AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/005-restricted-signature-spoofing/contracts/spoofing-surface.md

@@ -0,0 +1,59 @@
+# Contract: Spoofing surface (LAB / user-visible)
+
+## Settings
+
+| Interface | Contract |
+|-----------|----------|
+| Secure setting | `allow_signature_fake` ∈ {`null`/`0`, `1`} |
+| Readback | `adb shell settings get secure allow_signature_fake` |
+| UI | Developer Options exposes enable/disable; OFF disables effect of grants |
+
+## Permission
+
+| Interface | Contract |
+|-----------|----------|
+| Permission name | `android.permission.FAKE_PACKAGE_SIGNATURE` |
+| `pm list permissions` | Permission is listed (not “Unknown permission”) |
+| Grant | Visible in `dumpsys package <pkg>` for authorized packages when user granted |
+
+## PackageManager behaviour
+
+When **toggle ON** and package **has grant** and **has** `meta-data fake-signature`
+(or microG’s equivalent spoof path):
+
+- Callers using legacy signature APIs and signing-certificate APIs MUST observe
+  the faked Google identity for that package (sufficient for microG Self-Check
+  “correct signature” and Play OAuth registration checks).
+
+When **toggle OFF**:
+
+- Effective spoofing MUST NOT occur (silent deny).
+
+## Allow-list
+
+| Package | Required |
+|---------|----------|
+| `com.google.android.gms` | yes |
+| `com.android.vending` | yes |
+| Other packages | denied unless explicitly added later under project policy |
+
+## First-stack package registration
+
+| Package | `pm path` expectation |
+|---------|----------------------|
+| `com.google.android.gms` | system_ext app path |
+| `com.google.android.gsf` | system_ext app path |
+| `com.android.vending` | system priv-app Phonesky path |
+
+PRESIGNED APKs in the shipped image MUST verify with APK Signature Scheme v2/v3
+(no post-sign strip).
+
+## Location (documentation contract)
+
+Quickstart MUST specify:
+
+1. Open microG → Location  
+2. Enable network/Wi-Fi location as required by UI  
+3. Set service URL to BeaconDB (or documented successor), not MLS  
+
+No requirement to install UnifiedNlp backend packages.