AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/003-lineage-23-vanilla-build/contracts/README.md

@@ -0,0 +1,3 @@
+# Contracts: N/A for 003
+
+No HTTP/API contracts. Build/flash/smoke documentation only.

specs/003-lineage-23-vanilla-build/data-model.md

@@ -0,0 +1,27 @@
+# Data model: 003-lineage-23-vanilla-build
+
+## VanillaBuild
+
+| Field | Notes |
+|-------|-------|
+| manifest_url / branch | From `repo init` |
+| resolved_manifest | `repo manifest -r` artifact |
+| lunch_target | e.g. `lineage_sunfish-userdebug` (confirm at build) |
+| build_id / date | Host timestamp |
+| artifact_paths | img/zip under `/srv/rom/artifacts/003-…` |
+| sha256 | Per artifact |
+| build_log | Compressed under `/srv/rom/logs` |
+
+## LabFlashSession
+
+| Field | Notes |
+|-------|-------|
+| serial | Must be LAB `11231JEC207477` |
+| bootloader_state_before/after | Measured |
+| flash_steps | Documented |
+| boot_ok | bool |
+| getprop_fingerprint | Post-boot |
+
+## SmokeChecklist
+
+P1 + extended rows from spec; each `pass` / `fail` / `skip` + evidence.

specs/003-lineage-23-vanilla-build/plan.md

@@ -0,0 +1,80 @@
+# Implementation Plan: LineageOS 23.2 vanilla build for sunfish
+
+**Branch**: `003-lineage-23-vanilla-build` | **Date**: 2026-09-13 | **Spec**: [spec.md](./spec.md)
+
+**Input**: Feature specification from `/specs/003-lineage-23-vanilla-build/spec.md`
+
+## Summary
+
+On `rom-dev01`, sync official LineageOS **23.2** for `sunfish`, build
+`userdebug` (test-keys), publish hashed artifacts under `/srv/rom/artifacts`,
+`rsync` to the laptop, flash **LAB only** (`11231JEC207477`), and run P1 +
+extended hardware smoke. No microG, KernelSU, Magisk, or hardening patches.
+On flash failure, use `docs/002-lab-stock-rescue.md` — never touch GOLDEN.
+
+## Technical Context
+
+**Language/Version**: Bash + Lineage `repo` / Soong / ninja (AOSP Android 16)
+
+**Primary Dependencies**: LineageOS 23.2 manifest; device/kernel trees for
+sunfish; `ccache`; OpenSSH; laptop `adb`/`fastboot`
+
+**Storage**: `/srv/rom/src` (tree), `/srv/rom/ccache`, `/srv/rom/artifacts`,
+`/srv/rom/logs` on `rom-dev01`
+
+**Testing**: Observational boot + hardware checklists (documented results)
+
+**Target Platform**: `rom-dev01` Ubuntu 24.04 build; LAB Pixel 4a flash
+
+**Project Type**: ROM bring-up / reproducible baseline artifact
+
+**Performance Goals**: Complete sync+build with conservative `-j`; survive
+OOM via documented recovery
+
+**Constraints**: LAB only; no project patches beyond LOS device needs; no
+Magisk/KSU “just to test”; GOLDEN forbidden
+
+**Scale/Scope**: One developer; one known-good vanilla baseline for regression
+
+## Constitution Check
+
+*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
+
+- Independence from SSYSTEMS: yes
+- GOLDEN do-not-flash: enforced (FR-007)
+- Functionality-first vanilla base before hardening: yes
+- Secrets/APKs off Git: artifacts stay on host/laptop paths; Git = docs/metadata
+- Prefer primary sources: Lineage wiki + official manifest
+
+**Post-design**: Pass — plan does not invent device trees or flash GOLDEN.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/003-lineage-23-vanilla-build/
+├── plan.md
+├── research.md
+├── data-model.md
+├── quickstart.md
+├── contracts/
+└── tasks.md
+```
+
+### Source / artifact layout
+
+```text
+# rom-dev01
+/srv/rom/src/lineage/          # repo workspace (or documented path)
+/srv/rom/artifacts/003-*/      # images, zip, SHA-256, repo manifest -r
+/srv/rom/logs/003-*/           # compressed build logs
+
+# laptop
+~/…/artifacts/003-*/           # rsync target for flash
+docs/003-*.md                  # flash + smoke results (redacted)
+```
+
+## Complexity Tracking
+
+None — single vanilla bring-up path.

specs/003-lineage-23-vanilla-build/quickstart.md

@@ -0,0 +1,27 @@
+# Quickstart: 003 vanilla LOS 23.2
+
+## Prerequisites
+
+- `001` host ready (`rom-dev01`, `android-build`, ccache, repo)
+- `002` gate: LAB rescue zip OK; GOLDEN do-not-flash
+- USB to **LAB** only for flash
+
+## Build (host)
+
+```bash
+ssh rom-dev01   # as android-build
+# repo init/sync lineage-23.2 sunfish — exact commands in tasks / build notes
+# breakfast/lunch sunfish userdebug
+# mka bacon or documented target; log + hash artifacts into /srv/rom/artifacts
+```
+
+## Flash (laptop → LAB)
+
+1. `adb devices` / `fastboot devices` — confirm LAB serial  
+2. Unlock LAB if needed (wipes device)  
+3. Flash per LOS wiki / project `docs/003-flash-lab.md` (to be written)  
+4. If brick/bootloop: `docs/002-lab-stock-rescue.md`
+
+## Smoke
+
+Fill `docs/003-smoke-lab.md` P1 + extended; keep as known-good baseline before `004`.

specs/003-lineage-23-vanilla-build/research.md

@@ -0,0 +1,51 @@
+# Research: 003-lineage-23-vanilla-build
+
+## R1 — Manifest / branch
+
+**Decision**: Use official LineageOS `lineage-23.2` (or the wiki-documented
+sunfish 23.2 branch name measured at implement time). Record exact
+`repo init` URL/branch and `repo manifest -r` for the known-good build.
+
+**Rationale**: Constitution base = LOS 23.2 / A16; no AXP/GOS base.
+
+## R2 — Build user / path
+
+**Decision**: Build as `android-build` on `rom-dev01`; tree under
+`/srv/rom/src/` (exact subdir documented at init); `CCACHE_DIR=/srv/rom/ccache`.
+
+## R3 — Variant
+
+**Decision**: `userdebug` + LOS default/test-keys for this stage (FR-002).
+Release keys / AVB = later (`011`).
+
+## R4 — Flash target
+
+**Decision**: **LAB only** (`11231JEC207477`). Owner approved unlock/wipe for
+first custom flash. GOLDEN never flashed. Factory zip on disk =
+**emergency rescue only** — owner does not want stock as a planned LAB OS;
+skip “Yuh on stock” experiment.
+
+## R4b — Banking / root / Phonesky (owner 2026-09-13)
+
+- Hard-gate focus: **Yuh** (+ Swissquote as tracked); Revolut not a hard-gate.
+- Root: **KernelSU-Next + SusFS**; ReSukiSU only if KSU-Next fails on LAB.
+- Play: **AXP-style patched Phonesky/GPlay** priv-app (not XDA FakeStore-first).
+
+## R5 — Parallelism / OOM
+
+**Decision**: Start conservative `-j` (e.g. half of vCPUs); document failure
+recovery (`out/` cleanup) in build notes. Measure host: ~8 vCPU / 62 GiB RAM.
+
+## R6 — What “vanilla” excludes
+
+**Decision**: No microG, Phonesky, signature-spoof patches, KernelSU/SUSFS,
+Magisk, call-recording/FLAG_SECURE ports, Graphene/Divest hardening — even if
+present on LAB’s current iodé image (that baseline will be wiped by flash).
+
+## R8 — Proprietary blobs
+
+**Decision (owner 2026-09-13):** Factory/Lineage-equivalent blob base, then
+selective **AXP sunfish** diffs and **GrapheneOS** diffs (historical sunfish A13
++ transferable bits from a currently supported Pixel). No exotic blob hunting
+for GPS; do not overthink for `003` vanilla (factory-equivalent only).
+

specs/003-lineage-23-vanilla-build/spec.md

@@ -0,0 +1,183 @@
+# Feature Specification: LineageOS 23.2 vanilla build for sunfish
+
+**Feature Branch**: `003-lineage-23-vanilla-build`
+
+**Created**: 2026-08-09
+
+**Status**: Active — implementation next (vanilla sync/build on `rom-dev01`)
+
+**Input**: Produce the first vanilla LineageOS 23.2 / Android 16 build for
+`sunfish`, copy images to the laptop, flash, and verify boot plus basic
+hardware — with no microG, KernelSU, or hardening yet.
+
+## Context / non-goals
+
+**Prerequisites:**
+
+- `001-development-environment` sufficiently complete to sync/build;
+- `002-axp-reference-capture` P1 complete (GOLDEN labeled; LAB stock rescue
+  documented). Flash **LAB only** — never GOLDEN (`docs/device-roles.md`).
+
+**Out of scope for this feature:**
+
+- microG / Phonesky / signature spoofing;
+- KernelSU / SUSFS / Magisk parity;
+- call recording, FLAG_SECURE toggles, privacy extras;
+- project signing / AVB / OTA implementation;
+- Graphene/AXP/Divest patch ports.
+
+Build target: **`userdebug`** with development/test-keys.
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - Reproducible vanilla sync & build (Priority: P1)
+
+As the developer, I can sync LineageOS 23.2 for sunfish on `rom-dev01` and
+complete a build that emits flashable images, with manifest/revisions recorded.
+
+**Why this priority**: Establishes the real base ROM.
+
+**Independent Test**: Build finishes; artifact paths listed; manifest revision
+document stored under `/srv/rom` with hashes.
+
+**Acceptance Scenarios**:
+
+1. **Given** `android-build` on `rom-dev01`, **When** I sync the LOS 23.2
+   sunfish source via `repo`, **Then** the tree matches a documented manifest
+   revision.
+2. **Given** the synced tree, **When** I build `userdebug` for sunfish with
+   conservative parallelism, **Then** the build completes without requiring
+   project patches beyond LOS-needed device/kernel trees.
+3. **Given** a successful build, **When** I collect outputs, **Then** images/
+   zip needed to flash sunfish are in `/srv/rom/artifacts` (or documented path)
+   with SHA-256 hashes and a compressed build log.
+
+---
+
+### User Story 2 - Flash from laptop (Priority: P1)
+
+As the developer, I `rsync` artifacts to the laptop and flash the Pixel 4a over
+USB using fastboot/adb, following the recovery notes from `002` if something
+fails.
+
+**Why this priority**: Closes the loop on the thin-client workflow.
+
+**Independent Test**: Device boots the new build; `getprop` shows LineageOS /
+ expected fingerprints (not AXP).
+
+**Acceptance Scenarios**:
+
+1. **Given** artifacts on the laptop, **When** I flash per documented steps,
+   **Then** the device boots into the vanilla LOS build.
+2. **Given** a failed flash/boot on **LAB**, **When** I follow `002` LAB stock
+   factory rescue docs, **Then** LAB returns to usable stock. GOLDEN is not
+   touched.
+
+---
+
+### User Story 3 - Basic hardware smoke test (Priority: P1)
+
+As the developer, after first boot I verify essential radios and peripherals
+well enough to trust this build as the clean base for later features — and I
+know what was already broken on **vanilla** LOS before we add patches.
+
+**Why this priority**: A boot-only “success” that breaks telephony/Wi-Fi is not
+a usable base. Later regressions must be attributable.
+
+**Independent Test**: Checklist results stored for P1 and extended items on the
+vanilla build.
+
+**Acceptance Scenarios**:
+
+1. **Given** first boot completed, **When** I run the **P1 smoke** set, **Then**
+   each item either works or is logged as a blocking defect with evidence:
+
+   - encryption / PIN
+   - SELinux mode (`Enforcing` expected)
+   - Android security patch level
+   - vendor security patch level / build baseline
+   - SIM detection
+   - mobile data
+   - phone calls
+   - SMS (send/receive as applicable)
+   - Wi-Fi
+   - Bluetooth
+   - GPS
+   - camera(s)
+   - audio (speaker/mic)
+   - NFC
+   - sensors (basic)
+   - fingerprint
+   - USB data / ADB
+   - charging
+
+2. **Given** P1 smoke done, **When** I run the **extended baseline** set,
+   **Then** each is recorded (need not all be P1 blockers, but must not be
+   skipped silently):
+
+   - airplane mode
+   - flashlight
+   - vibration
+   - screen rotation
+   - USB OTG (if hardware/cable available)
+   - headphone jack
+   - WebView implementation / basic page load
+   - app sideload install smoke (non-Google)
+   - Widevine / DRM security level
+   - eSIM capability/state, if available
+   - WireGuard kernel capability/baseline
+   - bootloader version
+   - baseband / modem version
+
+3. **Given** smoke results, **When** deciding to proceed to `004`, **Then** no
+   unresolved P1 hardware blockers remain (or they are explicitly accepted with
+   rationale).
+
+---
+
+### Edge Cases
+
+- Build disk/oom with 52 GB + swap: document job `-j` and failure recovery
+  (`out/` cleanup).
+- Partial artifact set: do not flash until required partitions/images are
+  present and hashed.
+- Do not install Magisk/KernelSU “just to test” in this feature.
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+- **FR-001**: Initialize from the documented official LineageOS 23.2
+  manifest/branch (`repo init` → sync) and capture a revision-locked resolved
+  manifest (e.g. `repo manifest -r`) for every known-good build.
+- **FR-002**: Build `userdebug` images with test-keys / default LOS signing for
+  this stage.
+- **FR-003**: Record manifest, revisions, build variant, config, hashes, and
+  compressed log for the successful build.
+- **FR-004**: Publish artifacts to `/srv/rom/artifacts` and document `rsync` +
+  flash procedure.
+- **FR-005**: Boot sunfish on the vanilla build and run the P1 + extended
+  hardware/baseline checklist (record results even for non-blockers).
+- **FR-006**: Keep tree free of microG/Phonesky/KernelSU/hardening patches
+  intended for later features.
+- **FR-007**: On LAB flash failure, follow `002` LAB stock factory rescue; never
+  flash or wipe GOLDEN as part of recovery.
+
+### Key Entities
+
+- **Vanilla LOS build**: clean base artifact set.
+- **Build metadata**: manifest + hashes + log bundle.
+- **Smoke checklist**: hardware/regression minimum for this stage.
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-001**: One successful sunfish `userdebug` build exists with recorded
+  metadata and hashes.
+- **SC-002**: Device boots that build after laptop-side flash.
+- **SC-003**: P1 and extended hardware/baseline checklists are completed and
+  stored (extended items may be non-blocking but must be recorded).
+- **SC-004**: No dependency on LSPosed/Magisk modules for this stage’s success.
+- **SC-005**: This build is tagged/kept as a known-good flashable baseline for
+  regression when later features break the device.

specs/003-lineage-23-vanilla-build/tasks.md

@@ -0,0 +1,54 @@
+# Tasks: LineageOS 23.2 vanilla build for sunfish
+
+**Input**: Design docs from `/specs/003-lineage-23-vanilla-build/`  
+**Prerequisites**: `001` done; `002` P1 gate (`docs/002-gate-handoff.md`)
+
+## Phase 1: Prep
+
+- [x] T001 Confirm active feature `specs/003-lineage-23-vanilla-build`
+- [x] T002 [P] Create `docs/003-build-notes.md` stub (manifest URL/branch TBD at init)
+- [x] T003 [P] Create `docs/003-flash-lab.md` stub (LAB serial check; link rescue)
+- [x] T004 [P] Create `docs/003-smoke-lab.md` checklist from spec P1 + extended
+- [x] T005 Verify LAB serial still `11231JEC207477`; confirm GOLDEN not attached before any flash *(LAB serial documented; flash later)*
+- [x] T006 Confirm host dirs `/srv/rom/{src,artifacts,logs,ccache}` writable by `android-build`
+
+## Phase 2: Sync
+
+- [x] T007 `repo init` official LineageOS 23.2 (wiki-verified URL/branch) under `/srv/rom/src/…` *(`/srv/rom/src/lineage`, `lineage-23.2`)*
+- [x] T008 `repo sync` sunfish device/kernel dependencies; record wall time / failures *(finished 2026-09-13T21:27:26Z exit=0; tree ~180G)*
+- [x] T009 Save `repo manifest -r` to `/srv/rom/artifacts/003-…/manifest-rev.xml`
+
+## Phase 3: Build
+
+- [x] T010 Configure ccache env; choose parallelism (**`-j8`** = match vCPU)
+- [x] T011 `lunch`/`breakfast` sunfish `userdebug`; start build; capture log
+- [x] T012 On OOM/disk failure: document recovery; retry (no silent `-j` guessing) *(N/A — no OOM; mid-run bump -j4→-j8)*
+- [x] T013 Collect flashable images/zip into `/srv/rom/artifacts/003-…`; SHA-256 all
+- [x] T014 Compress build log beside artifacts; write build metadata (variant, date, host)
+
+## Phase 4: Flash LAB
+
+- [x] T015 `rsync` artifacts to laptop *(`${WORKSPACE}/.local-artifacts/003-vanilla/20260914-lineage-23.2-sunfish/`)*
+- [x] T016 Unlock LAB bootloader if still locked (owner-approved wipe) — **LAB only**
+- [x] T017 Flash per `docs/003-flash-lab.md`; verify serial before every `fastboot` command
+- [x] T018 Confirm first boot; `getprop` shows LOS vanilla (not AXP / not prior iodé id)
+- [ ] T019 If fail: factory rescue from `002`; do not touch GOLDEN *(N/A so far)*
+
+## Phase 5: Smoke
+
+- [x] T020 Complete P1 smoke checklist in `docs/003-smoke-lab.md`
+- [x] T021 Complete extended baseline checklist (record skips with reason)
+- [x] T022 Decide gate to `004`: no unresolved P1 blockers (or explicit accept)
+
+## Phase 6: Polish
+
+- [x] T023 Tag/keep known-good baseline note (paths + hashes) for regression
+      (`docs/003-gate-handoff.md` + artifacts dir)
+- [x] T024 Confirm tree has no microG/KSU/hardening patches (FR-006)
+      (vanilla identity props; no microG packages on LAB pre-004)
+- [x] T025 Handoff: **`003` complete → `004`** (microG path) on LAB only
+
+## Parallel opportunities
+
+- T002–T004 while T006 host checks run
+- T015 rsync can start as soon as T013 hashes exist