[Moto X4 ROMs, Kernels, Recoveries, & Other Develop] gee one:
[MENTION=8712221]tgwitmodt[/MENTION] Thanks catching the OTA!

I had a look a the OTA file and it is quite different than what I am used to seeing for nougat roms.

~/moto4x$ ls -l
total 185664
-rw-r--r-- 1 95031216 Nov 10 17:10 Blur_Version.26.51.1.payton_fi.google_fi.en.US.zip
-rw-r--r-- 1 54688 Jan 1 2009 care_map.txt
-rw-r--r-- 1 465 Jan 1 2009 metadata.json
drwxr-xr-x 3 4096 Nov 10 17:11 META-INF
-rw-r--r-- 1 95007612 Jan 1 2009 payload.bin
-rw-r--r-- 1 154 Jan 1 2009 payload_properties.txt

It looks like the system will grab whatever is in payload.bin and care_map.txt to update one of the A/B partitions. I was expecting to find an updater_script in the META-INF folder, but that is not there.

from META-INF/com/android/metadata

ota-required-cache=0
ota-type=AB
post-build=motorola/payton_fi/payton_sprout:7.1.1/NPW26.83-41/47:user/release-keys
post-build-incremental=47
post-timestamp=1508499987
pre-build=motorola/payton_fi/payton_sprout:7.1.1/NPW26.83-34-0-1/1:user/release-keys
pre-build-incremental=1
pre-device=payton_sprout

There is also an otacert there too, which seems to be signed by motorola, not google.

Certificate:
Data:
Version: 3 (0x2)
Serial Number: 7557 (0x1d85)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, ST = Illinois, L = Libertyville, O = Motorola, OU = MDb, CN = MAP4 OTA 466-6
Validity
Not Before: Feb 16 22:34:26 2017 GMT
Not After : Feb 16 22:34:26 2042 GMT
Subject: C = US, ST = Illinois, L = Chicago, O = Lenovo, OU = Motorola, CN = MAP4 OTA 466-6-199
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:c8:d1:28:7c:80:9e:c3:03:1c:59:c7:2a:58:ae:
f1:57:e9:d0:21:7b:97:a2:0d:a0:57:c8:0b:6f:46:
b6:f7:df:c2:89:2e:9a:e7:79:5a:28:bf:e8:b8:5a:
e4:4a:91:da:46:0a:bf:66:15:3a:99:61:be:a4:2f:
0f:51:0c:92:bc:5c:6f:f1:f8:eb:92:7d:a9:52:ad:
f5:f4:6d:a1:a3:15:d0:e2:ac:e0:11:e5:fb:53:77:
16:14:72:c5:2d:d6:f8:e5:4b:2f:01:35:cd:a6:17:
9c:14:cf:4c:7a:80:f2:72:16:e6:d7:35:43:d2:cf:
4d:f0:cd:0c:87:0d:41:dd:f2:4d:8b:54:8c:61:3d:
33:f1:77:e7:15:33:4f:50:09:74:29:65:0e:2e:b1:
46:17:b2:de:34:2d:bf:b1:19:3c:72:c8:e4:7b:91:
f0:c3:8a:45:d3:ff:14:7b:dc:a6:cf:84:9f:84:14:
3a:18:ca:15:1f:b4:9a:1c:46:89:d4:65:c1:16:16:
c5:ff:ef:f6:d1:ba:a8:e9:a8:78:08:38:fe:c7:e6:
03:71:2c:d9:89:76:d9:5f:ee:52:2a:d5:b8:21:4b:
6a:eb:f1:0b:42:d5:de:c9:c9:84:11:cf:10:ff:d5:
b4:22:a9:29:b7:f9:44:d5:7e:c1:f7:e0:58:c7:fd:
b0:b3
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:B6:40:F6:EE:91:02:B8:8D:AA:34:50:B1:3E:F2:5F:C9:EB:14:3D:63

Netscape Cert Type:
Object Signing
X509v3 Key Usage: critical
Digital Signature, Non Repudiation, Key Encipherment
X509v3 Extended Key Usage:
Code Signing
Signature Algorithm: sha256WithRSAEncryption
04:7a:13:fa:97:04:1f:5e:cf:9e:19:61:62:c0:70:53:f1:c4:
0b:3e:5d:2e:5e:14:39:19:fb:cc:b3:5b:fe:19:cc:2c:40:14:
ef:33:6d:25:a6:e1:a8:83:30:05:32:3c:d7:25:a9:ac:02:0f:
64:e5:a9:d0:3d:22:39:eb:17:10:5e:e8:f1:df:8f:a6:b2:fc:
66:ee:f0:be:d9:7f:89:d9:ac:91:67:ef:86:58:92:93:97:c2:
d0:7c:bd:8c:d4:a0:92:37:0e:87:50:9f:73:9e:a4:ed:b0:dc:
be:fd:d8:5d:fa:04:ff:1b:2f:c5:f1:73:d0:a7:78:76:2e:bf:
44:0e:63:5a:bc:4d:5e:5b:94:a3:6a:56:3a:44:93:0f:dc:c4:
c3:b9:f6:9f:a0:0c:6c:2b:f9:e9:b7:33:07:91:19:c0:16:3c:
54:5e:9c:27:3f:c6:fe:ac:db:8b:b9:31:f9:f1:ff:02:01:a3:
3a:52:82:6f:e8:fa:a8:41:67:a9:d2:5f:28:46:84:de:2f:58:
a8:d3:ab:43:3a:96:af:1a:90:f0:36:8f:20:49:aa:b3:0e:d8:
e9:af:41:77:08:35:ef:0f:a5:5b:5e:ee:16:1e:77:99:d9:15:
3e:37:93:79:46:2d:cd:65:db:ba:b0:c7:56:ee:60:2c:a1:5c:
b0:aa:68:ea

I'll have to see if there is an updater in the oreo build tree. From my understanding, with the A/B partitions, the OS will update which ever system isn't booted. When you reboot, it will choose the updated partition. I wonder if it is possible to install a recovery into the B partition and just force normal boots into the A partition? It seems like there are fastboot commands to choose the A/B partition, but I'm not sure if the updater checks to make sure they are in sync.

more research...

edit: I forgot to show this file -payload_properties.txt. The nougat updater script would hash the target files to make sure they were compatible with the incremental update. The only verification that I see are the pre-build and post-build fingerprints in the metadata file.

FILE_HASH=6wDPQpwCnS5IHbcEBV5yk/6gWErUmhHGsqYlMaS/Zeo=
FILE_SIZE=95007612
METADATA_HASH=OXzw2BFfjyXM5ltGami1bmUR0ObYrKv7DetxtTIOwYw=
METADATA_SIZE=892901