Matthai I wonder how does it look for end user when GrapheneOS detect phone tampering? Are there any screenschoots to demonstrate that?
The primary tampering check is done at boot time, when the bootloader checks the signature on the system partition. Rebooting should show a yellow indication about booting "a different operating system", and the displayed signing-key hash should match what's on the GrapheneOS web site.
If something goes wrong at that stage a red "corrupt" message will be displayed.