AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
2026-09-16 21:56:22 +00:00
commit 12d2179c20
@@ -0,0 +1,70 @@
+# Data model: 005 spoofing + first-stack entities
+
+## GlobalSpoofingToggle
+
+| Field | Description |
+|-------|-------------|
+| Setting key | `settings secure allow_signature_fake` (AXP/GOLDEN) |
+| Values | `0` / unset = OFF; `1` = ON |
+| Default | OFF |
+| UI | Developer Options → Signature spoofing support → Allow signature spoofing |
+| Effect when OFF | Prior per-app grants ignored (silent deny) |
+
+## SpoofingPermission
+
+| Field | Description |
+|-------|-------------|
+| Name | `android.permission.FAKE_PACKAGE_SIGNATURE` |
+| Protection | dangerous (user-grantable), as on GOLDEN |
+| Grant state | Per package / per user; GOLDEN uses `USER_SET` for gms + vending |
+| Revoke UI | App permissions → Spoof package signature (AXP strings) |
+
+## AuthorizedPackage
+
+| Package | Signer identity | Notes |
+|---------|-----------------|-------|
+| `com.google.android.gms` | Official microG PRESIGNED | System_ext app; F-Droid updates |
+| `com.android.vending` | Project Phonesky JKS | System priv-app; `fake-signature` meta-data |
+
+Extension of this set requires constitution-aligned review (not open allow-all).
+
+## FakeSignatureMetadata
+
+| Field | Description |
+|-------|-------------|
+| APK meta-data name | `fake-signature` |
+| Value | Hex-encoded Google platform certificate (injected by AXP `patch-playstore`) |
+| Consumer | PackageManager spoofing path when permission granted + toggle ON |
+
+## PackagingArtifacts (first-stack ship)
+
+| Artifact | Rule |
+|----------|------|
+| GmsCore / Gsf / Phonesky APKs | PRESIGNED install without zip-realign strip (`REPLACE_PREBUILT`) |
+| Phonesky privapp XML | Includes FAKE_PACKAGE + A16 FGS / exact-alarm / Play 52 extras; digest = **our** cert |
+| Default-permissions / sysconfig | Align with GOLDEN `er_*` intent (power-save, app-link) as needed |
+
+## LocationConfig (validation, not a package)
+
+| Field | Description |
+|-------|-------------|
+| Provider | microG built-in network location (0.3.x) |
+| Endpoint | Ichnaea-compatible URL (BeaconDB: `https://api.beacondb.net`) |
+| Non-goals | UnifiedNlp backend APKs; Mozilla MLS |
+
+## State transitions
+
+```text
+[Toggle OFF] --enable in Dev Options--> [Toggle ON]
+     |                                      |
+     v                                      v
+ spoof denied                          prompts/grants for
+ for all apps                          authorized packages
+                                            |
+                                            v
+                               [Permission granted]
+                                            |
+                                            v
+                         PackageInfo signatures + signingInfo
+                         present Google identity to callers
+```