AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
2026-09-16 21:56:22 +00:00
commit 12d2179c20
@@ -0,0 +1,35 @@
+# Specification Quality Checklist: microG + Phonesky
+
+**Purpose**: Validate specification completeness before planning  
+**Created**: 2026-09-14  
+**Feature**: [spec.md](../spec.md)
+
+## Content Quality
+
+- [x] No implementation details (languages, frameworks, APIs)
+- [x] Focused on user value and business needs
+- [x] Written for non-technical stakeholders
+- [x] All mandatory sections completed
+
+## Requirement Completeness
+
+- [x] No [NEEDS CLARIFICATION] markers remain
+- [x] Requirements are testable and unambiguous
+- [x] Success criteria are measurable
+- [x] Success criteria are technology-agnostic (no implementation details)
+- [x] All acceptance scenarios are defined
+- [x] Edge cases are identified
+- [x] Scope is clearly bounded
+- [x] Dependencies and assumptions identified
+
+## Feature Readiness
+
+- [x] All functional requirements have clear acceptance criteria
+- [x] User scenarios cover primary flows
+- [x] Feature meets measurable outcomes defined in Success Criteria
+- [x] No implementation details leak into specification
+
+## Notes
+
+- Spoofing deferred to `005` by design; Self-Check may be partially blocked until then.
+- Phonesky signing strategy is FR-010 (document during plan/implement; keys host-only).
@@ -0,0 +1,35 @@
+# Contract: system packages (004)
+
+## Packages that MUST be present on LAB after flash
+
+| Package | Type | Notes |
+|---------|------|-------|
+| `com.google.android.gms` | system/priv | microG |
+| `com.google.android.gsf` | system/priv | GsfProxy |
+| `com.android.vending` | **priv-app** | Patched Phonesky |
+
+## Packages that MUST NOT be present
+
+| Package | Notes |
+|---------|-------|
+| FakeStore (typical `com.android.vending` stub from partner_gms) | Conflicts with Phonesky |
+| Magisk / KernelSU manager (as ROM-preinstalled) | Out of scope until `007` |
+
+## Host path contract (rom-dev01)
+
+| Path | Contents | In Git? |
+|------|----------|---------|
+| `/srv/rom/prebuilts/microg/` | GmsCore + GsfProxy APKs + `VERSIONS.txt` | No |
+| `/srv/rom/prebuilts/phonesky/` | Phonesky APK + permission XMLs + `VERSIONS.txt` | No |
+| `/srv/rom/secrets/phonesky-signing/` | Optional project keys | No |
+| Meta-repo `docs/004-*.md` | Runbook + self-check | Yes |
+| Product/vendor mk under LOS tree | References prebuilts by path | Tree on host; mirror patches in meta if small |
+
+## Verification commands (LAB)
+
+```bash
+adb -s 11231JEC207477 shell pm path com.google.android.gms
+adb -s 11231JEC207477 shell pm path com.google.android.gsf
+adb -s 11231JEC207477 shell pm path com.android.vending
+adb -s 11231JEC207477 shell pm list packages | grep -i fakestore || true
+```
@@ -0,0 +1,56 @@
+# Data model: 004 packages
+
+## Entities
+
+### MicroGGmsCore
+
+| Field | Description |
+|-------|-------------|
+| package | `com.google.android.gms` |
+| role | microG Services Core |
+| install | privileged / system (product or system_ext per chosen mk) |
+| source | Official microG release APK on host prebuilts |
+| golden_ref | `0.3.15.250932` (AXP inventory) |
+
+### GsfProxy
+
+| Field | Description |
+|-------|-------------|
+| package | `com.google.android.gsf` |
+| role | Legacy GSF / C2DM proxy |
+| install | system app or priv-app |
+| source | microG GsfProxy release (or rebuilt for targetSdk if needed) |
+| golden_ref | `GsfProxy_GH` v0.1.0 on GOLDEN |
+
+### PhoneskyPatched
+
+| Field | Description |
+|-------|-------------|
+| package | `com.android.vending` |
+| role | Patched Play Store |
+| install | **priv-app** + privapp-permissions + default-permissions XML |
+| source | AXP archive APK (not Git) |
+| golden_ref | Phonesky_AXP-OS **50.2.12-24** |
+| first_candidate | archive **50.3.27-24** or **51.4.19-24** |
+
+### PermissionConfig
+
+| Artifact | Purpose |
+|----------|---------|
+| `privapp-permissions-com.android.vending.xml` | Privileged permissions allowlist |
+| `com.android.vending.xml` | Feature/permission declarations as needed |
+| `phonesky-permissions.xml` (default-permissions) | Default grants |
+
+### ForbiddenCompanion
+
+| package | rule |
+|---------|------|
+| FakeStore / conflicting Companion | MUST NOT ship alongside Phonesky |
+
+## Relationships
+
+- Phonesky **replaces** FakeStore in the compatibility stack.
+- microG Self-Check may require spoofing of GmsCore (and later Phonesky) —
+  spoofing policy owned by `005`.
+- All binaries → host prebuilts → product makefile → image; evidence →
+  `/srv/rom/artifacts/004-…`.
@@ -0,0 +1,89 @@
+# Implementation Plan: microG + GSF Proxy + patched Phonesky
+
+**Branch**: `004-microg-phonesky-integration` | **Date**: 2026-09-14 | **Spec**: [spec.md](./spec.md)
+
+**Input**: Feature specification from `/specs/004-microg-phonesky-integration/spec.md`
+
+## Summary
+
+Add the Google compatibility stack to the sunfish LOS 23.2 / Android 16 tree on
+**LAB only**: microG GmsCore, GSF Proxy, and **patched Phonesky** as priv-app
+(AXP-style), without FakeStore, Magisk, or KernelSU. Signature spoofing beyond
+what LOS already provides stays in `005`. Proprietary APKs live only under
+`/srv/rom/` (never Git).
+
+## Technical Context
+
+**Language/Version**: Android.mk / Soong (`Android.bp` where needed); bash
+runbooks on `rom-dev01`  
+**Primary Dependencies**: LineageOS 23.2 tree (`/srv/rom/src/lineage`); microG
+release APKs; AXP `packages_apps_phonesky` permission XMLs + signed APK from
+project AXP archive; LOS restricted signature spoofing (baseline)  
+**Storage**: Host paths `/srv/rom/prebuilts/{microg,phonesky}/`, secrets under
+`/srv/rom/secrets/`  
+**Testing**: LAB flash + `pm`/`dumpsys` + microG Self-Check screenshots; no
+unit-test harness required  
+**Target Platform**: Pixel 4a (`sunfish`) LAB `11231JEC207477`; Android 16  
+**Project Type**: Android ROM packaging / device product overlay  
+**Performance Goals**: N/A (functional compatibility)  
+**Constraints**: No proprietary APKs in Git; no GOLDEN flash; no Magisk/KSU in
+`004`; Phonesky signing keys host-only  
+**Scale/Scope**: Three system packages + permission XMLs + product makefile +
+runbook; one rebuild + LAB flash
+
+## Constitution Check
+
+*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
+
+| Gate | Status |
+|------|--------|
+| LAB only; never GOLDEN | pass |
+| No proprietary Google APKs in Git | pass (host `/srv/rom/prebuilts`) |
+| Phonesky = patched priv-app, not FakeStore primary | pass |
+| No Magisk/KSU in Compatibility path before `006`/`007` | pass (`004` rootless) |
+| Spoofing restricted / auditable → full policy in `005` | pass (use LOS baseline only here) |
+| Prefer AXP reference for packaging | pass (archive Phonesky + XMLs) |
+| Prefer small attributable changes | pass (vendor/product overlay, not megapatch) |
+
+**Post-design**: unchanged — design stays packaging + docs.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/004-microg-phonesky-integration/
+├── plan.md
+├── research.md
+├── data-model.md
+├── quickstart.md
+├── contracts/
+│   └── packages.md
+└── tasks.md
+```
+
+### Host + tree (not all in Git)
+
+```text
+# Meta repo (this workspace)
+docs/004-phonesky-runbook.md
+docs/004-lab-selfcheck.md
+vendor packaging stubs / product mk (synced to rom-dev01 tree)
+
+# rom-dev01 (canonical build)
+/srv/rom/src/lineage/                 # LOS tree
+/srv/rom/prebuilts/microg/            # GmsCore + GsfProxy APKs (gitignored host)
+/srv/rom/prebuilts/phonesky/          # Phonesky APK + permission XMLs
+/srv/rom/secrets/phonesky-signing/    # keys if we re-sign (optional first pass)
+/srv/rom/artifacts/004-…/             # build zip + self-check evidence
+```
+
+## Complexity Tracking
+
+| Violation | Why needed | Simpler alternative rejected because |
+|-----------|------------|--------------------------------------|
+| None | — | — |
+
+## Phase 0 / Phase 1
+
+See `research.md`, `data-model.md`, `contracts/packages.md`, `quickstart.md`.
@@ -0,0 +1,42 @@
+# Quickstart: validate 004 on LAB
+
+## Prerequisites
+
+- `003` vanilla known-good on LAB (or re-flash `004` build cleanly)
+- Serial **only** `11231JEC207477`
+- Host prebuilts populated per `docs/004-phonesky-runbook.md`
+
+## Build (rom-dev01)
+
+```bash
+ssh a16-build   # or android-build via a16-build alias
+# ensure prebuilts exist
+cat /srv/rom/prebuilts/microg/VERSIONS.txt
+cat /srv/rom/prebuilts/phonesky/VERSIONS.txt
+cd /srv/rom/src/lineage
+source build/envsetup.sh
+breakfast sunfish userdebug
+mka bacon -j8
+```
+
+Copy zip to `/srv/rom/artifacts/004-…/` + SHA-256; rsync to laptop.
+
+## Flash LAB
+
+Same flow as `docs/003-flash-lab.md` (dtbo → boot recovery → format if needed →
+sideload). **No** GApps add-ons beyond what is already in the ROM image.
+
+## Validate
+
+1. `adb devices` shows LAB only.
+2. Package contract (`contracts/packages.md`).
+3. Open **microG Settings → Self-Check**; screenshot to
+   `/srv/rom/artifacts/004-…/selfcheck/` (or laptop `.local-artifacts`).
+4. Open Play Store; note whether login/install works or is blocked pending
+   `005`.
+5. Confirm no Magisk/KSU: `pm list packages | grep -iE 'magisk|kernelsu'`.
+
+## Pass criteria
+
+- SC-001…SC-005 from `spec.md`
+- Spoofing-only Self-Check failures explicitly listed as `005` follow-ups
@@ -0,0 +1,95 @@
+# Research: 004 microG + Phonesky
+
+## Decision: Packaging layout — follow AXP GOLDEN scheme (owner 2026-09-15)
+
+**Decision**: Mirror AXP GOLDEN partition roles. Do not invent a `product`-centric
+layout. Measured on GOLDEN (`002`):
+
+| Package | AXP GOLDEN path | Our packaging |
+|---------|-----------------|---------------|
+| Phonesky | `/system/priv-app/Phonesky_AXP-OS` | **system** + privileged |
+| GmsCore | `/system_ext/app/MicrogGmsCore_GH_presigned` | **system_ext** app (not priv-app) |
+| GsfProxy | `/system_ext/app/GsfProxy_GH` | **system_ext** app |
+
+Ship via a small `vendor/sunfish-a16` include (partner_gms *pattern*) but
+**replace FakeStore** with patched Phonesky. Permission XMLs follow the same
+partitions (`system` for Phonesky, `system_ext` for microG).
+
+**Rationale**: Owner — AXP methods exist for a reason; goal is modernize (LOS
+23.2 / A16) and later replace Magisk with KSU-Next+SusFS (`007`), not redesign
+the compatibility stack. Ad-hoc `LOCAL_PRODUCT_MODULE` + ABI-strip/re-sign of
+GmsCore risks different update/SELinux/behaviour vs GOLDEN.
+
+**Alternatives rejected**:
+- All on `PRODUCT` — layout drift; hit partition checks awkwardly
+- ABI-strip + project re-sign of GmsCore — breaks official microG F-Droid signer
+- Stock lineageos4microg + FakeStore — wrong Store model
+- Magisk module installers — not for `004` (root is `007`, non-Magisk)
+
+**Partition headroom**: AXP release Phonesky APKs stay **fat** (all ABIs); CI
+does not strip x86. If LOS 23.2 sunfish `BOARD_SUPER_PARTITION_ERROR_LIMIT` is
+too tight for this package set, raise the error limit modestly (still under
+`BOARD_GOOGLE_DYNAMIC_PARTITIONS_SIZE`) rather than breaking microG’s signer.
+
+## Decision: Phonesky binary — patch latest, AXP procedure, project sign
+
+**Decision**: Latest official Play (apkmd) → AXP `patch-playstore` → project JKS
+under `/srv/rom/secrets/phonesky-signing/`. XMLs from AXP `etc/`. Do **not** ship
+`Phonesky_AXP-OS-signed.apk` as product (wrong trust domain). Keep fat APK unless
+a later measured need forces arch filtering (document then).
+
+## Decision: microG — latest official PRESIGNED + F-Droid
+
+**Decision**: Latest official GmsCore **default** APK (`com.google.android.gms-*.apk`
+without `-hw`) + GsfProxy, `PRESIGNED`, system_ext like AXP `*_GH_presigned`.
+Never re-sign. F-Droid microG repo is the update path. No FakeStore/Companion APK
+from microG releases.
+
+**Do not ship `*-hw.apk`**: that Huawei flavor omits
+`NetworkLocationService` / `NetworkLocationProviderService` from the manifest, so
+microG Location hides Wi‑Fi/cell NLP toggles. GOLDEN ships the default flavor
+(`versionName` without `-hw`, e.g. `0.3.15.250932`); LAB previously had
+`0.3.16.252432-hw` and only Timeline — corrected 2026-09-16 to
+`0.3.16.252432` default for GOLDEN Location UI parity.
+
+## Decision: Signature spoofing in `004`
+
+**Decision**: Use LOS 23.2 restricted spoofing only; gaps → `005`.
+
+## Decision: AXP scheme vs Android 16 / LOS 23.2 (owner 2026-09-15)
+
+**Decision**: Prefer the AXP **A15 / GOLDEN** packaging and behaviour scheme when
+LOS 23.2 / Android 16 still supports it. If A16 makes an equivalent path
+*easier* (cleaner APIs, existing LOS hooks), use that — still targeting the
+same end state (priv Play, updatable official-signer microG, banking path).
+If A16 makes the AXP path *harder* or impossible, do **not** silently invent a
+divergent stack: document the blocker and redesign the route to the **same**
+goals (layout roles, update model, no Magisk-shaped packaging).
+
+**Rationale**: AXP’s choices were intentional; A16 is a port/modernization, not
+a license to ignore the oracle. Divergence only when measured necessity.
+
+**Oracle scope (owner 2026-09-16)**: GOLDEN and abu are **Android 15** reference
+images — use them for packaging/layout/behaviour (e.g. which GmsCore *flavor*
+exposes Location NLP), not as a pin to their older package versions. On LOS 23.2
+/ A16 we ship the **newest** fitting official microG (and peers) that preserve
+that scheme (default/non-hw GmsCore, not `*-hw`).
+
+**Measured A16 blocker (2026-09-14)**: Putting Phonesky on `system/priv-app`
+fails `artifact_path_requirements` (`generic_system.mk`) under LOS 23.2.
+**Route to same end state**: keep AXP paths and add them to
+`PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST` (same mechanism sunfish already
+uses for a few system libs) — do not move Phonesky to `product` just to silence
+the check. GmsCore/Gsf on `system_ext` already passed.
+
+**Align-first (owner 2026-09-15)**: Do not invent `privapp-permissions` for
+GmsCore while GOLDEN ships it as non-privileged `system_ext` app. Ship only
+AXP Phonesky XMLs; repair from Self-Check / build errors if A16 truly requires
+more.
+
+## Decision: Signing strategy (FR-010) — locked
+
+| Package | Signer | Update path |
+|---------|--------|-------------|
+| GmsCore / GsfProxy | Official microG (`PRESIGNED`) | F-Droid microG repo |
+| Phonesky | Project JKS `/srv/rom/secrets/phonesky-signing/` | Same-signer patched APKs |
@@ -0,0 +1,178 @@
+# Feature Specification: microG + GSF Proxy + patched Phonesky
+
+**Feature Branch**: `004-microg-phonesky-integration`  
+**Created**: 2026-09-14  
+**Status**: Draft  
+**Input**: Continue after `003` gate — integrate Google compatibility stack on LAB
+vanilla LOS 23.2 / Android 16 (sunfish), without Magisk/KernelSU yet.
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - microG Self-Check green on LAB (Priority: P1)
+
+As the developer, after flashing a build that includes microG + GSF Proxy, I can
+open microG Settings Self-Check and see the checks required for basic Google
+compatibility pass (or document exact remaining gaps owned by `005`).
+
+**Why this priority**: Without a working microG core, Play and banking paths
+cannot start.
+
+**Independent Test**: Flash LAB-only build; open microG Self-Check; capture
+screenshots/log; no Magisk/KSU installed.
+
+**Acceptance Scenarios**:
+
+1. **Given** LAB on `003` vanilla baseline, **When** a `004` build is flashed,
+   **Then** `com.google.android.gms` and `com.google.android.gsf` are present as
+   system packages and microG Settings opens.
+2. **Given** microG is configured (device registration as required), **When**
+   Self-Check runs, **Then** either all P1 checks pass, or each failure is
+   explicitly attributed to signature spoofing (`005`) vs packaging error.
+
+---
+
+### User Story 2 - Patched Phonesky as priv-app (Priority: P1)
+
+As the developer, patched Play Store (`com.android.vending`) is installed as a
+privileged system app with required permission XMLs, obtained/patched/signed via
+a documented host-side procedure (APK never committed to Git).
+
+**Why this priority**: Constitution requires AXP-style patched Phonesky, not
+FakeStore→Play as primary.
+
+**Independent Test**: Package present as priv-app; permission XMLs deployed;
+Play UI launches; update path documented even if spoofing still incomplete.
+
+**Acceptance Scenarios**:
+
+1. **Given** Phonesky artifacts under a restricted host path, **When** the ROM
+   is built, **Then** `com.android.vending` is a privileged system app with the
+   required default-permission / privapp-permissions configuration.
+2. **Given** the build is flashed to LAB, **When** Play Store is opened,
+   **Then** it starts (login/install may still depend on `005` spoofing — mark
+   clearly if so).
+3. **Given** Git history, **When** inspected, **Then** no Google proprietary
+   Phonesky APK bytes are committed.
+
+---
+
+### User Story 3 - No FakeStore conflict (Priority: P2)
+
+As the developer, FakeStore / microG Companion are not installed when they would
+conflict with real patched `com.android.vending`.
+
+**Why this priority**: Prevents the wrong Play stub from masking Phonesky.
+
+**Independent Test**: `pm list packages` shows no conflicting FakeStore when
+Phonesky is present.
+
+**Acceptance Scenarios**:
+
+1. **Given** Phonesky is included, **When** packages are listed, **Then**
+   FakeStore is absent (or explicitly disabled with documented reason).
+
+---
+
+### User Story 4 - Reproducible obtain → patch → sign pipeline (Priority: P2)
+
+As the developer, I can re-run a documented procedure on `rom-dev01` to produce
+signed Phonesky + microG packaging inputs without tribal knowledge.
+
+**Why this priority**: Required before any updatable Play Store distribution.
+
+**Independent Test**: Second operator (or clean host path) follows the runbook
+and produces matching package names/permissions (signature may differ if keys
+differ — keys stay host-only).
+
+**Acceptance Scenarios**:
+
+1. **Given** the `004` runbook, **When** followed on `rom-dev01`, **Then**
+   inputs land under `/srv/rom/…` (restricted) and the build consumes them
+   without manual one-off hacks.
+2. **Given** signing keys, **When** stored, **Then** they live only under
+   host secrets (e.g. `/srv/rom/secrets/`), never in Git.
+
+---
+
+### Edge Cases
+
+- LOS 23.2 already ships partial microG spoofing → use it; do not invent a full
+  spoofing stack in `004` (that is `005`).
+- Self-Check fails only on signature-related items → record as `005` dependency,
+  not a `004` packaging failure.
+- Play login/install fails while Self-Check packaging is OK → same split.
+- Flash/upgrade wipes user data → LAB only; never GOLDEN.
+- Wrong device serial → abort flash.
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+- **FR-001**: Integrate **latest** official microG Services Core as
+  `com.google.android.gms` on the LOS 23.2 sunfish LAB build (do not pin to
+  GOLDEN’s older version).
+- **FR-002**: Integrate GSF Proxy as `com.google.android.gsf` (latest upstream).
+- **FR-003**: Integrate patched Phonesky as privileged `com.android.vending`
+  with required privapp-permissions / default-permissions XML, produced by
+  patching the **latest** official Play Store APK (not an AXP archive binary).
+- **FR-004**: Document and implement a reproducible obtain → patch → sign →
+  priv-app pipeline for Phonesky on `rom-dev01` using AXP `patch-playstore` /
+  apktool; proprietary APKs MUST NOT be committed to Git.
+- **FR-005**: Do not install FakeStore (or conflicting Companion) alongside
+  patched Phonesky.
+- **FR-006**: Record microG Self-Check results on LAB (pass/fail per item) after
+  flash; attribute spoofing-related failures to `005`.
+- **FR-007**: Keep Magisk and KernelSU out of `004` builds (root arrives in
+  `007`; banking baseline rootless in `006`).
+- **FR-008**: Flash and validate on LAB serial `11231JEC207477` only; never
+  GOLDEN `11071JEC203839`.
+- **FR-009**: Prefer AXP golden packaging behaviour as reference (inventory from
+  `002`); do not blind-copy Magisk modules or ship AXP-signed Play as product.
+- **FR-010**: Phonesky is signed with a **project-owned** stable keystore under
+  `/srv/rom/secrets/phonesky-signing/` so later patched Builds can update Play.
+- **FR-011**: microG GmsCore/GsfProxy MUST remain **PRESIGNED** with the
+  official microG signer so they stay updatable from the microG F-Droid
+  repository; document repo setup for LAB Self-Check.
+
+### Key Entities
+
+- **microG Services Core** — `com.google.android.gms`
+- **GSF Proxy** — `com.google.android.gsf`
+- **Patched Phonesky** — `com.android.vending` (external proprietary input)
+- **LAB** — Pixel 4a `11231JEC207477` (Android 16 / LOS 23.2 target)
+- **GOLDEN** — AXP Pro Android 15 reference (read-only)
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-001**: LAB build includes microG + GSF + patched Phonesky packages with
+  correct package names.
+- **SC-002**: microG Self-Check evidence captured; packaging failures = 0; any
+  remaining failures mapped to `005` or explicitly accepted.
+- **SC-003**: Phonesky opens on LAB; Git contains no proprietary Play APK.
+- **SC-004**: Runbook exists such that a clean `rom-dev01` path can rebuild the
+  same packaging layout.
+- **SC-005**: No Magisk/KSU in the `004` validation build.
+
+## Assumptions
+
+- `003` vanilla baseline remains the parent tree; `004` adds packaging/patches
+  on top without unrelated hardening.
+- LineageOS 23.2 microG-oriented spoofing hooks may already exist; full
+  restricted spoofing policy is `005`.
+- `002` / GOLDEN inventory supplies reference behaviour and permission
+  patterns only — not version pins for microG or Play.
+- Phonesky binary is obtained outside Git via latest Play APK + AXP
+  `patch-playstore` (apktool) + project signing keys on `rom-dev01`.
+- Official microG release APKs share the signer used by the microG F-Droid
+  repo, enabling same-package updates without re-signing.
+
+## Out of Scope
+
+- Signature spoofing implementation beyond using what LOS already provides
+  (`005`)
+- Insular / banking hard-gates (`006`)
+- KernelSU (`007`)
+- Release signing / AVB relock (`011`)
+- Flashing or modifying GOLDEN
@@ -0,0 +1,94 @@
+# Tasks: microG + GSF Proxy + patched Phonesky
+
+**Input**: Design docs from `/specs/004-microg-phonesky-integration/`  
+**Prerequisites**: `003` gate (`docs/003-gate-handoff.md`)
+
+## Phase 1: Setup
+
+- [x] T001 Create host dirs `/srv/rom/prebuilts/{microg,phonesky}/` and
+      `/srv/rom/artifacts/004-microg/` on `rom-dev01` (android-build writable)
+- [x] T002 [P] Add `docs/004-phonesky-runbook.md` (obtain → place APKs → versions
+      file → no Git) in meta repo
+- [x] T003 [P] Add `docs/004-lab-selfcheck.md` stub (Self-Check table + `005`
+      attribution) in meta repo
+
+## Phase 2: Foundational
+
+- [x] T004 Stage **latest** microG GmsCore + GsfProxy APKs into
+      `/srv/rom/prebuilts/microg/` + `VERSIONS.txt` (URLs/hashes;
+      `PRESIGNED` for F-Droid updates) — currently `v0.3.16.252432` /
+      GsfProxy `v0.1.0` (GitHub latest as of 2026-09-14)
+- [x] T005 Obtain **latest** official Play Store (apkmd), patch with AXP
+      `patch-playstore` + apktool, sign with project JKS under
+      `/srv/rom/secrets/phonesky-signing/`; stage APK + AXP permission XMLs
+      into `/srv/rom/prebuilts/phonesky/` + `VERSIONS.txt`
+      *(Play **52.9.22-24**, not AXP archive)*
+- [x] T006 Add LOS product/vendor makefile include that packages the three APKs
+      as system/priv-app **without FakeStore** (`vendor/sunfish-a16/` on host tree)
+- [x] T007 Wire include into `lineage_sunfish` product so `mka bacon` picks it up
+
+## Phase 3: User Story 1 — microG Self-Check (P1)
+
+**Goal**: GmsCore + GsfProxy on LAB; Self-Check evidence  
+**Independent test**: packages present; Self-Check screenshots
+
+- [x] T008 [US1] Build `004` image (`mka bacon -j8`); log under
+      `/srv/rom/logs/004-build/` — **superseded by `005` T020 bacon**
+      (`bacon-20260915T103756Z.log`)
+- [x] T009 [US1] Flash LAB only (`11231JEC207477`) per quickstart —
+      **superseded by `005` T022**
+- [x] T010 [US1] Verify `pm path` for `com.google.android.gms` and
+      `com.google.android.gsf`; fill `docs/004-lab-selfcheck.md` —
+      **done via `005` US6** (2026-09-15)
+
+## Phase 4: User Story 2 — Patched Phonesky (P1)
+
+**Goal**: priv-app Phonesky with XMLs; Play launches  
+**Independent test**: `pm path com.android.vending`; app opens
+
+- [x] T011 [US2] Confirm privapp-permissions XMLs installed on device
+      (`/etc/permissions` or equivalent) — **covered by `005` packaging**
+- [x] T012 [US2] Launch Play Store on LAB; record result — **pass after
+      `005` spoof + exact-alarm** (was blocked → `005`, now closed)
+- [x] T013 [US2] Confirm Git/meta repo contains **no** Phonesky APK bytes
+
+## Phase 5: User Story 3 — No FakeStore (P2)
+
+- [x] T014 [US3] `pm list packages` shows no FakeStore; document in self-check
+      — **`docs/004-lab-selfcheck.md` 2026-09-15**
+
+## Phase 6: User Story 4 — Reproducible pipeline (P2)
+
+- [x] T015 [US4] Finalize runbook with exact copy commands from AXP archive +
+      microG download pins — **`docs/004-phonesky-runbook.md` + `005` runbook**
+- [x] T016 [US4] Document FR-010 signing strategy (project JKS under
+      `/srv/rom/secrets/phonesky-signing/`; GmsCore stays PRESIGNED)
+
+## Phase 7: Polish
+
+- [x] T017 Collect artifacts: zip SHA-256, `VERSIONS.txt` copies, Self-Check
+      evidence → **`005` artifacts `20260915-bacon` + `20260915-us6-validation`**
+- [x] T018 Update `docs/axp-pro-parity.md` rows microG/Phonesky status —
+      **done in `005` T027**
+- [x] T019 Handoff note: spoofing done in `005`; next `006` banking rootless;
+      no Magisk/KSU in this build
+
+## Dependencies
+
+- T001–T003 before staging  
+- T004–T007 before build  
+- T008–T010 (US1) before claiming microG done  
+- T011–T013 (US2) can overlap validation with US1 after same flash  
+- T014 after flash  
+- T015–T016 can refine docs in parallel with builds  
+- T017–T019 after validation  
+
+## MVP
+
+T001–T012: packages on LAB + Self-Check notes + Play launch attempt.
+
+## Parallel opportunities
+
+- T002/T003 with T001  
+- T004/T005 in parallel  
+- Doc polish T015/T016 while T008 builds