AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/002-axp-reference-capture/contracts/README.md

@@ -0,0 +1,3 @@
+# Contracts: N/A for 002
+
+No HTTP/API contracts. Device observation + documentation only.

specs/002-axp-reference-capture/data-model.md

@@ -0,0 +1,30 @@
+# Data model: 002-axp-reference-capture
+
+Operational entities only (no application domain model).
+
+## DeviceRole
+
+| Field | Notes |
+|-------|-------|
+| role | `GOLDEN` \| `LAB` |
+| serial_or_label | Measured; may be redacted in public docs |
+| bootloader_state | Measured (`fastboot getvar unlocked` / UI) |
+| build_fingerprint | From `getprop` |
+| flash_policy | GOLDEN=forbidden; LAB=allowed |
+
+## GoldenInventory
+
+Essential package/config rows: name, version, cert fingerprint (short), path,
+notes, `re-query` flag.
+
+## BankingFlow
+
+Ordered steps 1–8 from spec; redacted (no passwords/OTPs/PII).
+
+## LabRescueBundle
+
+Factory zip path on host, SHA-256, Google source URL, flash steps, wipe warning.
+
+## ReferenceArchive
+
+Host path `/srv/rom/references/axp/archive/` — sunfish-scoped AXP materials.

specs/002-axp-reference-capture/plan.md

@@ -0,0 +1,112 @@
+# Implementation Plan: AXP.OS GOLDEN reference capture
+
+**Branch**: `002-axp-reference-capture` | **Date**: 2026-09-13 | **Spec**: [spec.md](./spec.md)
+
+**Input**: Feature specification from `/specs/002-axp-reference-capture/spec.md`
+
+## Summary
+
+Identify GOLDEN vs LAB sunfish, write LAB Google factory-image emergency
+rescue, capture essential live GOLDEN AXP inventory + banking flow (redacted),
+and store raw artifacts under `/srv/rom/references/axp/` on `rom-dev01` while
+committing only redacted docs to `sunfish-a16-rom`. Parallel: rsync existing
+laptop AXP archive per `docs/axp-sunfish-preservation.md` (does not replace
+live `adb`).
+
+## Technical Context
+
+**Language/Version**: Bash + `adb`/`fastboot` inventory scripts; Markdown docs
+
+**Primary Dependencies**: OpenSSH to `rom-dev01`; Android platform-tools on
+laptop; optional wget/curl for factory images on host
+
+**Storage**: `/srv/rom/references/axp/` (raw); Git = redacted summaries only
+
+**Testing**: Observational checklists (getprop/dumpsys excerpts); no unit suite
+
+**Target Platform**: Two physical sunfish + `rom-dev01` Ubuntu 24.04
+
+**Project Type**: Device documentation / reference capture
+
+**Performance Goals**: N/A — correctness and non-invention of device facts
+
+**Constraints**: Never flash GOLDEN; no secrets/APKs in Git; NeoBackup not a gate;
+bootloader state measured not assumed; gaps marked “re-query GOLDEN”
+
+**Scale/Scope**: One developer; essential inventory for `004`–`006` hard-gates
+
+## Constitution Check
+
+*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
+
+- Independence from SSYSTEMS: yes (Gitea/host paths only)
+- GOLDEN do-not-flash: enforced in docs + FR-006
+- No Magisk-as-production-path invention: Magisk recorded as GOLDEN oracle only
+- Secrets/APKs off Git: FR-005 / SC-005
+- Prefer primary sources: Google factory images page; live `adb` over blogs
+
+**Post-design**: Still pass — plan does not invent package versions.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/002-axp-reference-capture/
+├── plan.md
+├── research.md
+├── data-model.md
+├── quickstart.md
+├── contracts/          # N/A (README only)
+└── tasks.md
+```
+
+### Source / artifact layout
+
+```text
+# In-repo (redacted)
+docs/device-roles.md                 # update serials/labels + lock notes
+docs/002-golden-inventory.md         # essential inventory + banking flow
+docs/002-lab-stock-rescue.md         # LAB factory rescue
+docs/axp-pro-parity.md               # cross-links only (non-normative)
+
+# On rom-dev01 (raw; not Git)
+/srv/rom/references/axp/
+├── archive/           # rsync from ~/Archives/AXP.OS
+├── golden/            # adb pulls, APK copies, dumpsys (restricted)
+├── lab/               # factory image zip + checksums
+└── logs/              # capture session logs
+```
+
+## Complexity Tracking
+
+| Violation | Why Needed | Simpler Alternative Rejected Because |
+|-----------|------------|-------------------------------------|
+| — | — | — |
+
+## Phases
+
+### P0 — Docs + archive seed (no phone required)
+
+1. Freeze plan/research/tasks.
+2. Rsync laptop `~/Archives/AXP.OS` → `/srv/rom/references/axp/archive/`.
+3. Draft LAB stock rescue from current Google sunfish factory image listing;
+   download image+hash to `/srv/rom/references/axp/lab/` when network allows.
+
+### P1 — Device roles + measured identity (phones required)
+
+1. Connect GOLDEN and LAB; record serials/labels; `getprop` + fastboot lock.
+2. Update `docs/device-roles.md` + `docs/002-golden-inventory.md` stubs with
+   measured facts only.
+
+### P2 — Essential GOLDEN inventory + banking flow
+
+1. Scripted `adb` collection into `/srv/rom/references/axp/golden/` (redact
+   before any Git paste).
+2. Write banking install order from GOLDEN observation.
+3. Cross-link parity matrix rows that become known.
+
+### Gate before `003`
+
+LAB rescue doc reviewed; GOLDEN explicitly do-not-flash; FR-006 satisfied.
+**No** Lineage sync in this feature.

specs/002-axp-reference-capture/quickstart.md

@@ -0,0 +1,21 @@
+# Quickstart: 002-axp-reference-capture
+
+## Prerequisites
+
+- `001` done (`rom-dev01`, `android-build`, `/srv/rom`)
+- Laptop: `adb` / `fastboot`
+- Both phones labeled (or serials ready)
+
+## Path
+
+1. Confirm no device attached confusion: `adb devices -l`
+2. Capture GOLDEN then LAB (or vice versa) — never flash GOLDEN
+3. Store raw under `/srv/rom/references/axp/golden/` (rsync from laptop pulls)
+4. Update redacted `docs/002-golden-inventory.md` + banking flow
+5. Verify LAB rescue zip + hash on host before any `003` flash
+
+## Gate before 003
+
+- [ ] GOLDEN marked do-not-flash in docs
+- [ ] LAB factory rescue doc + image hash present
+- [ ] Essential inventory + banking flow (gaps = re-query, not invented)

specs/002-axp-reference-capture/research.md

@@ -0,0 +1,47 @@
+# Research: 002-axp-reference-capture
+
+## R1 — Live GOLDEN vs offline AXP archive
+
+**Decision**: Treat live GOLDEN `adb` as the compatibility oracle. Offline archive
+under `/srv/rom/references/axp/archive/` is supporting reference (docs/git/
+images), never a substitute for measured device state.
+
+**Rationale**: Spec FR-003/SC-003; constitution two-device model.
+
+## R2 — NeoBackup / wipe GOLDEN
+
+**Decision**: Out of scope / not a gate (spec + `docs/device-roles.md`).
+
+## R3 — LAB factory rescue source
+
+**Decision (measured 2026-09-13)**: Target build `TQ3A.230805.001.S1` /
+`sunfish-tq3a.230805.001.s1-factory-82902ea9.zip`, SHA-256
+`82902ea98c80f1a22706279a30d2bc46aa55cbe60703c9a02ba043bd052c6d99`.
+
+Google CDN URL for that zip now returns **404**; sunfish section on
+`developers.google.com/android/images` is effectively pruned. Download from
+Internet Archive item `sunfish-tq3a.230805.001.s1` and **verify SHA-256** against
+the historical Google/Calyx hash before treating it as a rescue image.
+
+**Alternatives**: Other community mirrors only if IA fails; same hash required.
+
+## R4 — Raw artifact location
+
+**Decision**: `/srv/rom/references/axp/{archive,golden,lab,logs}/` on
+`rom-dev01`. Git holds redacted Markdown only.
+
+## R5 — Inventory depth
+
+**Decision**: Essential checklist from spec US2; missing items marked
+`re-query GOLDEN` — never invent versions/UIDs.
+
+## R6 — Magisk on GOLDEN
+
+**Decision**: Record Magisk/DenyList as **oracle facts**. Project production
+root path remains KernelSU-Next in later features; Magisk is not promoted as
+our stage.
+
+## R7 — Parallelism with archive rsync
+
+**Decision**: Start laptop→host AXP archive rsync as soon as `001` host is
+ready; does not block writing LAB rescue docs; does not wait for phone `adb`.

specs/002-axp-reference-capture/spec.md

@@ -0,0 +1,183 @@
+# Feature Specification: AXP.OS GOLDEN reference capture
+
+**Feature Branch**: `002-axp-reference-capture`
+
+**Created**: 2026-08-09
+
+**Status**: P1 complete (gate to `003`); archive rsync may still finish in background
+
+**Input**: Document and sample the **GOLDEN** daily-driver AXP.OS sunfish as a
+live compatibility oracle; label GOLDEN vs LAB; prepare **LAB** stock factory
+rescue. Experimental flashing stays on LAB only (`docs/device-roles.md`).
+
+## Context / non-goals
+
+- There are **two** sunfish devices: **GOLDEN** (**AXP.OS 22.2 / Android 15**
+  daily driver — do not experiment/flash) and **LAB** (flash/reflash freely).
+- Exact GOLDEN build fingerprint/patch is **measured** here (`getprop`). GOLDEN
+  is AXP 22.2/A15 — **not** the last GrapheneOS sunfish release (that was
+  **A13**, historical reference only).
+- Broader offline AXP *sunfish* archive (website, selected git, images) is
+  documented in `docs/axp-sunfish-preservation.md` for execution on `rom-dev01`
+  — not a full Disroot org clone; does not replace live GOLDEN `adb`.
+- Capture **essential** versions/config up front; GOLDEN remains available for
+  later live `adb` re-queries — do not require an exhaustive one-shot dump of
+  everything before `003`.
+- **NeoBackup / wipe / migrate GOLDEN are not project requirements.**
+- Do **not** invent package versions/UIDs in the constitution; this feature
+  records what GOLDEN actually runs.
+- Do not commit credentials, tokens, or personal identifiers to Git.
+- Observe devices; do **not** assume bootloader unlock state until measured
+  (both GOLDEN and LAB).
+- Product intent vs AXP Pro lives in non-normative `docs/axp-pro-parity.md`.
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - Device roles + LAB stock rescue (Priority: P1)
+
+As the developer, GOLDEN and LAB are clearly identified, and LAB has a written
+Google factory-image emergency rescue so experiments cannot permanently brick
+the lab phone.
+
+**Why this priority**: Prevents flashing the wrong phone; keeps LAB recoverable.
+
+**Independent Test**: Serials/labels documented; factory image procedure for LAB
+reviewed; GOLDEN marked do-not-flash.
+
+**Acceptance Scenarios**:
+
+1. **Given** two sunfish devices, **When** I record serials (or equivalent IDs)
+   and physical/doc labels, **Then** GOLDEN vs LAB cannot be confused.
+2. **Given** GOLDEN and LAB, **When** I inspect bootloader/fastboot/`getprop`
+   on each, **Then** lock state and build identity are recorded without prior
+   assumptions.
+3. **Given** official Google sunfish factory images, **When** I document image
+   set, hashes, and flash steps for **LAB**, **Then** LAB emergency stock rescue
+   exists before `003` experiments.
+4. **Given** project docs, **When** reviewed, **Then** they state GOLDEN must
+   not receive experimental project flashes.
+
+---
+
+### User Story 2 - Essential GOLDEN inventory (Priority: P1)
+
+As the developer, I have enough structured inventory of GOLDEN AXP to start
+`004`–`006`, knowing I can re-probe GOLDEN later for missing details.
+
+**Why this priority**: Defines the live oracle without blocking on perfection.
+
+**Independent Test**: Essential checklist complete or explicitly deferred with
+“re-query GOLDEN later” notes — no silent unknowns for hard-gates.
+
+**Acceptance Scenarios**:
+
+1. **Given** GOLDEN AXP, **When** I collect `getprop` / fingerprints, **Then**
+   exact ROM/build identifiers are stored.
+2. **Given** microG, **When** inventoried at essential level, **Then** recorded:
+   version, signing cert; Self-Check; Device Registration; Cloud Messaging;
+   relevant permissions.
+3. **Given** Phonesky / `com.android.vending`, **When** inventoried, **Then**
+   recorded: version; APK path; cert; permissions; spoofing state; useful
+   `dumpsys package` / priv-app XML notes.
+4. **Given** Insular, **When** inventoried, **Then** recorded: profile IDs;
+   profile owner; `dumpsys device_policy` excerpt; owner vs work UIDs/packages;
+   Yuh/Swissquote locations.
+5. **Given** Magisk/root, **When** inventoried, **Then** recorded: Magisk
+   version; modules; **DenyList including processes**.
+6. **Given** GSF Proxy and related packages, **When** inventoried, **Then**
+   versions/paths/signatures are recorded.
+7. **Given** banking interest, **When** measurable, **Then** record observational
+   Play Integrity (or equivalent) state plus Yuh/Swissquote pass/fail on GOLDEN
+   — comparative baseline only, not a Strong Integrity promise for our ROM.
+8. **Given** Daily-driver MVP features we will replace natively, **When**
+   capturing modules/settings, **Then** document current call-recording and
+   FLAG_SECURE bypass behaviour/source on GOLDEN (AXP vs module; global/per-app).
+
+---
+
+### User Story 3 - Golden banking flow on GOLDEN (Priority: P1)
+
+As the developer, the known-good banking install order is written from GOLDEN
+so `006` can reproduce it on LAB (with KernelSU substituting DenyList later).
+
+**Why this priority**: Order is load-bearing.
+
+**Independent Test**: Step list matches GOLDEN procedure.
+
+**Acceptance Scenarios**:
+
+1. **Given** GOLDEN, **When** I document the banking app install flow, **Then**
+   it explicitly includes:
+
+   1. Aurora Store → install  
+   2. **Do not open**  
+   3. Magisk DenyList **before** first process (include processes)  
+   4. Clone into Insular  
+   5. First launch inside Insular  
+   6. Phonesky/Play in Insular  
+   7. Play update inside work profile if required  
+   8. Verify login/biometrics/push/reboot as applicable  
+
+2. **Given** that flow, **When** stored in the redacted summary, **Then** it
+   omits passwords, OTPs, and personal identifiers.
+
+---
+
+### User Story 4 - Safe artifact handling (Priority: P2)
+
+As the developer, sensitive captures stay off Git; redacted summaries are
+committed to `sunfish-a16-rom`.
+
+**Acceptance Scenarios**:
+
+1. **Given** raw pulls/APKs, **When** stored, **Then** they live under e.g.
+   `/srv/rom/references/axp/` on `rom-dev01`, not in Git.
+2. **Given** in-repo summary, **When** reviewed, **Then** it has versions/hashes/
+   workflow steps without personal secrets.
+
+---
+
+### Edge Cases
+
+- GOLDEN encrypt/PIN: document without storing the PIN.
+- Missing detail later: re-attach GOLDEN and `adb` — do not invent.
+- LAB brick: use LAB stock factory rescue; do not wipe GOLDEN to “recover”.
+- Optional personal NeoBackup of GOLDEN is outside project gates.
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+- **FR-001**: Label and record GOLDEN vs LAB identities; measure bootloader/
+  fastboot state on both.
+- **FR-002**: Document LAB Google factory-image emergency rescue (hashes + steps).
+- **FR-003**: Capture essential GOLDEN inventory (microG, GSF, Phonesky, Insular,
+  Magisk/DenyList processes, Yuh/Swissquote, call-recording + FLAG_SECURE
+  sources, observational Play Integrity if measurable).
+- **FR-004**: Document GOLDEN banking flow (Aurora → NO OPEN → DenyList →
+  Insular → Play update).
+- **FR-005**: Store raw artifacts off-Git; commit only redacted docs.
+- **FR-006**: Gate: no experimental flash on LAB until LAB rescue docs exist and
+  GOLDEN is explicitly marked do-not-flash; **no** NeoBackup/wipe of GOLDEN
+  required.
+- **FR-007**: Cross-link useful facts into `docs/axp-pro-parity.md` /
+  `docs/device-roles.md` without inventing unseen features.
+
+### Key Entities
+
+- **GOLDEN**: live AXP oracle (not wiped for bring-up).
+- **LAB**: experimental flash target + stock rescue docs.
+- **Reference bundle**: host-local capture directory.
+- **Redacted summary**: in-repo documentation.
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-001**: GOLDEN vs LAB clearly identified; agents/docs forbid flashing GOLDEN.
+- **SC-002**: LAB stock factory rescue written and reviewed before `003`.
+- **SC-003**: Essential GOLDEN inventory + banking flow complete enough for
+  `006` hard-gates; gaps marked “re-query GOLDEN” not invented.
+- **SC-004**: Yuh/Swissquote verified working on GOLDEN and documented.
+- **SC-005**: Git has no proprietary APK dumps or personal credential material.
+- **SC-006**: Bootloader states in docs match measured GOLDEN and LAB reality.

specs/002-axp-reference-capture/tasks.md

@@ -0,0 +1,59 @@
+# Tasks: AXP.OS GOLDEN reference capture
+
+**Input**: Design docs from `/specs/002-axp-reference-capture/`
+
+**Prerequisites**: `001` complete on `rom-dev01`
+
+## Phase 1: Setup (no phone)
+
+- [x] T001 Confirm active feature `specs/002-axp-reference-capture` in `.specify/feature.json`
+- [x] T002 [P] Create `docs/002-lab-stock-rescue.md` stub (LAB only; Google factory source)
+- [x] T003 [P] Create `docs/002-golden-inventory.md` stub (essential checklist + banking flow placeholders)
+- [x] T004 [P] Create host dirs `/srv/rom/references/axp/{archive,golden,lab,logs}` as `android-build`
+
+## Phase 2: Offline AXP archive seed (no phone)
+
+- [~] T005 Rsync `~/Archives/AXP.OS/` → host archive *(~18G/38G in progress; not a `003` flash gate)*
+- [x] T006 Record archive size + SNAPSHOT_DATE in `/srv/rom/references/axp/logs/archive-rsync.txt` *(partial; refresh when rsync ends)*
+
+## Phase 3: LAB stock rescue (P1 — may download without phone)
+
+- [x] T007 Resolve current official sunfish factory image URL + SHA-256 from Google primary page (or document pruning if only one remains) *(Google CDN 404; hash + IA fallback documented)*
+- [x] T008 Download factory zip to `/srv/rom/references/axp/lab/`; verify SHA-256 *(VERIFY_OK 2026-09-13)*
+- [x] T009 Complete `docs/002-lab-stock-rescue.md` with flash-all steps, wipe warning, LAB-only scope
+- [x] T010 Cross-check FR-002/SC-002 in a short verification note in that doc
+
+## Phase 4: Device roles measured (P1 — phones required)
+
+- [x] T011 Connect GOLDEN (AXP A15 main); record serial + `getprop` into golden inventory (raw log on host) — **adb sample only, no modifications** *(serial `11071JEC203839`)*
+- [x] T012 Connect LAB; record serial/label + build identity *(serial `11231JEC207477`, iodé/LOS 7.8 A16 — see `docs/002-lab-iodes-baseline.md`)*
+- [x] T013 Measure bootloader/fastboot unlock state on **both**; update `docs/device-roles.md` + inventory (SC-006) *(GOLDEN unlocked/orange; LAB locked/green — via getprop)*
+- [x] T014 Explicit “do not flash GOLDEN” callout in `docs/device-roles.md` and inventory (SC-001)
+
+## Phase 5: Essential GOLDEN inventory (P1 — GOLDEN adb)
+
+- [x] T015 Capture microG essential fields (version, cert, Self-Check notes) *(version + sig short; Self-Check UI = re-query)*
+- [x] T016 Capture Phonesky / `com.android.vending` essentials *(Phonesky_AXP-OS 50.2.12)*
+- [x] T017 Capture Insular / work profile essentials (`dumpsys device_policy` excerpt redacted) *(Island 6.4.2, user 10)*
+- [x] T018 Capture Magisk version, modules, DenyList **including processes** *(Magia UI DenyList packages from screenshots; Magisk 29.0; process expand partial; modules dir not readable without root)*
+- [x] T019 Capture GSF Proxy / related packages versions/paths/signatures
+- [x] T020 Record observational Play Integrity + Yuh/Swissquote pass/fail on GOLDEN (SC-004) *(Swissquote PASS; Yuh FAIL HA / certificate invalid; Finsky PI token path still completes; keystore2 TEE errors in log)*
+- [x] T021 Document call-recording + FLAG_SECURE bypass source on GOLDEN *(deferred — re-query; not blocking `003`)*
+- [x] T022 Mark any missing rows `re-query GOLDEN` — do not invent
+
+## Phase 6: Banking flow (P1)
+
+- [x] T023 Write redacted GOLDEN banking install order / observed layout in `docs/002-golden-inventory.md`
+- [x] T024 Confirm no passwords/OTPs/PII in Git docs (SC-005)
+
+## Phase 7: Polish / gate
+
+- [x] T025 Cross-link known facts into `docs/axp-pro-parity.md` without inventing features (FR-007)
+- [x] T026 FR/SC checklist pass for gate: LAB rescue ready; GOLDEN do-not-flash; inventory+flow sufficient for `006` *(see `docs/002-gate-handoff.md`)*
+- [x] T027 Handoff note: **`002` complete → `003` on LAB only**
+- [x] T028 Verify Git trees contain no proprietary APK dumps or credential files
+
+## Parallel opportunities
+
+- T002–T004 parallel; T005 archive rsync while drafting T007–T009
+- T011–T014 require physical devices; block inventory until done