AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

docs/hardening-backlog.md

@@ -0,0 +1,119 @@
+# Hardening backlog (non-normative)
+
+Candidate hardening ideas for later evaluation. **Not requirements** until a row
+is promoted into an active feature `spec.md` (`012` / `013` or related).
+
+Authority order for an active feature:
+
+1. Constitution
+2. That feature's `spec.md`
+3. This backlog / `docs/axp-pro-parity.md` (hints only)
+
+Status: `candidate` | `investigate` | `accepted→spec` | `rejected` | `los-provides`
+
+## Privacy / identifiers
+
+| Idea | Notes | Status |
+|------|-------|--------|
+| SUPL IMSI/MSISDN exposure | Reduce carrier ID leakage via SUPL | candidate |
+| Build.SERIAL restrictions | Identifier privacy | candidate |
+| Analytics / statistics removal | Drop unused telemetry | candidate |
+| Package query visibility | Tighten package visibility | candidate |
+| MAC / address privacy | Wi-Fi/BT randomization policy | candidate |
+| Private DNS defaults | Sensible defaults without breaking banks | candidate |
+| CA-store review | Trust anchors audit | candidate |
+
+## Userspace
+
+| Idea | Notes | Status |
+|------|-------|--------|
+| hardened_malloc | Graphene/AXP portability on sunfish | candidate |
+| Bionic hardening | Selective, attributable | candidate |
+| JNI protections | Safer JNI boundaries | candidate |
+| Stack canaries | Confirm / strengthen where applicable | candidate |
+| ptrace / Yama | Restrict debugging attach | candidate |
+| seccomp | Incremental filter improvements | candidate |
+| noexec / nosuid / nodev mounts | Where applicable without breaking HW | candidate |
+| Dynamic code / JIT restrictions | Evaluate app compatibility cost | candidate |
+| Exec spawning / ASLR-related | Attack-surface reduction | candidate |
+
+## Kernel
+
+| Idea | Notes | Status |
+|------|-------|--------|
+| Historical GrapheneOS sunfish kernel patches/config | Device-specific commits **and** config known to have run on sunfish — not CONFIG-only review | candidate |
+| Modern GrapheneOS kernel techniques | Evaluate equivalent/backport on sunfish 4.14; no blind cherry-picks | candidate |
+| AXP/DivestOS sunfish kernel patch audit | Identify AXP-owned vs inherited vs upstream; de-duplicate against LOS | candidate |
+| Applicable CVE backports | Document EOL firmware vs patchable kernel | candidate |
+| CFI | Feasibility on 4.14 | candidate |
+| ASLR config | Kernel/userspace related knobs | candidate |
+| IPv6 privacy | Address generation / exposure | candidate |
+| Debug / UART restrictions | Reduce attack surface | candidate |
+| Attack-surface reduction | Drop unused drivers/configs carefully | candidate |
+
+## Kernel hardening source policy
+
+The kernel base remains the LineageOS 23.2-compatible sunfish kernel.
+
+```text
+                         ┌─ historical GOS sunfish
+                         │
+LOS23/A16 sunfish 4.14 ←─┼─ AXP own + DivestOS
+      OUR BASE           │
+                         ├─ modern GOS techniques
+                         │
+                         └─ original upstream fixes
+```
+
+**Not:** GrapheneOS Android 13 (or any old GrapheneOS) kernel tree as our base.
+
+Candidate hardening comes from four classes:
+
+1. **Historical GrapheneOS sunfish** — device-specific patches/configuration known
+   to have run on sunfish (real commits, not only `.config`).
+2. **AXP.OS / DivestOS sunfish** — audit the actual patch stack; distinguish
+   AXP-owned changes from inherited changes.
+3. **Modern GrapheneOS** — use current kernel hardening as a source of
+   techniques/security properties; adapt/backport only where feasible on
+   non-GKI Linux 4.14; do not assume current Pixel kernel patches cherry-pick
+   cleanly.
+4. **Original upstream** — where a GrapheneOS/AXP/Divest patch derives from AOSP,
+   Android common, Linux stable, or another upstream source, prefer the
+   appropriate original upstream fix when practical.
+
+For each candidate record:
+
+- security problem / property;
+- original source and commit;
+- source lineage / provenance;
+- sunfish-specific or generic;
+- already present in LOS 23.2?;
+- already present through another patch?;
+- kernel/hardware prerequisites;
+- applicability to Linux 4.14;
+- port/backport required;
+- compatibility/regression risk;
+- test result;
+- final decision.
+
+## Much later / evaluate
+
+| Idea | Notes | Status |
+|------|-------|--------|
+| Per-app network control | High UX/complexity | candidate |
+| Sensors permission model | Graphene-like | candidate |
+| Storage Scopes-like behaviour | Compatibility cost | candidate |
+| Contact Scopes-like behaviour | Compatibility cost | candidate |
+| Duress PIN/password | Later | candidate |
+| USB restrictions | Policy toggles | candidate |
+| Exploit-protection toggles | User-facing switches | candidate |
+| Modernize LOS API deprecations / Kotlin annotation targets | **Final-ROM hygiene (last steps)**, not a mid-feature gate. Measured on `005` bacon 2026-09-15 SUCCESS (~45k log lines): ~3k deprecated, ~4.5k KT-73255 annotation-target, ~8.7k “warning” hits total; **0** hard `error:`/`FAILED:` in successful run. Themes: Settings Slices `[removal]`; SystemUI KeyguardState/SceneContainer/CommunalScenes; DesktopMode desk APIs; `FingerprintManager`/`Executors`; SettingsLib `@StringRes` KT-73255. Fix **API-by-API** with attributable ports; never megapatch or `-Xlint:-deprecation` as “done”. Prefer waiting for LOS merges; only port what still warns at freeze. Own patches (`005` spoofing, vendor) must stay clean first. Evidence: `/srv/rom/artifacts/005-spoofing/20260915-bacon/bacon-log-triage.md`. | candidate |
+
+## EOL firmware caveat (for `013`)
+
+sunfish is EOL. The project can modify kernel/framework we build, but cannot
+fabricate new proprietary vendor/modem firmware. Document clearly:
+
+- security patches we can backport in-tree;
+- old proprietary firmware/baseband/vendor images we **cannot** fix;
+- do not claim hardware protections unsupported by Pixel 4a.