AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

docs/005-spoofing-runbook.md

@@ -0,0 +1,92 @@
+# 005 — Restricted signature spoofing runbook
+
+**Feature**: `005-restricted-signature-spoofing`  
+**LAB only**: serial `11231JEC207477` — never GOLDEN  
+**Host**: `rom-dev01` under `/srv/rom/`
+
+## What we discovered (2026-09-15)
+
+LineageOS 23.2 **already** ships restricted microG spoofing
+(`frameworks/base` commit `23c0a5c19844`, LuK1337):
+
+| Gate | Stock LOS behaviour |
+|------|---------------------|
+| Build | `userdebug`/`eng` only (`isDebuggable()` JNI) |
+| Packages | `com.google.android.gms`, `com.android.vending` only |
+| Signer | Must match **microG release** cert (`MICROG_REAL_SIGNATURE`) |
+| Fake value | Must equal platform Google cert (`MICROG_FAKE_SIGNATURE`) |
+| Surfaces | Spoofs both `PackageInfo.signatures` and `signingInfo` |
+
+Gaps vs our stack / AXP UX:
+
+1. **Our Phonesky** is signed with the **project JKS**, not microG — stock
+   gate rejected it → Play `UNREGISTERED_ON_API_CONSOLE`.
+2. No `FAKE_PACKAGE_SIGNATURE` permission → microG Self-Check permission rows
+   empty.
+3. No Developer Options master switch (`allow_signature_fake`).
+
+## What we applied
+
+Script (idempotent, marker `SUNFISH_A16_005_SIGSPOOF`):
+
+- Meta: `vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py`
+- Host copy: `/srv/rom/src/lineage/vendor/sunfish-a16/patches/005-sigspoof/`
+- References: `/srv/rom/references/extendrom` @ `f129253c…`
+- Cert hex: `/srv/rom/artifacts/005-spoofing/phonesky-cert.hex`
+  (SHA-256 `31:31:86:CB:…:BD:56`)
+
+Changes on the LOS tree:
+
+1. Extend `isMicrogSigned()` to accept **project Phonesky** signer for
+   `com.android.vending`.
+2. Gate spoofing on `Settings.Secure.allow_signature_fake` (default **0**).
+3. Require grant of `android.permission.FAKE_PACKAGE_SIGNATURE`.
+4. Port EXTENDROM permission + Settings Developer Options toggle + strings.
+5. Keep packaging leftovers: `LOCAL_REPLACE_PREBUILT_APK_INSTALLED` + Play FGS
+   privapp XML (already in `vendor/sunfish-a16/`).
+
+**LAB 2026-09-15 post-flash:** Self-Check / spoofing / no
+`UNREGISTERED_ON_API_CONSOLE` OK. Play install failures / ANR: `DownloadService`
+/`VpaService` FGS `systemExempted` needs **any of** `SCHEDULE_EXACT_ALARM` /
+`USE_EXACT_ALARM` / VPN — privapp alone is not enough if the APK does not
+**request** those permissions.
+
+**Fix (2026-09-15):** Phonesky rebuild adds `USE_EXACT_ALARM` +
+`SCHEDULE_EXACT_ALARM` to the manifest; artifact
+`/srv/rom/artifacts/005-spoofing/Phonesky_exact-alarm.apk`; pushed to LAB via
+`adb install -r` (same project JKS); vendor prebuilt updated under
+`/srv/rom/src/lineage/vendor/sunfish-a16/prebuilt/Phonesky.apk` for next bacon.
+`USE_EXACT_ALARM: granted=true` on LAB after upgrade.
+
+Re-apply after `repo sync` that resets frameworks/Settings:
+
+```bash
+python3 /srv/rom/src/lineage/vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py
+```
+
+Backups: `/srv/rom/artifacts/005-spoofing/bak-snapshots/` (never leave
+`*.005.bak` under `res/` — aapt2 will fail).
+
+## LAB validation (US6 — 2026-09-15)
+
+Accepted on LAB `11231JEC207477` / build `23.2-20260915-UNOFFICIAL-sunfish`.
+Evidence: `/srv/rom/artifacts/005-spoofing/20260915-us6-validation/LAB-US6.txt`.
+
+1. ~~Flash LAB; `pm path` gms / gsf / vending~~ — pass  
+2. ~~Allow signature spoofing~~ — `allow_signature_fake=1`  
+3. ~~Self-Check correct signature~~ — pass (grant on user 0 + Island 10)  
+4. ~~Play sign-in / installs~~ — pass after exact-alarm Phonesky; no `UNREGISTERED_ON_API_CONSOLE`  
+5. Location: configure BeaconDB `https://api.beacondb.net` (no UnifiedNlp) — steps in
+   `docs/004-lab-selfcheck.md` + `quickstart.md`
+
+```bash
+adb -s 11231JEC207477 shell settings get secure allow_signature_fake
+# expect 1 when enabled
+```
+
+**Handoff:** first stack done → next feature **`006` banking rootless**. Do **not**
+add KernelSU/`007` until after `006`.
+
+## Out of scope
+
+- Banking apps (`006`), KSU/root (`007`), Magisk/LSPosed.