About the new private spaces feature in AOSP 15, just how much separated is it from the main user? Unfortunately official documentation of the feature seems a bit sparse, but I imagine those involved in the GrapheneOS project knows pretty well how the feature works, so I ask here.

If I have understood it correctly, the private space can have an always-on VPN set up even if the main user does not have any VPN, and all apps in the private space will run through this VPN. And apps in the main user cannot even detect the private space uses a VPN. Correct?

And the private space will have its own app data and file storage separate from the main user, just like on secondary user profiles, such that even if an app in either the main user or the private space is granted all storage permissions there are, they cannot see or access files from the other in any capacity, even when the private space is unlocked. Correct?

But the documentation says sharesheet, file picker and docui can see files between the main user and private space. What is sharesheet and docui? Are they part of GrapheneOS? And how is file sharing between main user and private space implemented for the file picker? What process has privileges enough to copy the file between the profiles and how is this done? I am just trying to understand how separated file access really is. Are there any other means to transfer files between main user and private space?

Are storage for the private space encrypted separately from the main user, such that if the private space hasn't been unlocked since device start, the files are at rest to the same strong degree as for secondary users? All screenshots show unlocking is by fingerprint. Does this mean there is no separate encryption passphrase for the private space? On GrapheneOS, what unlock options will be available for the private space?

The official documentation says apps between main profile and private space cannot see each other when the private space is locked. But to what degree can they see each other when private space is unlocked? Is IPC between main user and private space allowed in any capacity at all, or are they as separated as for secondary users? If IPC is allowed at all, what kinds of IPC and when?

When the phone is plugged in into a computer, how does one control whether main user storage or private space storage is shared with the computer?

Does notifications work in private space? Are notifications from main user and private space shown together the same, like they originated from the same user? Unlike for secondary users where content is hidden, if notifications are propagated at all?

Does private space have access to telephony to any degree at all, or is all that handled by the main profile? Do they share contacts?

I hope some clarity about this feature can be provided, in the context of GrapheneOS, since I am seriously considering redoing my phone setup to use private spaces, since it sounds like it would be way more convenient with telephony and notifications and app switching, while providing similar isolation as secondary users. But I just want to be sure just what weakening of security there is, if any, before I can make a choice.