AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
2026-09-16 21:56:22 +00:00
commit 12d2179c20
@@ -0,0 +1,365 @@
+# Reference sources — LineageOS, AXP.OS, GrapheneOS (sunfish only)
+
+Project documentation consolidating where sources live, what role they play, what
+is already archived locally, and what to execute later on `rom-dev01`.
+
+**Scope: Google Pixel 4a (`sunfish`) only.** Do not plan or archive unrelated
+devices (other Pixels, OnePlus, Fairphone, Sony, …).
+
+```text
+LineageOS 23.2 / Android 16     → AUTHORITATIVE CURRENT BASE (build from this)
+AXP.OS 22.2 / Android 15        → GOLDEN / functional reference (live device + selective archive)
+GrapheneOS Android 13 sunfish   → HISTORICAL hardening reference (selective archive)
+```
+
+Do **not** execute server archive/download/build commands from this file until
+`rom-dev01` exists. Do **not** treat this as work on frozen feature `001`.
+
+Detailed AXP hosting probes, Tor/download URLs, and Forgejo inventory commands:
+[`axp-sunfish-preservation.md`](axp-sunfish-preservation.md).
+
+Device roles (GOLDEN vs LAB): [`device-roles.md`](device-roles.md).
+
+---
+
+## Classification legend
+
+| Label | Meaning |
+|-------|---------|
+| **AUTHORITATIVE CURRENT SOURCE** | Use for builds / official current truth |
+| **HISTORICAL REFERENCE** | Study/port only; not the build base |
+| **LOCAL ARCHIVE** | Copy under `/srv/rom/references/…` or laptop path |
+| **UNAVAILABLE / PRIVATE** | Do not scrape or bypass access controls |
+| **TO BE EXECUTED LATER ON rom-dev01** | Commands/actions deferred until host is ready |
+
+---
+
+## Target layout on rom-dev01
+
+```text
+/srv/rom/references/
+├── axp/
+│   ├── archive/          # see axp-sunfish-preservation.md
+│   ├── manifests/        # sunfish A15 selection / versioning notes
+│   └── README.md
+├── lineage/
+│   ├── manifests/        # repo manifest -r snapshots (reproducibility)
+│   └── README.md
+└── grapheneos/
+    ├── mirrors/          # selective bare clones only
+    ├── manifests/
+    ├── metadata/
+    └── README.md
+```
+
+Plus the normal **build checkout** (not an “archive”):
+
+```text
+/srv/rom/src/lineage-23.2/    # full Lineage tree used to compile (feature 003+)
+```
+
+---
+
+# 1. LineageOS 23.2 / Android 16 — BASE
+
+## Role
+
+**AUTHORITATIVE CURRENT SOURCE** for the ROM. Compiling = syncing and building
+this tree for sunfish. No need for a redundant mass mirror of the entire
+LineageOS GitHub organization.
+
+## Authoritative URLs
+
+| Item | URL | Class |
+|------|-----|--------|
+| Android / repo umbrella | https://github.com/LineageOS/android | AUTHORITATIVE CURRENT |
+| Device sunfish | https://github.com/LineageOS/android_device_google_sunfish | AUTHORITATIVE CURRENT |
+| Kernel msm-4.14 | https://github.com/LineageOS/android_kernel_google_msm-4.14 | AUTHORITATIVE CURRENT |
+| Wiki device page | https://wiki.lineageos.org/devices/sunfish/ | AUTHORITATIVE CURRENT (verify against repos) |
+
+**Note:** Indexed/cached wiki install pages may still mention older branches
+(e.g. 22.2). For branch and source tree truth, trust **current GitHub branches /
+official `repo init`**, not a stale wiki cache. As of project research,
+`android_device_google_sunfish` and `android_kernel_google_msm-4.14` expose
+**`lineage-23.2`**.
+
+## Official source init
+
+```bash
+repo init \
+  -u https://github.com/LineageOS/android.git \
+  -b lineage-23.2 \
+  --git-lfs
+
+repo sync
+```
+
+(Exact path on host: e.g. `/srv/rom/src/lineage-23.2` — set during `003`.)
+
+## What to preserve locally (not a full org archive)
+
+**TO BE EXECUTED LATER ON rom-dev01** after syncs/builds:
+
+```bash
+mkdir -p /srv/rom/references/lineage/manifests
+
+cd /srv/rom/src/lineage-23.2   # or actual checkout path
+
+# After first successful sync:
+repo manifest -r \
+  -o /srv/rom/references/lineage/manifests/lineage-23.2-initial.xml
+
+# After first known-good vanilla sunfish boot/build:
+repo manifest -r \
+  -o /srv/rom/references/lineage/manifests/lineage-23.2-sunfish-vanilla-known-good.xml
+```
+
+Also keep short README under `/srv/rom/references/lineage/README.md` with:
+
+- `repo init` command used
+- date / host
+- pointer to known-good images under `/srv/rom/artifacts/` (hashes)
+
+## Explicitly out of scope for Lineage “archive”
+
+- `git clone --mirror` of hundreds of LineageOS repos “just in case”
+- Mirroring unrelated device trees
+
+The build checkout **is** the working copy; revision-locked manifests are the
+reproducibility archive.
+
+---
+
+# 2. AXP.OS 22.2 / Android 15 — GOLDEN / functional reference
+
+## Role
+
+**HISTORICAL + FUNCTIONAL REFERENCE** (and live GOLDEN device). Not the build
+base. Infrastructure risk is higher (self-hosted pieces may vanish) → selective
+archive matters more than for Lineage.
+
+Full operational cookbook: [`axp-sunfish-preservation.md`](axp-sunfish-preservation.md).
+
+## Source classes
+
+| Source | Class | Notes |
+|--------|-------|--------|
+| GOLDEN phone (AXP 22.2 / A15) | AUTHORITATIVE CURRENT *for behaviour* | Live `adb`; do not flash |
+| https://axpos.org (docs/news/devices) | AUTHORITATIVE CURRENT *docs* (while up) | Hosted via Codeberg |
+| https://git.disroot.org/AXP.OS | AUTHORITATIVE CURRENT *public git* | Main public mirror (~225 repos; **do not clone all**) |
+| https://codeberg.org/AXP-OS | HISTORICAL / PARTIAL | Website git + fewer repos after Jan 2026 removals |
+| https://github.com/AXP-OS | AUTHORITATIVE for some **APK/releases** | Lower priority mirror |
+| https://code.binbash.rocks/AXP.OS | UNAVAILABLE / PRIVATE anonymously | Alive; no anonymous repo list; do not bypass |
+| https://download.axpos.org/…/sunfish/ | AUTHORITATIVE downloads (when reachable) | Probe exact paths |
+| Tor onion `:8008` | FALLBACK downloads | See preservation doc |
+| `leech.binbash.rocks` | UNAVAILABLE (2026-08-09 probes) | Legacy |
+
+## Sunfish-only archive criteria
+
+Preserve/reference **only**:
+
+- documentation/web useful to the project  
+- `android_device_google_sunfish`, `android_kernel_google_msm-4.14`  
+- manifests / `axp_versioning` needed to identify exact AXP sunfish revisions  
+- common repos **only when** they contain AXP changes applicable to sunfish
+  (e.g. frameworks/base, Settings, build/config, microG/spoofing, Phonesky,
+  callrec, FLAG_SECURE, hardening) — **selected via sunfish A15 manifests**,
+  not by cloning the whole org  
+- sunfish Pro/Slim builds, recovery, factory, `.prop`, checksums, public keys
+  where recoverable  
+
+**Discarded:** full Disroot “225 repos / ~48 GiB Git” org mirror as a project
+goal.
+
+## LOCAL ARCHIVE (laptop today)
+
+```text
+~/Archives/AXP.OS/
+  website-rendered/
+  codeberg/                 # ~14 repos / ~38 GiB; LFS gaps in legacy_prebuilt_apps
+  disroot-repositories.jsonl
+  mirror-forgejo-org.sh
+  …
+```
+
+## TO BE EXECUTED LATER ON rom-dev01
+
+1. rsync laptop archive → `/srv/rom/references/axp/archive/`  
+2. `df` preflight (must not steal LOS/`out`/ccache space)  
+3. Refresh website / selected Disroot mirrors via **manifest-driven** selection  
+4. Probe/download sunfish Pro/Slim artifacts if hosts allow  
+5. Never attempt private binbash access  
+
+See [`axp-sunfish-preservation.md`](axp-sunfish-preservation.md) for commands.
+
+---
+
+# 3. GrapheneOS — Android 13 sunfish (historical hardening)
+
+## Role
+
+**HISTORICAL REFERENCE** for hardening techniques/patches that once ran on
+sunfish. **Not** the ROM base. Official project: sunfish **unsupported**; old
+trees moved toward **GrapheneOS-Archive**.
+
+Confirms project rule: GrapheneOS sunfish = **A13 history**, never A16 base.
+
+## Authoritative / archive URLs
+
+| Item | URL | Class |
+|------|-----|--------|
+| Current GrapheneOS orgs | https://github.com/GrapheneOS | AUTHORITATIVE CURRENT (active devices) |
+| Platform manifest (current) | https://github.com/GrapheneOS/platform_manifest | AUTHORITATIVE CURRENT |
+| Official historical archive org | https://github.com/GrapheneOS-Archive | HISTORICAL REFERENCE |
+| sunfish device (archived) | https://github.com/GrapheneOS-Archive/device_google_sunfish | HISTORICAL — archive/read-only (e.g. since 2025-12-04); branch **13** |
+| Releases / changelog | https://grapheneos.org/releases | AUTHORITATIVE for release history (A13 era mentions Pixel 4a) |
+| FAQ | https://grapheneos.org/faq | AUTHORITATIVE docs |
+| Example reorganized tree | `GrapheneOS-Archive/platform_frameworks_base-old` (read-only) | HISTORICAL — illustrates repo moves |
+
+**Do not** mirror all ~244 repos in GrapheneOS-Archive.
+
+## Selection rule (same spirit as AXP)
+
+1. From last sunfish **Android 13** GrapheneOS manifests/tags, list repos/commits
+   that carried GrapheneOS deltas relevant to sunfish.  
+2. Mirror **only** those (plus `device_google_sunfish` + useful manifests).  
+3. Likely candidates after proof: frameworks, system/core, SELinux, malloc,
+   kernel/configs, etc. — **only if** tied to sunfish A13 lineage.  
+4. Record provenance; port carefully to LOS 23.2 / 4.14 (see constitution /
+   `docs/hardening-backlog.md`).
+
+## TO BE EXECUTED LATER ON rom-dev01 (minimum seed)
+
+```bash
+mkdir -p /srv/rom/references/grapheneos/{mirrors,manifests,metadata}
+
+git clone --mirror \
+  https://github.com/GrapheneOS-Archive/device_google_sunfish.git \
+  /srv/rom/references/grapheneos/mirrors/device_google_sunfish.git
+
+git clone --mirror \
+  https://github.com/GrapheneOS/platform_manifest.git \
+  /srv/rom/references/grapheneos/mirrors/platform_manifest.git
+
+git --git-dir=/srv/rom/references/grapheneos/mirrors/device_google_sunfish.git fsck --full
+git --git-dir=/srv/rom/references/grapheneos/mirrors/device_google_sunfish.git show-ref
+```
+
+Then expand selectively from A13 sunfish manifests/tags — not the whole Archive
+org.
+
+## LOCAL ARCHIVE
+
+No complete GrapheneOS sunfish archive is assumed on the laptop yet (unlike
+AXP). Seed mirrors are **TO BE EXECUTED LATER ON rom-dev01**.
+
+---
+
+# 4. Conceptual comparison
+
+| | LineageOS | AXP.OS | GrapheneOS (sunfish) |
+|--|-----------|--------|----------------------|
+| Android | 16 (23.2) | 15 (22.2) | 13 (last) |
+| Role | **BASE** | **GOLDEN / functional** | **Hardening history** |
+| Full tree checkout | Yes (to build) | No (selective) | No (selective) |
+| Mass org mirror | No | No | No |
+| Key local artifact | `repo manifest -r` XML | web + sunfish repos + images | device_sunfish + selected A13 repos |
+| Urgency | Low (GitHub active) | Higher (self-host risk) | Medium (already moving to Archive) |
+
+---
+
+# 5. Shared porting discipline
+
+For **any** AXP or GrapheneOS candidate change:
+
+1. Identify source repo + tag/branch/build (sunfish-relevant)  
+2. Identify corresponding LOS 23.2 / AOSP base  
+3. Inspect full diff  
+4. Classify: direct / port / obsolete / superseded / A16- or 4.14-incompatible  
+5. Deduplicate vs LOS / the other reference  
+6. One logical change; build; test on **LAB** only  
+
+---
+
+# 6. Execution status checklist
+
+| Item | Status |
+|------|--------|
+| Document Lineage URLs + manifest `-r` strategy | Done (this file) |
+| Document AXP sunfish-scoped preservation | Done (`axp-sunfish-preservation.md` + this file) |
+| Document GrapheneOS Archive sunfish strategy | Done (this file) |
+| Laptop AXP archive under `~/Archives/AXP.OS/` | Exists (operator); rsync later |
+| rom-dev01 AXP/Lineage/GOS archives | **TO BE EXECUTED LATER** |
+| Lineage full sync / first `manifest -r` | **TO BE EXECUTED LATER** (`003`) |
+| Feature `001` implement | Not started (frozen docs) |
+| Features `002`/`003` | Not started |
+
+---
+
+# 7. Contradictions / pitfalls noted
+
+1. **Wiki vs GitHub for Lineage:** install wiki caches may show 22.2; repos show
+   `lineage-23.2` — trust repos/`repo init`.  
+2. **AXP “~48 GiB Disroot” ≠ required archive size** — that is whole-org Git
+   metadata; project policy is sunfish-selected only.  
+3. **Codeberg AXP archive ≠ complete** — LFS 404s (e.g. `legacy_prebuilt_apps`);
+   keep anyway; do not claim 100% LFS.  
+4. **download.axpos.org `/` timeout ≠ paths dead** — probe `/axp/sunfish/` etc.  
+5. **OTA `/` → 403** does not mean updater API is down.  
+6. **GrapheneOS-Archive growth** — sunfish material is being archived; prefer
+   Archive URLs + manifests over assuming old live GrapheneOS device support.  
+7. **AXP Android version:** GOLDEN is **22.2 / A15**; last GrapheneOS sunfish is
+   **A13** — do not conflate.
+
+---
+
+# 8. Community inspiration (non-base) — LOS + microG + KSU-Next + SusFS
+
+**Not** our ROM base. Useful field report for sunfish banking / root / SusFS.
+
+| Item | Detail |
+|------|--------|
+| Thread | [XDA: UNOFFICIAL sunfish LOS 22.2 + MicroG + KSU-Next + SusFS](https://xdaforums.com/t/rom-unofficial-sunfish-pixel-4a-lineageos-22-2-microg-ksu-next-susfs.4772261/) (torukk) |
+| Ship | LOS **22.2** / A15 + upstream microG + kernel KSU-Next + SusFS |
+| Kernel tree (author) | https://github.com/abu-adm/android_kernel_google_msm-4.14 (branch noted compatible with LOS23 kernel work) |
+| Claims | Revolut / hard banks workable with **spoofed** KSU-Next manager + SusFS + **TrickyStore** + microG “unblock hardware attestation”; integrity landscape changes fast |
+| LOS 23.2 note (forum) | Boot image with SusFS/ReSukiSU flashed onto official LOS 23.2: SusFS works, but ReSukiSU config unstable, heat, sudden reboots vs Magisk |
+| Our use | Inspiration for `006`/`007` (profiles, SusFS, attestation modules on **LAB**). Still build **our** LOS 23.2 vanilla first (`003`), then microG/Phonesky, then KSU-Next. Do **not** adopt as drop-in base; layer AXP/Graphene call-rec / FLAG_SECURE / hardening later as planned |
+
+If iodé/vanilla keep failing Yuh KeyMint/RKP, this thread’s stack (SusFS + TrickyStore + microG HA toggles) is the first **LAB** experiment family to evaluate — after stock factory diagnosis when convenient.
+
+---
+
+# 9. Community inspiration (non-base) — rooted GrapheneOS OTAs
+
+**Not** our ROM base. **Not** for sunfish (EOL; project targets modern supported Pixels).
+
+| Item | Detail |
+|------|--------|
+| Repo | https://github.com/schnatterer/rooted-graphene |
+| Idea | Patch **Magisk** into official GrapheneOS OTAs; keep **AVB + locked bootloader** + root; own OTA channel via [Custota](https://github.com/chenxiaolong/Custota) / GitHub Pages; switch Magisk ↔ rootless by OTA |
+| Tooling of interest | [avbroot](https://github.com/chenxiaolong/avbroot), Custota, signed OTA pipeline |
+| Limits (upstream notes) | Stock Magisk Zygisk broken in this setup → banking detection; optional third-party Magisk fork; **KernelSU hard to integrate** with this Magisk-in-OTA approach |
+| Our use | Inspiration for later **`011`** (project signing / AVB / OTA) and for “locked + root” trade-offs — **not** a Magisk production path (constitution: KernelSU-Next). Do not treat as GrapheneOS-on-sunfish revival |
+
+Contrast with §8 (torukk): that one is **sunfish + KSU-Next + SusFS + LOS**; this one is **modern Graphene + Magisk + locked AVB OTA**. Different lessons for different stages.
+
+---
+
+# 10. Attestation / banking compatibility references
+
+Primary reading when designing `006`/`007` attestation strategy (not sunfish-specific
+fixes by themselves):
+
+| Source | URL | Why keep |
+|--------|-----|----------|
+| GrapheneOS attestation compatibility guide | https://grapheneos.org/articles/attestation-compatibility-guide | Explains **hardware attestation API** vs Play Integrity; `SelfSigned` + whitelist of official GOS verified-boot keys (`attestation.json`); why modern supported Pixels can work with banks that whitelist GOS; sunfish **not** on that key list (EOL) |
+| PrivSec banking apps compat report (issue) | https://github.com/PrivSec-dev/banking-apps-compat-report/issues/509 | Crowdsourced banking/attestation outcomes across ROMs (incl. Graphene); use for comparative evidence, not as a recipe dump |
+
+**Project takeaway:** Yuh/Swissquote working on **supported** GrapheneOS tracks
+whitelist + healthy TEE/AVB on current Pixels. Our sunfish path still needs
+LOS+microG/Phonesky + measured KeyMint/RKP behaviour; GOS docs inform *what*
+apps check, not a drop-in port.
+
+
+