' "$top/frameworks/base/core/java/android/os/Build.java" ; then
-        git -C "$top/frameworks/base" apply --allow-empty ../../build/make/tools/finalization/frameworks_base.apply_resource_sdk_int.diff
+        local base_git_root="$(readlink -f $top/frameworks/base)"
+        git -C "$base_git_root" apply --allow-empty ../../build/make/tools/finalization/frameworks_base.apply_resource_sdk_int.diff
     fi
 }
 
diff --git a/tools/finalization/finalize-sdk-rel.sh b/tools/finalization/finalize-sdk-rel.sh
index 84ad2a7..62e5ee5 100755
--- a/tools/finalization/finalize-sdk-rel.sh
+++ b/tools/finalization/finalize-sdk-rel.sh
@@ -34,7 +34,8 @@
     revert_resources_sdk_int_fix
 
     # build/make/core/version_defaults.mk
-    sed -i -e "s/PLATFORM_VERSION_CODENAME.${FINAL_BUILD_PREFIX} := .*/PLATFORM_VERSION_CODENAME.${FINAL_BUILD_PREFIX} := REL/g" "$top/build/make/core/version_defaults.mk"
+    # Mark all versions "released".
+    sed -i 's/\(PLATFORM_VERSION_CODENAME\.[^[:space:]]*\) := [^[:space:]]*/\1 := REL/g' "$top/build/make/core/version_defaults.mk"
 
     # cts
     echo "$FINAL_PLATFORM_VERSION" > "$top/cts/tests/tests/os/assets/platform_versions.txt"