AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/007-kernelsu-sunfish/contracts/ksu-hide-surface.md

@@ -0,0 +1,40 @@
+# Contract: KernelSU hide / umount surface
+
+**Feature**: `007-kernelsu-sunfish`  
+**Consumers**: LAB validation (`quickstart.md`), future `011` signed builds
+
+## Root grant
+
+| Rule | Requirement |
+|------|-------------|
+| Default | No app has root until explicitly allowed |
+| Banking | `com.yuh`, `com.swissquote.android` → **deny** on all tested `userId`s |
+| Proof | Manager UI alone insufficient; show failed `su`/root API from those UIDs |
+
+## Mount hide
+
+| Rule | Requirement |
+|------|-------------|
+| Mechanism | KernelSU umount / profile hide (and SusFS when enabled) |
+| Proof | From banking (or probe) UID, sensitive module/overlay paths that appear
+  to a normal rooted UID are **absent** or inaccessible |
+| `path_umount` | Must work on this 4.14 integration or be explicitly filed as blocker |
+
+## Non-goals
+
+- Magisk DenyList semantics as the production contract
+- LSPosed/Zygisk hide
+- Claiming “legitimate system” without Yuh PASS (see `banking-yuh-gate.md`)
+
+## Mandatory evidence checklist
+
+For each banking package × tested user ID, record PASS/FAIL, method and artifact:
+- root grant denied;
+- denied root access demonstrated;
+- module mount visibility before/after recorded;
+- configured unmount mechanism actually removes the test mount.
+
+All rows must PASS. A probe must reproduce the target policy and namespace;
+a different UID with unrelated settings is not evidence for the banking UID.
+Unavailable evidence is unverified, not PASS. Optional SUSFS checks apply only
+when enabled and must identify their tested paths.