AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
2026-09-16 21:56:22 +00:00
commit 12d2179c20
@@ -0,0 +1,39 @@
+# Contract: Yuh hard-gate (banking)
+
+**Feature**: `007-kernelsu-sunfish`  
+**Device**: LAB `11231JEC207477` only
+
+## Hard-gate
+
+| App | Profile | Required outcome to accept `007` |
+|-----|---------|----------------------------------|
+| Yuh (`com.yuh`) | Island (work user) | **PASS** — usable authenticated session |
+| Swissquote | Island | **PASS** — usable authenticated session; does not waive Yuh |
+| N26 / Revolut | any | Non-blocking |
+
+## Preconditions for a valid Yuh PASS attempt
+
+1. Build includes KernelSU-Next pin under test.
+2. Yuh UID(s) have **root deny** + **verified** mount hide (`ksu-hide-surface.md`).
+3. Install path prefers Aurora → do not open → Island clone → first launch in
+   Island (AXP-like); document deviations.
+4. Attestation/SusFS experiments in use are listed with revisions.
+
+## FAIL handling
+
+- Capture `keystore2` / KeyMint / RKP / Yuh UI error (compare `002`).
+- Iterate SusFS/attestation pins; do not mark feature done.
+- Exhausted options → `007` **incomplete or cancelled**; prefer stock phone for
+  banks rather than shipping root without Yuh.
+
+## PASS evidence package
+
+- Build id + date
+- Profile user id
+- Stack pins (KSU, SusFS, modules)
+- Short log excerpt showing absence of prior `HARDWARE_TYPE_UNAVAILABLE` class
+  *or* explicit note if a different success path applies
+- Stored under `/srv/rom/artifacts/007-kernelsu/…`
+
+US5 exclusively owns acceptance. Both banks must pass on the same build/stack;
+failure of either keeps the feature incomplete or triggers withdrawal of root.
@@ -0,0 +1,40 @@
+# Contract: KernelSU hide / umount surface
+
+**Feature**: `007-kernelsu-sunfish`  
+**Consumers**: LAB validation (`quickstart.md`), future `011` signed builds
+
+## Root grant
+
+| Rule | Requirement |
+|------|-------------|
+| Default | No app has root until explicitly allowed |
+| Banking | `com.yuh`, `com.swissquote.android` → **deny** on all tested `userId`s |
+| Proof | Manager UI alone insufficient; show failed `su`/root API from those UIDs |
+
+## Mount hide
+
+| Rule | Requirement |
+|------|-------------|
+| Mechanism | KernelSU umount / profile hide (and SusFS when enabled) |
+| Proof | From banking (or probe) UID, sensitive module/overlay paths that appear
+  to a normal rooted UID are **absent** or inaccessible |
+| `path_umount` | Must work on this 4.14 integration or be explicitly filed as blocker |
+
+## Non-goals
+
+- Magisk DenyList semantics as the production contract
+- LSPosed/Zygisk hide
+- Claiming “legitimate system” without Yuh PASS (see `banking-yuh-gate.md`)
+
+## Mandatory evidence checklist
+
+For each banking package × tested user ID, record PASS/FAIL, method and artifact:
+- root grant denied;
+- denied root access demonstrated;
+- module mount visibility before/after recorded;
+- configured unmount mechanism actually removes the test mount.
+
+All rows must PASS. A probe must reproduce the target policy and namespace;
+a different UID with unrelated settings is not evidence for the banking UID.
+Unavailable evidence is unverified, not PASS. Optional SUSFS checks apply only
+when enabled and must identify their tested paths.