AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
2026-09-16 21:56:22 +00:00
commit 12d2179c20
@@ -0,0 +1,252 @@
+# Tasks: KernelSU-Next on sunfish (LAB) + Yuh/Swissquote gate
+
+**Input**: Design docs from `/specs/007-kernelsu-sunfish/`  
+**Prerequisites**: `005` stack on LAB; `002` Yuh/KeyMint baselines; constitution
+KernelSU-Next (not Magisk production)
+
+**Organization**: Priority = **Swissquote + Yuh** on LAB. KSU/SusFS/TrickyStore
+exist to serve that gate. If the gate cannot be met after the experiment track,
+**cancel root** and pivot to native `008`/`009` (+ optional stock phone) — do
+not ship “root without Yuh” as success.
+
+**Out of scope**: GOLDEN flash; Magisk production; Revolut/N26 hard-gates;
+full Graphene/AXP kernel hardening (`013`).
+
+## Format: `[ID] [P?] [Story] Description`
+
+- **[P]**: Can run in parallel (different files, no incomplete deps)
+- **[Story]**: US1…US5 from `spec.md`
+
+## Path conventions
+
+- Meta: `docs/`, `specs/007-kernelsu-sunfish/`
+- Host: `/srv/rom/src/lineage/` (kernel + boot), `/srv/rom/artifacts/007-kernelsu/`,
+  `/srv/rom/logs/007-build/`
+
+---
+
+## Phase 1: Setup
+
+**Purpose**: Artifact dirs, baseline index, pin stubs
+
+- [x] T001 Create `/srv/rom/artifacts/007-kernelsu/` and
+      `/srv/rom/logs/007-build/` on `rom-dev01` (android-build writable)
+- [x] T002 [P] Add `docs/007-kernelsu-runbook.md` stub (LAB-only; pin table;
+      Yuh hard-gate; cancel-root criteria) in meta repo
+- [x] T003 [P] Index `002` Yuh evidence paths in
+      `docs/007-kernelsu-runbook.md` (GOLDEN + LAB iodé KeyMint refs from
+      `docs/002-golden-inventory.md` / `docs/002-lab-iodes-baseline.md`)
+- [x] T004 [P] Confirm LAB still on `005` userspace
+      (`pm path` gms/gsf/vending; spoof toggle) — note build id in
+      `/srv/rom/artifacts/007-kernelsu/preflight.txt`
+
+- [x] T039 Before T009/T011, capture a rootless snapshot of the current LAB ROM:
+      both bank versions/outcomes, build type, microG/Phonesky versions and
+      attestation probe/logs under `pre-root/`. FAIL is allowed; record actual
+      results rather than inferring them from iodé/GOLDEN. Document Island as
+      the current managed-profile vehicle in `docs/007-kernelsu-runbook.md`.
+      *(2026-09-15: banks not installed → N/A; see pre-root/OUTCOMES.txt)*
+
+---
+
+## Phase 2: Foundational (blocks all stories)
+
+**Purpose**: Choose 4.14-capable KernelSU-Next revision; locate LOS kernel tree;
+no banking claims yet
+
+**⚠️ CRITICAL**: No SusFS/attestation/Yuh PASS claims until KSU boots on LAB
+
+- [x] T005 Inventory LOS 23.2 sunfish kernel path on
+      `/srv/rom/src/lineage/` (defconfig, branch); record in
+      `docs/007-kernelsu-runbook.md`
+      *(`kernel/google/msm-4.14` @ `28f9290ae067…`; sunfish_defconfig)*
+- [x] T006 Select KernelSU-Next revision compatible with non-GKI 4.14; document
+      candidates + choice in `docs/007-kernelsu-runbook.md` (ReSukiSU only as
+      explicit fallback)
+      *(`legacy` branch; manual hooks preferred over kprobes)*
+- [x] T007 Mirror/checkout chosen KernelSU-Next sources under
+      `/srv/rom/references/kernelsu-next/` (or documented path); record commit
+      *(@ `a54e4fa46c6c…`)*
+- [x] T008 Draft integration notes (what files touch kernel vs boot.img) in
+      `docs/007-kernelsu-runbook.md` — attributable commits only, no megapatch
+
+**Checkpoint**: Ready to integrate and build boot (US1)
+
+---
+
+## Phase 3: User Story 1 — Bootable rooted LAB image (P1) 🎯 MVP slice
+
+**Goal**: LAB boots with KernelSU-Next; selective root works  
+**Independent test**: Manager present; one approved app gets root; unapproved
+does not; telephony/Wi‑Fi OK
+
+- [ ] T009 [US1] Integrate KernelSU-Next into sunfish kernel tree under
+      `/srv/rom/src/lineage/`; build boot/kernel; log
+      `/srv/rom/logs/007-build/ksu-poc.log`
+- [ ] T010 [US1] Stage boot/images + SHA256 to
+      `/srv/rom/artifacts/007-kernelsu/<date>-ksu-poc/`
+- [ ] T011 [US1] Flash LAB only (`11231JEC207477`); confirm boot +
+      `ro.lineage.version`; install/open KSU manager
+- [ ] T012 [US1] Grant root to one debug app; deny a second; capture evidence
+      under `/srv/rom/artifacts/007-kernelsu/<date>-ksu-poc/root-grant/`
+- [ ] T013 [US1] Pin exact KernelSU-Next revision in
+      `docs/007-kernelsu-runbook.md` + artifact `PIN.txt`
+
+**Checkpoint**: US1 green before profiles/SusFS
+
+---
+
+## Phase 4: User Story 2 — Banking never root; mounts hidden (P1)
+
+**Goal**: Yuh/Swissquote UIDs denied + **verified** umount/hide  
+**Independent test**: `contracts/ksu-hide-surface.md` — not toggle-only
+
+- [ ] T014 [US2] Configure KSU profiles: deny root for `com.yuh` and
+      `com.swissquote.android` on user 0 and Island user; document steps in
+      `docs/007-kernelsu-runbook.md`
+- [ ] T015 [US2] Enable umount/hide for those UIDs; verify `path_umount` (or
+      equivalent) works on this 4.14 build — note pass/fail in
+      `/srv/rom/artifacts/007-kernelsu/<date>-hide/umount.txt`
+- [ ] T016 [US2] From banking or probe UID, capture mount/root visibility
+      before/after hide →
+      `/srv/rom/artifacts/007-kernelsu/<date>-hide/mounts/`
+- [ ] T017 [US2] Mark `contracts/ksu-hide-surface.md` checklist rows against
+      real evidence (update runbook if contract gaps)
+
+**Checkpoint**: Hide verified before SusFS
+
+---
+
+## Phase 5: User Story 3 — SusFS after profiles (P2)
+
+**Goal**: SusFS on LAB; measurable hide; no reboot loop  
+**Independent test**: Boot + one path hidden; soak before claim
+
+**Note (2026-09-16):** T018 **build** completed early (API bridge) *before* US2
+hide verification — process exception. Boot artifact
+`boot-resukisu-susfs-20260916T004038Z.img` is **trial only**. Prefer LAB on
+`boot-resukisu-our-20260915T183729Z` until US2 green; then re-attempt T019.
+abu/torukk boots are reference-only — see `docs/session-20260916-handoff.md`.
+
+- [x] T018 [US3] Integrate SusFS into the pinned kernel path; build; log
+      (host detach SusFS boot 20260916T004038Z; sha `455a77a6…`)
+- [ ] T019 [US3] Flash LAB; confirm boot + KSU still works; record SusFS pin in
+      `docs/007-kernelsu-runbook.md`
+- [ ] T020 [US3] Re-verify banking UID hide with SusFS on → artifact
+      `/srv/rom/artifacts/007-kernelsu/<date>-susfs/`
+- [ ] T021 [US3] Soak ≥24h or document revert if unstable (SC-005); update
+      SusFS status `trial`/`claimed`/`reverted` in runbook
+
+**Checkpoint**: SusFS stable or withdrawn before attestation claims that depend
+on it
+
+---
+
+## Phase 6: User Story 4 — Attestation / KeyMint experiment (P1)
+
+**Goal**: TrickyStore-class (or equiv.) vs `002` Yuh KeyMint failure  
+**Independent test**: New log pack; progress toward Yuh PASS
+
+- [ ] T022 [US4] Choose attestation experiment stack (TrickyStore-class or
+      documented equivalent + microG HA toggles); record source URL, immutable commit or release and binary SHA256, dependencies, key-material requirements, auditability and rollback in
+      `docs/007-kernelsu-runbook.md` **before T023**
+- [ ] T023 [US4] Apply stack on LAB; capture `keystore2`/KeyMint/RKP logcat on
+      Yuh open → `/srv/rom/artifacts/007-kernelsu/<date>-attest/`
+- [ ] T024 [US4] Diff against `002` failure class; write short delta note in
+      artifact `DELTA.md` (same / improved / resolved)
+- [ ] T025 [US4] Iterate one candidate at a time based on measured probe/banking outcomes; do not use a log string alone as the failure criterion; keep each attempt under dated artifact dirs — do
+      not mark feature done on FAIL
+
+**Checkpoint**: Diagnostic evidence ready for US5; persistent log messages
+alone do not determine acceptance. Exhausted unsuccessful bank attempts lead
+to Phase 9 or an incomplete feature.
+
+---
+
+## Phase 7: User Story 5 — Banking regression / hard-gate (P1)
+
+**Goal**: **Yuh and Swissquote PASS** in Island  
+**Independent test**: `contracts/banking-yuh-gate.md` + `quickstart.md`
+
+- [ ] T026 [US5] Install path: Aurora → (prefer no owner open) → Island clone
+      for Yuh + Swissquote; note UIDs in
+      `/srv/rom/artifacts/007-kernelsu/<date>-banking/layout.txt`
+- [ ] T027 [US5] Swissquote Island session → **PASS required** + evidence under
+      `…/<date>-banking/swissquote/`
+- [ ] T028 [US5] Yuh Island session → **PASS required**; evidence under
+      `…/<date>-banking/yuh/` (build id, stack pins, log excerpt)
+- [ ] T040 Before T029 acceptance, verify FR-009: installed packages, root
+      module inventory, relevant processes/mounts and build configuration show
+      no Zygisk/LSPosed integration. Store evidence; a package-name check alone
+      is insufficient. Any proposed exception requires a spec decision first.
+
+- [ ] T029 [US5] If both banks PASS: fill `data-model.md` banking row + tick
+      `specs/007-kernelsu-sunfish/quickstart.md` pass criteria
+- [ ] T030 [US5] If either bank FAILS after T022–T025 exhausted: do **not** accept
+      `007`; proceed to Phase 9 cancel-root tasks
+
+**Checkpoint**: Feature accepted only with both banks PASS
+
+---
+
+## Phase 8: Polish (only if both banks PASS)
+
+- [ ] T031 [P] Update `docs/axp-pro-parity.md` root / DenyList / Yuh / Swissquote
+      rows to reflect KSU-Next + LAB results
+- [ ] T032 [P] Update `docs/a15-a16-delta.md` attestation/`007` measured notes
+- [ ] T033 Handoff note in `docs/007-kernelsu-runbook.md`: next may be `008`
+      call recording / `009` FLAG_SECURE; full hardening still `012`–`013`
+- [ ] T034 Mark deferred `006` as superseded-by-`007` (or thin stub) in
+      `specs/` / roadmap note — no fake rootless Yuh success
+
+---
+
+## Phase 9: Cancel-root pivot (only if either banking hard-gate fails)
+
+**Purpose**: Owner priority — without Yuh/Swissquote success, discard project
+root and keep native requirements instead
+
+- [ ] T035 Write `/srv/rom/artifacts/007-kernelsu/CANCEL-ROOT.md` (attempts,
+      last pins, KeyMint residual, recommendation: stock phone for banks)
+- [ ] T036 Update `docs/007-kernelsu-runbook.md` + `docs/axp-pro-parity.md`:
+      root path **withdrawn**; Magisk/KSU not production
+- [ ] T037 [P] Stub or specify next focus: `008` call recording + `009`
+      FLAG_SECURE (native, no LSPosed) — Spec Kit when owner starts them
+- [ ] T038 Leave LAB on last known-good **non-root** (`005`) image or document
+      re-flash steps in runbook
+
+---
+
+## Dependencies
+
+```text
+Setup T001–T004 + T039
+    → Foundational T005–T008
+        → US1 T009–T013 (KSU boot)
+            → US2 T014–T017 (hide)
+                → US3 T018–T021 (SusFS)
+                    → US4 T022–T025 (attest)
+                        → US5 T026–T030 + T040 (both-bank gate)
+                            ↘ PASS → Polish T031–T034
+                            ↘ FAIL → Cancel-root T035–T038
+```
+
+- US3 may be skipped only if US4/US5 PASS without SusFS (document why)
+- US4/US5 are the product priority; US1–US2 are enablers
+
+## Parallel opportunities
+
+- T002, T003, T004 after T001  
+- T031, T032 after both banks PASS  
+- T037 anytime during cancel-root phase  
+
+## MVP
+
+**Minimum useful slice**: T001–T013 (KSU boots on LAB).  
+**Product MVP**: T027 Swissquote PASS and T028 Yuh PASS on the same stack.
+Either unresolved failure → Phase 9 or remain incomplete, never “007 done”.
+
+## Suggested next command after tasks
+
+`/speckit-analyze` (optional) → `/speckit-implement` starting at T001 on
+`rom-dev01` (kernel work is host-side; LAB flash when boot ready).