Fail-Closed, On-Device Agentic Orchestration for Mobile Operating Systems: Design, Implementation, and Real-Hardware Validation on Android

Smartphones have accumulated capability faster than they have accumulated usability: using any of it still requires knowing which app holds a function, navigating that app’s interface, and manually carrying state between apps for any task spanning more than one. We present AgentOS, an intent-driven Android layer that replaces this app-mediated interaction model with a single natural-language surface backed by a six-layer orchestration architecture spanning UI, orchestration engine, on-device AI run-time, native tool capabilities, context storage, and device provisioning. AgentOS contributes two central mechanisms. Fail-closed capability registration excludes a native tool from a language-model planner’s schema entirely, before inference, when the tool’s backing data-source confidence falls below a threshold τ — preventing an unreliable call from ever being offered to the model, rather than validating or blocking it after generation. Hardware-capability-aware routing uses a declarative per-device profile, consumed identically by both the AI runtime and the native capability layer at initialization, to decouple orchestration logic from any single device’s sensor, camera, and compute characteristics. A supporting sensor-context safety-escalation mechanism governs dispatch-time authorization for consequential actions. We evaluate AgentOS end-to-end on a real Samsung Galaxy F34 device provisioned under Android’s Device-Owner model — not emulation or scripted traces — across seventeen native tool executors spanning telephony, messaging, calendar, camera, location, media, fitness, and notifications. Thirteen of seventeen executors pass end-to-end; every remaining failure is root-caused to a specific external cause rather than left unexplained. The fast-classified path meets its sub-two-second latency budget; an LLM-escalation path, evaluated across five candidate on-device models, does not, by a disclosed and substantial margin. We situate both central mechanisms against the closest available prior art — including concurrent industry work on pre-inference tool-schema gating — and report real engineering failures, root causes, and open limitations alongside the results that favor the system.