AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/007-kernelsu-sunfish/contracts/banking-yuh-gate.md

@@ -0,0 +1,39 @@
+# Contract: Yuh hard-gate (banking)
+
+**Feature**: `007-kernelsu-sunfish`  
+**Device**: LAB `11231JEC207477` only
+
+## Hard-gate
+
+| App | Profile | Required outcome to accept `007` |
+|-----|---------|----------------------------------|
+| Yuh (`com.yuh`) | Island (work user) | **PASS** — usable authenticated session |
+| Swissquote | Island | **PASS** — usable authenticated session; does not waive Yuh |
+| N26 / Revolut | any | Non-blocking |
+
+## Preconditions for a valid Yuh PASS attempt
+
+1. Build includes KernelSU-Next pin under test.
+2. Yuh UID(s) have **root deny** + **verified** mount hide (`ksu-hide-surface.md`).
+3. Install path prefers Aurora → do not open → Island clone → first launch in
+   Island (AXP-like); document deviations.
+4. Attestation/SusFS experiments in use are listed with revisions.
+
+## FAIL handling
+
+- Capture `keystore2` / KeyMint / RKP / Yuh UI error (compare `002`).
+- Iterate SusFS/attestation pins; do not mark feature done.
+- Exhausted options → `007` **incomplete or cancelled**; prefer stock phone for
+  banks rather than shipping root without Yuh.
+
+## PASS evidence package
+
+- Build id + date
+- Profile user id
+- Stack pins (KSU, SusFS, modules)
+- Short log excerpt showing absence of prior `HARDWARE_TYPE_UNAVAILABLE` class
+  *or* explicit note if a different success path applies
+- Stored under `/srv/rom/artifacts/007-kernelsu/…`
+
+US5 exclusively owns acceptance. Both banks must pass on the same build/stack;
+failure of either keeps the feature incomplete or triggers withdrawal of root.