AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/007-kernelsu-sunfish/research.md

@@ -0,0 +1,106 @@
+# Research: 007 KernelSU-Next on sunfish
+
+## Decision: Defer `006` rootless-Yuh gate; start `007` now
+
+**Decision**: Do not block on a separate `006` “Yuh green without root”. Absorb
+banking regression into `007`. A rootless snapshot on the current `005` LAB image is required before root;
+its PASS/FAIL outcome is informational and does not block experiments.
+
+**Rationale**: GOLDEN (Magisk) and LAB iodé (no Magisk, locked BL) both show Yuh
+KeyMint/`HARDWARE_TYPE_UNAVAILABLE`. Rootless is not a known fix.
+
+**Alternatives**: Force `006` first — rejected. Cancel banking on ROM entirely
+before trying KSU stack — premature; try `007` experiment first.
+
+## Decision: Yuh PASS is mandatory to accept `007`
+
+**Decision**: Feature closes only when both Yuh and Swissquote work in Island on LAB under
+root-denied + verified hide (+ SusFS/attestation stack as needed). Honest
+residual FAIL ⇒ `007` incomplete or cancelled — not “KSU done, Yuh later”.
+
+**Rationale**: Owner (2026-09-15): without Yuh, root adds little vs NeoBackup +
+native call recording / FLAG_SECURE; denylist-style legitimacy alone is not
+enough reason to carry KSU. Stock handset remains interim fallback, not
+acceptance.
+
+**Alternatives**: Soft gate / document FAIL — rejected by owner.
+
+## Decision: Prefer ReSukiSU + TEESimulator for hard-bank PoC (2026-09-15)
+
+**Decision**: Align LAB banking experiments with torukk/abu field results:
+ReSukiSU over KernelSU-Next when Revolut-class detection matters; **TEESimulator-RS**
+instead of TrickyStore; document Zygisk Next + PIF inject as possible LAB-only
+exception if required for the Yuh/Swissquote gate.
+
+**Rationale**: Owner overlap with that project; XDA 2026-08-22; constitution
+already names ReSukiSU as evaluable fork.
+
+**Alternatives**: KernelSU-Next-only in-tree first — still useful as build
+practice, weaker evidence for hard banks.
+
+## Decision: Profiles + verified umount before SusFS
+
+**Decision**: Order: (1) KSU boots + selective root, (2) banking UIDs denied +
+**mount evidence** of hide/`path_umount`, (3) SusFS, (4) attestation modules.
+
+**Rationale**: Constitution: SusFS only after KernelSU and application profiles
+work. GUI toggle alone is insufficient.
+
+## Decision: TrickyStore-class → prefer TEESimulator-RS
+
+**Decision**: Attestation experiment track prefers **TEESimulator-RS** (TrickyStore
+compatible drop-in) per owner + torukk; select banking packages only.
+
+**Rationale**: Community recommendation over original TrickyStore; same slot in
+the stack.
+
+## Decision: Island remains managed-profile vehicle
+
+**Decision**: Keep Island (already on LAB/GOLDEN) for Yuh/Swissquote unless
+planning discovers a blocking incompatibility; then document substitute.
+
+**Rationale**: Matches AXP oracle workflow and existing LAB user 10.
+
+## Decision: No Zygisk/LSPosed in initial `007`
+
+**Decision**: Out of default scope. Prefer native ROM features for call-rec /
+FLAG_SECURE later (`008`/`009`).
+
+**Rationale**: Constitution.
+
+## Decision: Full Graphene/AXP kernel hardening stays `013`
+
+**Decision**: `007` only patches kernel as required for KSU / SusFS / umount.
+Do not import broad hardening series here.
+
+**Rationale**: Constitution progress order; reduces blast radius while chasing Yuh.
+
+## Remediation alignment — 2026-09-15
+
+Constitution 0.2.0 explicitly defers `006`; T039 records our current rootless
+LAB state before kernel changes, without requiring PASS. US5 alone owns banking
+acceptance: both Yuh and Swissquote must pass on the same stack. US4 owns
+attestation investigation/evidence, not a duplicate acceptance gate. Older
+iodé/GOLDEN KeyMint logs are correlations, not proof of our ROM's failure cause.
+T040 explicitly verifies the no-Zygisk/LSPosed constraint.
+
+## Concrete attestation candidates (not yet selected or validated)
+
+- TrickyStore: https://github.com/5ec1cff/TrickyStore — certificate-chain
+  intervention; current releases closed-source. Record auditability limitations.
+- TEESimulator: https://github.com/JingMatrix/TEESimulator — open-source
+  software KeyMint/key-attestation simulation; candidate alternative, not
+  authentic hardware repair. Requires external signing material not bundled.
+- TEESimulator-RS: https://github.com/Enginex0/TEESimulator-RS — related
+  alternative; independently verify implementation, dependencies and A16 support.
+- BootloaderSpoofer: https://modules.lsposed.org/module/es.chiteroman.bootloaderspoofer/
+  — LSPosed/Xposed approach, outside FR-009 default; not an approved candidate
+  without a separate explicit scope decision.
+
+T022 selects one concrete candidate before deployment: upstream URL, immutable
+commit or release with binary hash, license/source availability, dependencies,
+key-material provenance/availability and rollback. Do not collect keys from
+unknown sources or commit signing secrets. Evaluate candidates separately, not
+as a combined stack. No candidate is verified for Yuh on our sunfish yet.
+KernelSU/SUSFS and Play Integrity modules are not interchangeable substitutes
+for Key Attestation. A simulator does not itself create a trusted signing chain.