AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
2026-09-16 21:56:22 +00:00
commit 12d2179c20
@@ -0,0 +1,264 @@
+# Tasks: Restricted native signature spoofing (first working stack)
+
+**Input**: Design docs from `/specs/005-restricted-signature-spoofing/`  
+**Prerequisites**: `004` packaging on LAB (Phonesky present); GOLDEN oracle
+`.local-artifacts/002-golden/20260915-spoofing-phonesky/`; constitution spoofing rules
+
+**Organization**: First working stack = packaging leftovers + spoofing + BeaconDB.
+**Out of scope**: `006` banking, `007` KSU/root.
+
+## Format: `[ID] [P?] [Story] Description`
+
+- **[P]**: Can run in parallel (different files, no incomplete deps)
+- **[Story]**: US1…US6 from `spec.md`
+
+## Path conventions
+
+- Meta repo: `vendor/sunfish-a16/`, `docs/`, `specs/005-…/`
+- Build host: `/srv/rom/src/lineage/` (frameworks, Settings), `/srv/rom/artifacts/005-…/`
+
+---
+
+## Phase 1: Setup
+
+**Purpose**: Patch sources, dirs, delta notes
+
+- [x] T001 Checkout / mirror EXTENDROM sigspoof sources on `rom-dev01` under
+      `/srv/rom/references/extendrom/` (or sparse clone
+      `sfX-android/android_vendor_extendrom`); record commit in
+      `docs/a15-a16-delta.md`
+      *(2026-09-15: `f129253c…`; also found stock LuK1337 spoof in LOS tree)*
+- [x] T002 [P] Create `/srv/rom/artifacts/005-spoofing/` and
+      `/srv/rom/logs/005-build/` (android-build writable)
+- [x] T003 [P] Add `docs/005-spoofing-runbook.md` stub (EXTENDROM port steps,
+      allow-list, LAB-only) in meta repo
+- [x] T004 [P] Confirm working-tree packaging leftovers present:
+      `vendor/sunfish-a16/Android.mk` has `LOCAL_REPLACE_PREBUILT_APK_INSTALLED`;
+      `vendor/sunfish-a16/permissions/privapp-permissions-com.android.vending.xml`
+      has FGS/exact-alarm + Play 52 entries — sync both to
+      `/srv/rom/src/lineage/vendor/sunfish-a16/`
+
+---
+
+## Phase 2: Foundational (blocks all stories)
+
+**Purpose**: A16-portable spoofing patch set + product wiring; no bacon yet
+
+**⚠️ CRITICAL**: No US validation flash until this phase completes
+
+- [x] T005 Inventory EXTENDROM A15 patch list vs LOS 23.2 paths; write mapping
+      table in `docs/a15-a16-delta.md` (frameworks/base, services, Settings,
+      overlays)
+- [x] T006 Apply / port EXTENDROM signature-spoofing patches to
+      `/srv/rom/src/lineage/frameworks/base/` so
+      `android.permission.FAKE_PACKAGE_SIGNATURE` exists and
+      `meta-data fake-signature` is honoured for **both**
+      `PackageInfo.signatures` and `PackageInfo.signingInfo`
+      *(extended LuK1337 path via `apply_005_sigspoof.py`)*
+- [x] T007 Wire global gate `settings secure allow_signature_fake` in
+      PackageManager path under
+      `/srv/rom/src/lineage/frameworks/base/services/` (silent deny when off)
+- [x] T008 Restrict effective spoofing to allow-list packages/signers
+      (`com.google.android.gms` official microG; `com.android.vending` project
+      Phonesky digest
+      `31:31:86:CB:7D:F2:D4:01:33:72:12:07:B7:29:73:E8:52:F6:1C:87:67:C3:21:E5:C7:50:39:01:1B:83:BD:56`)
+      — document mechanism in `docs/005-spoofing-runbook.md`
+- [x] T009 [P] Update Phonesky privapp/default XMLs in
+      `vendor/sunfish-a16/permissions/` to include `FAKE_PACKAGE_SIGNATURE` and
+      bind Phonesky entries to **our** cert SHA-256 digest (not AXP
+      `00:5C:98:…`); sync to host tree
+      *(FAKE_PACKAGE already in privapp; digest enforced in ComputerEngine)*
+- [ ] T010 [P] Align GmsCore-related default-permissions / sysconfig intent from
+      GOLDEN `er_*` files into `vendor/sunfish-a16/` (power-save / app-link as
+      needed) without inventing GmsCore priv-app
+
+**Checkpoint**: Foundation ready — bacon is next (US6)
+
+---
+
+## Phase 3: User Story 1 — Developer Options master switch (P1) 🎯 MVP slice
+
+**Goal**: Toggle **Allow signature spoofing** in Developer Options  
+**Independent test**: UI present; `settings get secure allow_signature_fake` is
+`1` when ON; OFF disables effect
+
+- [x] T011 [US1] Port EXTENDROM/AXP Settings Developer Options strings +
+      preference for `allow_signature_fake` into
+      `/srv/rom/src/lineage/packages/apps/Settings/` (or overlay under
+      `vendor/sunfish-a16/`) matching GOLDEN UX
+      (`signature_spoof_category` / Allow signature spoofing)
+- [ ] T012 [US1] Verify default is OFF; toggling ON/OFF persists across reboot
+      (device proof after US6 flash)
+
+**Checkpoint**: US1 code landed in tree (validated on device in US6 flash)
+
+---
+
+## Phase 4: User Story 4 — Restricted allow-list only (P1)
+
+**Goal**: Non-authorized apps cannot effectively spoof  
+**Independent test**: Third-party test APK requesting FAKE_PACKAGE denied
+
+- [ ] T013 [US4] Add allow-list enforcement tests/notes in
+      `docs/005-spoofing-runbook.md` (manual LAB procedure + expected deny)
+- [ ] T014 [US4] Confirm implementation from T008 rejects non-listed packages
+      even with toggle ON (code review + LAB check after flash)
+
+**Checkpoint**: Policy documented; enforcement in PMS path
+
+---
+
+## Phase 5: User Story 2 — Self-Check correct signatures (P1)
+
+**Goal**: microG Self-Check marks correct signature for GmsCore + Phonesky  
+**Independent test**: Self-Check screenshots after grants
+
+- [ ] T015 [US2] Ensure grant path works (permission UI / Self-Check tap) —
+      no missing `GrantFakeSignaturePermissionActivity` / unknown permission
+- [ ] T016 [US2] Update `docs/004-lab-selfcheck.md` with spoofing steps and
+      expected green signature rows (post-`005`)
+
+**Checkpoint**: Self-Check contract ready; device proof in US6
+
+---
+
+## Phase 6: User Story 3 — Play auth without API-console mismatch (P1)
+
+**Goal**: Play sign-in without `UNREGISTERED_ON_API_CONSOLE`  
+**Independent test**: logcat during login
+
+- [ ] T017 [US3] Document auth verification commands in
+      `specs/005-restricted-signature-spoofing/quickstart.md` (already drafted —
+      tighten failure signatures)
+- [ ] T018 [US3] After flash (US6), capture logcat proving absence of
+      `UNREGISTERED_ON_API_CONSOLE` for Phonesky; store under
+      `/srv/rom/artifacts/005-spoofing/`
+
+**Checkpoint**: Auth acceptance tied to US6 validation build
+
+---
+
+## Phase 7: User Story 5 — Survives without root (P2)
+
+**Goal**: Spoofing works with no Magisk/KSU  
+**Independent test**: build props / `pm` show no Magisk
+
+- [ ] T019 [US5] Confirm `005` product makefiles do not pull Magisk/KSU; note in
+      `docs/005-spoofing-runbook.md` and gate handoff
+
+---
+
+## Phase 8: User Story 6 — First working stack ship gate (P1)
+
+**Goal**: One zip = REPLACE packaging + FGS privapp + spoofing; BeaconDB docs  
+**Independent test**: `quickstart.md` end-to-end on LAB
+
+- [x] T020 [US6] `mka bacon -j8` on `rom-dev01`; log
+      `/srv/rom/logs/005-build/bacon.log`; verify intermediate Phonesky APK
+      `apksigner verify` (v2/v3) under `out/target/product/sunfish/`
+      *(SUCCESS 2026-09-15T14:27Z, 03:49:11; log
+      `bacon-20260915T103756Z.log`; zip SHA256
+      `1f08e00433e073e0b6525eb2539fe9011a291f34604a6917bf1836aecf03e383`;
+      Phonesky v2+v3 OK)*
+- [x] T021 [US6] Stage zip + imgs + SHA256 + VERSIONS + spoofing notes to
+      `/srv/rom/artifacts/005-spoofing/<date>/` and rsync to
+      `.local-artifacts/005-spoofing/`
+      *(host `…/20260915-bacon/`; laptop got SHA+triage+packaging-check;
+      full zip remains on host)*
+- [x] T022 [US6] Flash LAB only (`11231JEC207477`); confirm
+      `pm path` for gms/gsf/vending without remount
+      *(gms/gsf `/system_ext/…`; vending from zip then exact-alarm
+      `adb install -r` → `/data/app/…` until next bacon)*
+- [x] T023 [US6] Enable spoofing toggle; grant FAKE_PACKAGE to gms + vending;
+      Self-Check correct signature green
+      *(`allow_signature_fake=1`; user 0+10 grants; operator Self-Check pass)*
+- [x] T024 [US6] Play sign-in smoke; confirm no FGS VpaService crash loop; record
+      update-still-blocked as acceptable
+      *(installs OK both profiles after exact-alarm; UNREGISTERED count=0)*
+- [x] T025 [P] [US6] Document BeaconDB location steps in
+      `docs/004-lab-selfcheck.md` + `quickstart.md` (URL
+      `https://api.beacondb.net`; no UnifiedNlp backends)
+- [x] T026 [US6] Run full `specs/005-restricted-signature-spoofing/quickstart.md`
+      checklist; tick SC-001…SC-008
+      *(evidence `/srv/rom/artifacts/005-spoofing/20260915-us6-validation/`)*
+
+**Checkpoint**: First working stack accepted on LAB
+
+---
+
+## Phase 9: Polish
+
+- [x] T027 [P] Update `docs/axp-pro-parity.md` spoofing + microG/Phonesky rows
+- [x] T028 [P] Finalize `docs/a15-a16-delta.md` with A15→A16 spoofing port notes
+- [x] T029 Handoff: first stack done; next `006` banking rootless — **no** KSU
+      until after `006`
+- [x] T030 Mark remaining `004` tasks superseded/closed where `005` US6 covered
+      them (`specs/004-microg-phonesky-integration/tasks.md` notes)
+
+---
+
+## Dependencies & Execution Order
+
+### Phase dependencies
+
+- Phase 1 → Phase 2 (foundational patches) → US1/US4 code → US2/US3/US5 docs →
+  **US6 build/flash validates everything**
+- US6 is the integration gate; US1–US5 implementation lands before bacon when
+  possible, device proof in US6
+
+### User story dependencies
+
+| Story | Depends on |
+|-------|------------|
+| US1 toggle | T005–T007 (+ T011 Settings) |
+| US4 allow-list | T008 |
+| US2 Self-Check | T006–T009, US1 toggle |
+| US3 Play auth | US2 grants working |
+| US5 no root | Product wiring (Phase 2) |
+| US6 ship | All above + T004 packaging |
+
+### Parallel opportunities
+
+- T002, T003, T004 after T001 started  
+- T009, T010 while T006–T008 in progress (XML vs frameworks)  
+- T025 docs parallel with T020 build  
+- T027, T028 polish parallel  
+
+---
+
+## Parallel example: Foundational
+
+```text
+T009 Update Phonesky privapp digest + FAKE_PACKAGE in vendor/sunfish-a16/permissions/
+T010 Align GmsCore sysconfig/default-permissions stubs in vendor/sunfish-a16/
+T006 Port frameworks FAKE_PACKAGE + signingInfo spoof in frameworks/base/
+```
+
+---
+
+## Implementation strategy
+
+### MVP
+
+1. Phase 1–2 (patches + XML)  
+2. US1 Settings toggle  
+3. US6 bacon + LAB flash proving toggle + Self-Check + Play auth  
+
+### Incremental
+
+After MVP flash: tighten allow-list evidence (US4), BeaconDB doc polish (T025),
+parity docs (T027–T029).
+
+### Suggested first implement slice
+
+**T001 → T004 → T005–T011 → T020–T026** (skip polish until green Self-Check).
+
+---
+
+## Notes
+
+- Never flash GOLDEN; LAB serial only  
+- No Magisk/KSU in this feature  
+- Do not reintroduce UnifiedNlp backend APKs  
+- Prefer EXTENDROM attributable patches; record conflicts in delta doc  
+- User owns git commit/MR; agents only working tree / host build dirs