AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/007-kernelsu-sunfish/quickstart.md

@@ -0,0 +1,64 @@
+# Quickstart: 007 KernelSU + Yuh gate (LAB only)
+
+**Device**: LAB `11231JEC207477` — never GOLDEN `11071JEC203839`
+
+## Goal
+
+Prove selective root + verified hide, then **Yuh and Swissquote PASS** in Island. Without both banks
+passing, do not declare `007` done.
+
+## Prerequisites
+
+- Working `005` userspace stack on LAB (microG + Phonesky + spoofing)
+- `007` boot image with pinned KernelSU-Next
+- Island installed; Aurora available
+- Baseline reading: `docs/002-golden-inventory.md`, `docs/002-lab-iodes-baseline.md`
+
+## 1. Flash LAB
+
+Use `docs/003-flash-lab.md` with the `007` artifact. Confirm:
+
+```bash
+SERIAL=11231JEC207477
+adb -s "$SERIAL" shell getprop ro.lineage.version
+# KernelSU manager present; grant root to one debug app only
+```
+
+## 2. Hide surface
+
+1. Deny root for `com.yuh` and `com.swissquote.android` (all relevant users).
+2. Enable umount/hide for those UIDs.
+3. **Verify mounts** from a probe — see `contracts/ksu-hide-surface.md`.
+
+## 3. SusFS (after step 2 green)
+
+Enable SusFS per pin; confirm boot; re-check hide. Soak before claiming.
+
+## 4. Attestation experiment
+
+Apply TrickyStore-class (or equivalent) + any microG HA toggles under test.
+Capture logcat around Yuh open (`keystore2`, KeyMint, RKP).
+
+## 5. Banking (Island)
+
+1. Aurora install Yuh/Swissquote → do not open on owner if following AXP order.
+2. Clone into Island; first launch in Island.
+3. Swissquote: must PASS a usable authenticated session.
+4. Yuh: **must PASS** for feature acceptance (`contracts/banking-yuh-gate.md`).
+
+## Pass criteria
+
+- [ ] KSU selective root works  
+- [ ] Banking UIDs: root deny + verified hide  
+- [ ] SusFS claimed only if stable  
+- [ ] **Yuh PASS** in Island with evidence under `/srv/rom/artifacts/007-…`  
+- [ ] Swissquote PASS on the same stack  
+- [ ] No Magisk production image  
+
+## Failure
+
+If either bank remains unusable after reasonable SusFS/attestation
+iterations: stop, keep artifacts, mark `007` blocked — consider stock phone for
+banks; do not ship “root without Yuh” as success.
+
+Before any rooted flash, complete T039. Before acceptance complete T040.