XFoneOS for PX7 and PX9 — November 2026 Release
Your everyday phone.
Your field workspace.
Standard XFoneOS features bring local assistance, field observation, a radio-style PTT screen and BlackBerry enterprise applications together on LynX Phone.
The capabilities described here are now standard across XFoneOS versions. This announcement covers the current releases for the Pixel 7-based PX7 and the Pixel 9-family PX9, with the same required application set in both builds. XFoneOS combines the Assistant and Mission workflows with the Phone app’s Secure and PTT entry points, while preserving the original signatures of the supplied BlackBerry applications. Hardware support, account roles, licensing and service provisioning still determine which functions are available.
Use the Assistant to manage your supported accounts and working information. Open Mission for radio observations and structured exercise reporting. Use Phone for everyday calls, its PTT interface or the shortcut to a separately activated SecuSUITE service.
Personal intelligence.
Operational awareness.
Accounts, mail and trusted contacts meet a field workspace for radio observations and reviewed reports.
Concept illustrations, not app screenshots. Radar returns and signal bars are illustrative.
Built for PX7 and PX9.
LynX Phone PX9
20261109000428
The Caiman release is offered to existing registered PX9 Monthly, Annual and Biannual update tiers. The SecuSUITE launch fix is included.
LynX Phone PX7
20261109000429
The Panther release includes the updated Dialer, the standard XFoneOS application set and the SecuSUITE launch fix. Check the XFoneOS updater for availability through your existing PX7 update channel.
Choose the exact device build. PX7 uses Panther / Pixel 7 hardware. The PX9 Caiman build on this page targets Pixel 9 Pro hardware; it is not a universal package for every Pixel 9-family model. Follow the device-specific updater or XTC Mobile installation instructions.
Every required app, explained.
These are all 15 required bundled application modules checked in the release packaging, followed by the updated Phone APK. Some are visible apps; the F-Droid extension is a system helper.
This is the required XFoneOS release-app manifest, not a claim that Android contains only 15 APKs. Android framework, setup and other system packages are additional OS components. The names below are the installed APK basenames; the signed source inputs may use different filenames.
XFoneOS AssistantXFoneOS MissionXFoneOS Store
BlackBerry SecuSUITEBlackBerry UEM ClientBlackBerry AtHoc
Breezy Weather
F-Droid
F-Droid Privileged Extension
Fennec
K-9 Mail
Aurora Store
OsmAnd
LibreOffice
NextcloudPhone
| Application / APK | What it does | What it needs |
|---|---|---|
|
01XFoneOS Assistant
|
Your personal and business control centre: local assistance, identity, accounts, email, contacts, trust relationships, Virtual Radar and account-enabled business tools. | Account and service features depend on sign-in, permissions and provisioning. |
|
02XFoneOS Mission
|
Field observation and reporting: cellular and nearby-device discovery, Virtual Radar, RF views, local Signals Analyst, bounded reconnaissance, sensor inputs and structured exercise reports. | Radio access depends on hardware and Android permissions; some functions need a local model or configured service. |
|
03XFoneOS Store
|
The XFoneOS application-store client provides an entry point for the XFoneOS application catalogue. It is separate from F-Droid and Aurora Store. | Catalogue access and available applications depend on the configured service. |
|
04BlackBerry SecuSUITE
|
BlackBerry’s secure voice and messaging client. The Phone app’s Secure shortcut opens the original BlackBerry-signed application. | Requires an activated SecuSUITE account and provisioned service. |
|
05BlackBerry UEM Client
|
Enrols the phone with a BlackBerry UEM deployment for organizational management, policies, compliance information and access to assigned work resources. | Requires an organization’s UEM activation and supported management configuration. |
|
06BlackBerry AtHoc
|
Connects users to an organization’s AtHoc critical-event communications, mass notifications and personnel-accountability workflows. | Requires an AtHoc organization and enrollment; available actions are administrator-configured. |
|
07Breezy Weather
|
Weather conditions and forecasts in a dedicated weather application. | Forecast updates depend on a configured weather provider and connectivity. |
|
08F-Droid
|
Browses configured free and open-source Android application repositories and manages supported application downloads and updates. | Repository content and update availability vary. |
|
09F-Droid Privileged Extension
|
A system companion that enables supported privileged installation and update operations for F-Droid. It is a helper APK, not a separate app catalogue. | Operations remain subject to the OS integration and applicable installation policy. |
|
10Fennec
|
A Firefox-derived web browser for browsing websites and using supported browser features. | Web services still have their own privacy policies and sign-in requirements. |
|
11K-9 Mail
|
A dedicated email client for supported email accounts, including reading, composing and sending mail. It remains separate from Assistant’s My Mail. | Requires a compatible account and mail-server configuration. |
|
12Aurora Store
|
An alternative client for accessing applications distributed through Google Play. | Availability, licensing and account requirements remain those of the underlying service and applications. |
|
13OsmAnd
|
OpenStreetMap-based maps and navigation, including offline use of downloaded map regions. | Download the required map data; location functions need appropriate permissions. |
|
14LibreOffice
|
An Android document-viewing application for opening supported office documents, spreadsheets and presentations. | Android capabilities differ from the full desktop LibreOffice suite. |
|
15Nextcloud
|
Connects to a configured Nextcloud server for cloud-file access, uploads, downloads and supported sharing workflows. | Requires a Nextcloud account and server. Contacts and calendar synchronization require their own configured components. |
|
Phone / XFoneOS Dialer
|
The system Phone application with ordinary calling, contacts, call history and the Secure and PTT entry points. | Calling features depend on the configured calling service; secure calling and PTT have separate setup requirements. |
Your accounts, contacts and local intelligence.
The Assistant joins personal-device context with supported business services. Expand each area for the available controls, connected-service features and clearly identified work still in progress.
01Ask Assist: answers on the phone
Type a question from the Assistant home screen. The phone-first answer path uses available phone facts, retained radar evidence and previously saved answers.
Open-ended local generation uses the compatible on-device Gemma/LiteRT model when one is installed and available. If the model is unavailable or busy, the app falls back to local facts or saved guidance instead of claiming that a remote answer was produced.
Phone/model and Android/app-version questions, scanning-permission guidance and radar-context questions have local handling. Saved answers carry a saved-at date. Current prices come from the connected catalogue or quotation workflow; the local answer path does not invent them.
This describes the local Ask feature. Account, mail, cloud, product and sales services make their own network connections when used.
02My Identity: a device-held trust identity
Create the LynX identity on the phone, establish a permanent username, and inspect the identity fingerprint. The identity view separates the device’s trust identity from the XFoneOS service accounts you sign into.
Identity keys are held in Android Keystore. The UI reports StrongBox availability where the device supports it. The account vault uses AES-256-GCM with a Keystore-protected key.
Nearby recognition uses rotating anonymous identifiers rather than placing the permanent identity in public Bluetooth advertisements. A displayed name or radio observation by itself is not proof of a trusted identity.
03My Accounts: connections and service status
Add, select, modify, test and remove supported XFoneOS and email account configurations. XFoneOS account details include plan, services and entitlement information supplied by the service.
Email tests check incoming and outgoing account connectivity without sending a test message. Removing an XFoneOS connection removes the local configuration and stored credential; it does not delete the server account.
My Accounts also leads to Products and Services, Marketing Ecosystem and the role-enabled quote and Sales Manager tools. Registration and Trust setup support the Dialer’s PTT path.
Provider sections for Microsoft 365, Salesforce, My Cloud, SIP, Signal, Telegram, WhatsApp, BlackBerry services and VPN appear as integration areas. An empty provider section is not an active connector or a promise that its account can already be managed there. Microsoft mail sign-in is provided separately through My Mail.
04My Mail: multiple mailboxes, one workspace
Configure multiple supported IMAP/SMTP accounts, edit display name and server settings, test connections, select a mailbox and refresh its messages. Provider discovery can suggest settings; Microsoft Exchange/Microsoft 365 uses the supported Microsoft sign-in path and provider requirements.
Browse folders, read messages, search the selected mailbox and load additional search results. Compose mail with To, CC, BCC, subject and message fields; attach files; reply, reply all and forward. The Outbox shows messages waiting to send.
Account switching, saved account configuration, connection-error feedback and retry actions are part of the mail workflow. A separate My Mail launcher and the Add My Mail to Home Screen action provide quick access; Android’s default email-app settings can be opened from the screen.
AI-generated email summaries and autonomous drafting are not announced as available features in this release. Mail-provider authentication, attachment limits and connectivity still apply.
05My Contacts and Rocket Search
Read contacts available through Android’s contacts system after granting permission. See contact counts and account/source information rather than assuming every service has already synchronized its address book.
Rocket Search searches names, numbers, email addresses, companies and discovered mail identities. The app can scan supported mailbox identities to surface people found in email, showing the mail source alongside the result.
Open a contact’s available phone or email actions. Associate an eligible contact with a trusted LynX identity, or initiate a trust request that the nearby phone must explicitly accept. Contact labels and a trust relationship are kept conceptually separate.
06My Trust Network and Virtual Radar
View nearby Bluetooth, Wi-Fi and cellular observations alongside trusted LynX contacts. The radar and retained contact list show the observation source, activity/last-seen information, signal strength, range, bearing and the evidence or estimator behind a displayed position.
Start or stop scanning, search retained contacts, select a contact for details, and use North Up, Heading Up or Track Up orientation. Separate range and bearing confidence values and a confidence filter help distinguish stronger evidence from weaker estimates.
Mark an observation Trusted or Not Trusted, set a local label and inspect possible duplicate/identity-unverified indications. A local observation label is not the same as cryptographic peer pairing.
Find Direction captures observations from separated positions. User distance/bearing references, locally saved feedback and Train My Assistant calibration inputs can improve the local interpretation. Stride and step-variation settings support the optional inertial-navigation estimate where sensors and permissions are available.
Introduce Nearby and explicit Accept/Not Accept pairing decisions establish supported LynX trust relationships. Per-peer location authorization controls the trusted location-sharing path, and Use GPS Bearing can use an authorized peer location when available.
Radar goals and local analysis work with the retained evidence. RSSI-derived ranges and motion-derived bearings are estimates: this is radio-observation software, not a claim of hardware radar or guaranteed direction finding. Calibration feedback is not a claim that the general language model is retrained.
07My Phone, contacts and calendar recovery status
See the phone’s reported manufacturer/model, Android release and Assistant version. Contacts and Calendar cards identify whether synchronization is configured, needs attention or lacks its required service.
Where the compatible My Cloud synchronization component is installed and repair is available, Sync My Contacts and Sync My Calendar open the supported recovery/configuration path.
The interface also contains Back Up My Phone, Restore My Phone, Move to a New LynX Phone, Trusted Computers and Expert Mode. In this source release these controls are marked Service connection pending; they are not being announced as working automated backup, migration or owner-access services.
08My Cloud and first-run welcome
An enrolled XTC account can receive its configured private-cloud entitlement. The welcome screen displays the service-reported storage quota and provides Add File to My Private Cloud.
Cloud-file access, account provisioning and the supporting contacts/calendar synchronization path depend on the actual service configuration. The Invite experience advertises the eligible introductory cloud allowance; storage is governed by the account’s entitlement, not by the presence of an APK.
09Invite, QR sharing and referrals
Create a personal invitation/QR entry point for another person to join XTC Mobile. The screen identifies the referring account and provides the supported sharing workflow.
View invited/joined/cloud-account counts, refresh referral results and inspect My Referrals, including whether the referred account and cloud service are active or pending. Referral status is service-provided; sharing an invitation does not guarantee an account, reward or entitlement.
10Products, services and quotes
Browse the live XTC Mobile product and service catalogue, inspect available prices and configurations, select quantities and add items to a quote.
Eligible ecosystem members can assemble quote lines, see quantities and subtotals, remove lines, enter customer/company/contact and billing/shipping details, request a quote and proceed to the supported checkout flow.
Prices, availability, billing choices, currencies and checkout results come from the connected services. These functions require connectivity and the appropriate account role.
11Sales Manager and Marketing Ecosystem
Eligible users can open Sales Manager and submit sales-assistance tasks concerning customer opportunities and quotes.
The Marketing Ecosystem workflow supports a business-profile application, country and contact details, application status, review of the applicable agreement and a typed signature. It presents the Member, Leader and Ambassador progression as part of the ecosystem programme.
Authorized administrators can review applications and use the available approval or cancellation actions. Access to these workflows depends on service roles, membership state and the applicable approval process; the release does not bypass them.
12Account sign-in and Assistant updates
Sign in or create an XTC Mobile account using the supported email-verification-code flow. The app can show enrollment, cloud welcome and account/service status.
The Assistant checks its supported update service and can offer the available app update through Android’s installation flow. A failed update check does not block normal use of the app. Firmware OTA availability is a separate XFoneOS updater function.
For the broader product introduction, visit XFoneOS Assistant.
Observe. Review. Report.
Mission is the field workspace for radio observations, sensor context and operator-reviewed reports. Measurement provenance, permissions and uncertainty matter throughout the workflow.
Observe
Gather available cellular, nearby-device and sensor observations.
Review
Inspect signal evidence, confidence and optional local analyst output.
Report
Review a structured exercise report before sending to a configured hub.
01Operations view and Virtual Radar
Mission brings Radar, AI and Sensors navigation into an operations screen. Start/stop scanning from the mission controls; view fused cellular and nearby-device contacts; select observations and prepare a report from the selected contact.
The radar view provides scan state, contact information, range/bearing confidence filtering and North Up, Heading Up or Track Up orientation. Search Bearings sets an evidence-focused analyst goal. Sound and alert controls can be changed separately.
Location and heading information provide context for the display. A plotted return or a model interpretation is not automatically a verified identity or a measured geographic bearing.
02Cellular observations and RF views
Look Around discovers visible cellular observations. Target Scan watches configured identifiers such as PLMN, band, channel/ARFCN, frequency and operating mode. Range Scan filters observations by selected limits.
Range selectors cover NR frequency, NR-ARFCN, LTE EARFCN, band, RSRP, RSRQ, SINR and PCI. Fast, Normal and Battery Saver sampling choices support the range workflow; configurable sampling is available for the other scan modes.
RF plots, session status and discovered-contact summaries expose observed signal information. GPS-assisted session collection and Mark Event record operator context during a scan. A vendor-specific engineering probe is also exposed for supported radio implementations; its presence is not a promise that private modem commands work on every Pixel.
Available measurements are constrained by the device, modem, Android radio APIs, SIM/network state and granted permissions. Software selection of a band does not add unsupported radio hardware.
03Active NR discovery, n79 and bounded reconnaissance
Active NR Discovery requests modem-supported NR discovery and reports returned cell identifiers, bands, frequencies and signal measurements. A dedicated n79 workflow focuses the search where hardware and permissions permit it.
Start Recon Mission runs the bounded n79-oriented reconnaissance controller, reports mission progress and retains returned observations. The interface reports a detected goal with its observed ARFCN, PCI and RSRP and records the learned configuration.
Recon owns the network-scan resource while running and stops conflicting manual NR scans. The operator can stop it. Modem rejection and scan failures are surfaced rather than treated as a successful discovery.
04Nearby devices and encounter context
Nearby Discovery supplies a snapshot of supported Wi-Fi/Bluetooth observations and LynX beacon information for the fused radar view. The screen offers scan controls, discovery summaries, contact activity and alert feedback.
Names, signal strength and repeat observations help the operator investigate a contact. They do not establish a person’s identity, hostile intent or trustworthiness. Observation source and uncertainty remain part of the interpretation.
05Signals Analyst: local AI and spoken feedback
Ask the Signals Analyst about available cellular, nearby-radio, location, history and sensor context. The on-device LiteRT/Gemma path works with a compatible installed model and shows progress while the model loads or responds.
Analyst prompt controls allow the operator to review or adjust the analytical instruction. The evidence-focused workflow asks for missing information rather than presenting inferred identity, confidence or bearing as a measurement.
Voice modes include Off, Alerts and Briefings when a compatible text-to-speech engine is installed. Spoken output takes audio priority over sweep effects while collection can continue. Sound effects and visual alerts have separate controls.
An absent model or TTS engine is shown as unavailable. Offline processing depends on the local components actually installed on the phone.
06External sensors and radiation-input workflow
Mission contains an external-instrument/measurement input path with instrument status, measurement summaries, radiation alerts and source-location plotting where the required evidence is available.
The pipeline includes a clearly labelled test-data action for exercising the display and alert workflow. It is not a real radiation reading. A phone alone is not a radiation detector; operational use needs compatible external equipment and an appropriate integration.
07Messages, SITREP exercise forms and reports
Open Messages and Reports from Mission, check SecureCell provisioning, compose a report, choose a bundled profile, enter a recipient device identity and fill the definition-driven form.
The form supports required fields, text/narrative/decimal inputs, enumerated choices, conditional fields and repeated entries. It validates applicable values and time/coordinate constraints, saves local drafts and provides a review step before Queue Report.
Manual Sync sends queued reports and retrieves the inbox through the configured hub. Inbox and Outbox retain report states. Queue identifiers support retry behavior; failures leave queued data available for another attempt.
Incoming reports can be viewed as structured fields where the local profile is recognized. Original raw text is retained; unknown or invalid profiles remain readable as raw messages. Acknowledge Report requires an explicit operator confirmation and confirms receipt rather than factual accuracy.
A selected Mission radar observation can open the composer for operator review. This does not send the report automatically or convert shared text into authenticated identity evidence.
The bundled SITREP profile is a local exercise format, not a declaration of USMTF/JANAP conformance. The exchange requires provisioned hub credentials and connectivity; background delivery, end-to-end message encryption and standards-certified interoperability are not claimed by this milestone.
Phone, Secure and PTT.
Clear paths to communicate.
The updated Dialer keeps calling familiar and brings secure-app access and a radio-style push-to-talk experience into the Phone workflow.
Phone
Everyday calls, contacts and call history through your configured calling service.
Secure
A direct shortcut to the separately activated BlackBerry SecuSUITE application.
Push to talk
Two trusted phones. One private Wi-Fi network. Foreground direct-phone mode.
Your regular Phone workflow
Favorites/speed dial, recent calls, contact lookup and the dial pad remain in the Phone application. Normal call handling includes the available call-screen controls such as mute, speaker, keypad tones and hold. Voicemail and account-dependent calling options remain subject to the configured carrier or calling service.
A Secure shortcut to BlackBerry
The Secure control opens the installed SecuSUITE client. BlackBerry continues to own the secure-call application, its activation and its communications stack. Tapping Secure does not turn a normal carrier call into a SecuSUITE call.
PTT inside the Dialer
The PTT control opens a Phone-owned radio-style screen with a link-status display, trusted-contact selector, large Hold to Talk button, Listen, Connect and Disconnect actions, and expandable connection settings.
Account and Trust setup
Connection settings include the registered hardware serial and the other phone’s Wi-Fi IPv4 address. Registration & Trust opens the supported Assistant setup. Assistant supplies registration, trust authorization and the network broker; microphone capture and playback remain in Phone.
Press to transmit, release to listen
A press requests the speaking floor; release ends transmission. Link state and floor status drive the display. The integration releases audio on pause, disconnect, audio-focus interruption or a broker timeout, and blocks starting PTT during an existing Telecom call.
A bounded direct-phone mode
The included direct mode is for two registered, trusted LynX Phones on the same private IPv4 Wi-Fi network with both PTT screens open. Presses are limited to 10 seconds and sessions to two minutes before reconnecting. It is not a carrier-wide, relay-backed or group-radio service.
Protected handoff between apps
Phone and Assistant use signature/identity checks for the PTT bridge. The Phone client pins the expected Assistant signer; registration credentials and private trust keys stay with their owning components instead of being copied into the Dialer.
Commercial services remain provisioned services
Commercial PTT networks need a separate order and provisioning. This release does not claim P25, MCPTT or SecuSUITE voice interoperability for the direct PTT mode. SecuSUITE’s own secure calls and the Dialer’s PTT path are distinct.
Three applications.
Distinct enterprise services.
SecuSUITE, UEM Client and AtHoc are included as their original signed applications. Their accounts, service infrastructure and activation remain controlled by the relevant deployment.
SecuSUITE: secure communications
SecuSUITE provides BlackBerry’s secure voice and messaging experience for an activated deployment. XFoneOS includes the original signed APK and its required ARM64 native libraries. The packaging fix restores the launch path: the PX9 test reached activation and stayed open. Calls, account activation and messaging still require service provisioning and have not been validated by that launch-only test.
UEM Client: organizational enrollment
UEM Client connects a supported device to an organization’s BlackBerry UEM deployment. After activation, the client can expose assigned profiles and IT policies, device-compliance information and work-app access according to the organization’s configuration. Installing the APK does not automatically enroll or manage the device.
AtHoc: critical-event communications
AtHoc connects enrolled users with their organization’s notification and personnel-accountability system. Available alert and response workflows depend on the organization and configuration. It is a separate application and service from Mission’s exercise-report exchange and the Dialer’s direct PTT mode.
Native-library packaging fixed
The release installs SecuSUITE’s three required ARM64 libraries alongside its unchanged signed APK. This resolves the launch failure observed on the PX9 and allows the client to reach activation. It does not replace BlackBerry’s activation, licenses or network services.
Inclusion of a BlackBerry client does not transfer a BlackBerry product certification to the complete XFoneOS release or imply that all enterprise services have been activated or tested.
Explore XTC Mobile enterprise solutions →Update through your device’s channel.
Check availability for your model.
This announcement covers PX9 build 20261109000428 and PX7 build 20261109000429. Check availability in the XFoneOS updater for your exact device. Updates use existing Monthly, Annual and Biannual registrations; your account coverage and entitlements are not changed.
Refresh the XFoneOS updater.
Connect to a suitable network, keep adequate battery charge and follow the updater’s prompts. Availability is offered through the existing channel; publication does not force installation or a reboot.
Activate the services you use.
Sign into supported Assistant accounts, grant the permissions needed for your workflows and obtain organization-approved BlackBerry or commercial communications provisioning where required.
Installing from a factory package is different from taking an OTA. The factory-flashing workflow erases phone data. Use the correct installation instructions and protect your data before replacing the operating system. Do not attempt to use this Android 16 release to downgrade an Android 17 device.
What has been confirmed.
01Build identity and security-patch label
PX9: build 20261109000428, Android 16 / SDK 36, Caiman. PX7: build 20261109000429, Android 16 / SDK 36, Panther. These identifiers distinguish the actual release artifacts from app version numbers.
The release artifacts report Android security patch level June 1, 2026. This announcement does not describe that as the current Android security patch level.
02Packaging, signing and device-test scope
The PX9 release passed factory and OTA signature checks, production-key AVB verification and application-content checks. A factory installation booted on the PX9, and SecuSUITE reached activation and remained open.
The PX7 build completed compilation and app-content packaging, and its factory-package signature has been verified. No PX7 handset was available for manual testing; this rollout uses the PX9 test evidence together with device-specific Panther artifact verification. Panther runtime behavior has not been manually tested on a PX7 handset.
The launch test did not exercise SecuSUITE account activation, secure calls or messaging. Real two-phone PTT operation, provisioned enterprise services, external instruments and every Assistant/Mission workflow have not all been established by that test. Feature descriptions identify software workflows and their dependencies, not blanket end-to-end certification.
03Services, permissions and third-party applications
Each app retains its own permissions, service requirements and applicable terms. A preinstalled APK is not a service subscription. Network catalogues, mail, cloud storage, maps, weather, enterprise services and communications may require connectivity, an account, downloaded data or additional provisioning.
Signal strength, model output and names advertised by other devices do not authenticate identity or prove intent. Mission’s bundled structured-report profile is for local exercise use; standards conformance and classified-environment suitability must be evaluated for the exact deployed solution.
