AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/007-kernelsu-sunfish/data-model.md

@@ -0,0 +1,65 @@
+# Data model: 007 KernelSU / banking gate
+
+Conceptual entities for validation and artifact tracking (not a database schema).
+
+## KernelSU pin
+
+| Field | Meaning |
+|-------|---------|
+| `project` | KernelSU-Next (or documented ReSukiSU fallback) |
+| `revision` | Exact git tag or commit |
+| `kernel_base` | LOS 23.2 sunfish-compatible 4.14 tree identity |
+| `boot_build_id` | `ro.lineage.version` / display id of accepting image |
+| `status` | `poc` → `pinned` → `withdrawn` |
+
+## SusFS pin (optional until enabled)
+
+| Field | Meaning |
+|-------|---------|
+| `enabled` | boolean on accepting build |
+| `revision` | tag/commit if separate |
+| `soak_hours` | observed soak before claim |
+| `status` | `off` / `trial` / `claimed` / `reverted` |
+
+## App profile (per package × userId)
+
+| Field | Meaning |
+|-------|---------|
+| `package` | e.g. `com.yuh` |
+| `user_id` | 0 owner, 10 Island, … |
+| `root_grant` | MUST be `deny` for banking targets |
+| `umount_or_hide` | `verified` / `unverified` / `failed` |
+| `evidence_path` | artifact log/screenshot |
+
+## Banking session result
+
+| Field | Meaning |
+|-------|---------|
+| `app` | Yuh \| Swissquote |
+| `profile` | Island / owner |
+| `build_id` | ROM build under test |
+| `stack` | KSU ± SusFS ± attestation modules (names + pins) |
+| `outcome` | `PASS` \| `FAIL` |
+| `fail_class` | e.g. KeyMint/`HARDWARE_TYPE_UNAVAILABLE`, UI, network |
+| `log_refs` | paths under `/srv/rom/artifacts/007-…` |
+| `date` | ISO date |
+
+**Rule**: Feature acceptance requires one **Yuh** and one **Swissquote** row on the same build/stack with
+`outcome=PASS` on LAB Island under root-denied + hide-verified stack.
+
+## Attestation experiment run
+
+| Field | Meaning |
+|-------|---------|
+| `modules_or_toggles` | TrickyStore-class + microG HA notes |
+| `baseline_ref` | `002` Yuh log pack |
+| `result_ref` | new log pack |
+| `delta` | same error class / improved / resolved |
+
+## State transitions (feature)
+
+```text
+ksu_poc → profiles_verified → susfs_optional → attestation_trial
+        → both_banks_pass (GATE) → 007_accepted
+        ↘ either_bank_fail_exhausted → 007_incomplete_or_cancelled
+```