AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/007-kernelsu-sunfish/plan.md

@@ -0,0 +1,110 @@
+# Implementation Plan: KernelSU-Next on sunfish (LAB)
+
+**Branch**: `007-kernelsu-sunfish` | **Date**: 2026-09-15 | **Spec**: [spec.md](./spec.md)
+
+**Input**: Feature specification from `/specs/007-kernelsu-sunfish/spec.md`
+
+## Summary
+
+Bring **KernelSU-Next** into the LineageOS 23.2 sunfish **4.14** kernel on LAB,
+verify per-app / per-user **root denial + mount hide** for banking UIDs, then
+layer **SusFS** and a **TrickyStore-class** attestation experiment so that
+**Yuh PASS** (Island) becomes achievable. **Yuh PASS is a hard-gate**: without
+it, `007` is incomplete/cancelled — root is not justified vs NeoBackup + native
+`008`/`009` and a stock banking phone.
+
+`006` rootless-Yuh-pass is **deferred** and does not block start. Swissquote PASS is also mandatory; Revolut/N26 non-blocking. GOLDEN never flashed.
+
+## Technical Context
+
+**Language/Version**: Linux 4.14 kernel (C); KernelSU-Next / SusFS integration;
+Android userspace manager APK; bash runbooks on `rom-dev01`  
+**Primary Dependencies**: LOS 23.2 sunfish kernel tree; KernelSU-Next (non-GKI
+4.14-capable pin); SusFS; TrickyStore-class (or documented equivalent); `005`
+userspace stack; Island; `002` Yuh/KeyMint logs  
+**Storage**: Host `/srv/rom/` kernel outs, module ZIPs, secrets; artifacts under
+`/srv/rom/artifacts/007-…`  
+**Testing**: LAB flash only; KSU manager grants; mount/root probes per UID;
+Yuh/Swissquote Island sessions; `keystore2`/KeyMint logcat vs `002`  
+**Target Platform**: Pixel 4a LAB `11231JEC207477`; Android 16 / LOS 23.2  
+**Project Type**: Android ROM kernel + root stack + LAB validation  
+**Performance Goals**: Boot + daily stability; SusFS soak ≥24h if claimed  
+**Constraints**: LAB only; no Magisk production; no Zygisk/LSPosed default;
+banking never gets root; attributable kernel commits; Yuh PASS mandatory  
+**Scale/Scope**: One kernel integration POC → pin revision → SusFS →
+attestation experiment → banking hard-gate on LAB
+
+## Constitution Check
+
+*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
+
+| Gate | Status |
+|------|--------|
+| LAB only; never GOLDEN | pass |
+| KernelSU-Next is project root (not Magisk production) | pass |
+| Banking apps never receive root; profiles + verified umount | pass |
+| SusFS only after KSU + profiles work | pass (phased US1→US3) |
+| No Zygisk/LSPosed as initial architecture | pass |
+| Small attributable, reversible changes | pass (pinned commits) |
+| `006` before `007` in written order | **amended explicitly in constitution 0.2.0** — rootless Yuh gate deferred; owner-approved sequencing; current-ROM snapshot required (T039) |
+| Hardening Graphene/AXP full ports | out of scope → `013` |
+
+**Post-design**: Same. Yuh hard-gate is an owner product gate layered on top of
+constitution Compatibility MVP (Yuh in Insular) — aligned, stricter on `007`
+acceptance.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/007-kernelsu-sunfish/
+├── plan.md
+├── research.md
+├── data-model.md
+├── quickstart.md
+├── contracts/
+│   ├── ksu-hide-surface.md
+│   └── banking-yuh-gate.md
+└── tasks.md                 # via /speckit-tasks (not this command)
+```
+
+### Host + tree
+
+```text
+# rom-dev01
+/srv/rom/src/lineage/kernel/…     # LOS 23.2 sunfish-compatible kernel
+/srv/rom/src/lineage/…            # product builds including boot.img
+/srv/rom/artifacts/007-kernelsu/  # bacon outs, pins, Yuh log packs
+/srv/rom/references/…             # optional mirrors of KSU/SusFS/TrickyStore docs
+
+# Meta repo
+docs/002-*-*.md                   # Yuh/KeyMint baselines (read-only input)
+docs/reference-sources.md §8–10   # community inspiration, not base
+docs/a15-a16-delta.md             # attestation notes as measured
+```
+
+**Structure Decision**: Kernel work lives on `rom-dev01` LOS tree; meta-repo
+keeps specs, contracts, runbooks, and pin records. No Magisk tree. No megapatch
+dumps in Git — pin URLs/commits + small project patches only.
+
+## Complexity Tracking
+
+| Violation / stretch | Why needed | Simpler alternative rejected because |
+|---------------------|------------|--------------------------------------|
+| Start `007` without closing `006` rootless Yuh | `002` shows Yuh fails with and without Magisk (KeyMint/RKP) | Waiting on rootless Yuh green has no known path |
+| SusFS + TrickyStore-class in same feature as KSU | Owner: Yuh PASS mandatory; hide alone insufficient on GOLDEN | KSU-only “done” without Yuh → root not worth keeping |
+| Yuh PASS hard-gate on EOL sunfish | Product rationale: else stock phone + `008`/`009` | Soft FAIL documentation wastes a root maintenance burden |
+
+## Phase 0 / Phase 1
+
+See `research.md`, `data-model.md`, `contracts/*`, `quickstart.md`.
+
+## Remediation alignment — 2026-09-15
+
+Constitution 0.2.0 explicitly defers `006`; T039 records our current rootless
+LAB state before kernel changes, without requiring PASS. US5 alone owns banking
+acceptance: both Yuh and Swissquote must pass on the same stack. US4 owns
+attestation investigation/evidence, not a duplicate acceptance gate. Older
+iodé/GOLDEN KeyMint logs are correlations, not proof of our ROM's failure cause.
+T040 explicitly verifies the no-Zygisk/LSPosed constraint.