AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
2026-09-16 21:56:22 +00:00
commit 12d2179c20
@@ -0,0 +1,68 @@
+# Runbook: `008` call-rec + FLAG_SECURE (LAB)
+
+**LAB serial**: `11231JEC207477` only — never GOLDEN.  
+**Apply** (on `rom-dev01`):
+
+```bash
+python3 /srv/rom/src/lineage/vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py
+```
+
+Idempotent (second run = all “already”). Marker:
+`SUNFISH_A16_008_CALL_REC_FLAG_SECURE`.
+
+**Evidence**: `/srv/rom/artifacts/008-call-rec-flag-secure/`  
+**Logs**: `/srv/rom/logs/008-build/`  
+**Backups**: `/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots/`
+
+## Secure keys
+
+| Key | Default | Source |
+|-----|---------|--------|
+| `extendrom_call_recording` | `0` | AXP GOLDEN / EXTENDROM (`ER_ALLOW_ANY_CALL_REC`) |
+| `disable_secure_windows` | `0` | AOSP A16 `Settings.Secure.DISABLE_SECURE_WINDOWS` (DO UI key `allow_flag_secure_override`) |
+
+GOLDEN dump: `extendrom_call_recording=1` in
+`.local-artifacts/002-golden/…/settings/secure-*.txt`.
+
+## Call-rec — EXTENDROM `F_CALLREC` (applied)
+
+| Step | LOS 23.2 path | Status |
+|------|---------------|--------|
+| Dialer config | `packages/apps/Dialer/.../callrecord/res/values/config.xml` | already `enabled=true`, audio `4` |
+| Controllers | `Settings/.../ER_CallRecPreferenceController.java` + `ER_CallRecInfo.java` | applied |
+| Dashboard | `DevelopmentSettingsDashboardFragment.java` | applied |
+| DO XML | `Settings/res/xml/development_settings.xml` | applied |
+| Strings | `Settings/res/values/strings.xml` | applied |
+| Secure const | `frameworks/base/.../Settings.java` `ER_ALLOW_ANY_CALL_REC` | applied |
+| Dialer gate | `Dialer/.../CallRecorder.java` `canRecordInCurrentCountry` | applied |
+
+## FLAG_SECURE — A16 inventory (applied via DO only)
+
+AOSP already implements the capture path:
+
+- `WindowState.isSecureLocked()` → early false if
+  `mWmService.getDisableSecureWindows()`
+- `WindowManagerService.updateDisableSecureWindows()` reads
+  `Settings.Secure.DISABLE_SECURE_WINDOWS`
+- **Only when** `ro.debuggable` / `SYSTEM_DEBUGGABLE` is true (LAB
+  `userdebug` OK; `user` needs retest / possible gate lift later)
+
+Project work: Settings DO writes that Secure key (no Magisk / no jar patcher).
+
+## Validation
+
+See `specs/008-call-rec-flag-secure/quickstart.md`.
+
+After bacon + flash Magisk-free:
+
+```bash
+adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
+adb -s 11231JEC207477 shell settings get secure disable_secure_windows
+```
+
+## `user` vs `userdebug`
+
+LAB = `userdebug` (DO + WMS secure-windows disable active). Before release
+(`011`), re-check on `user`: DO visibility (like `005`) and whether
+`updateDisableSecureWindows` still no-ops when not debuggable — document
+outcome; do not silently claim `user` PASS.