AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/008-call-rec-flag-secure/spec.md

@@ -0,0 +1,170 @@
+# Feature Specification: Call recording unlock + FLAG_SECURE override
+
+**Feature Branch**: `008-call-rec-flag-secure`  
+**Created**: 2026-09-16  
+**Status**: Draft  
+**Input**: Deliver constitution items `008` and `009` together as native ROM
+features with two Developer Options toggles (global only). Call recording =
+disable region/country restrictions via **AXP GOLDEN / EXTENDROM native**
+`extendrom_call_recording` DO gate. FLAG_SECURE = optional global allow
+screenshots/capture of secure windows (native frameworks + DO). Pattern
+matches `005` DO style. No LSPosed/Zygisk/Magisk runtime. LAB only.
+
+**Design**: [`docs/008-009-design.md`](../../docs/008-009-design.md)
+
+## Absorbs roadmap
+
+| # | Theme | In this feature |
+|---|--------|-----------------|
+| 008 | Unrestricted call recording (region) | Yes |
+| 009 | FLAG_SECURE override | Yes — **global only** |
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - Call recording region unlock toggle (Priority: P1)
+
+As a LAB/daily-driver user, I can enable **Disable call recording
+restrictions** under Developer Options. When ON, the Dialer no longer blocks
+recording solely because of country/region rules. When OFF, stock LOS
+restrictions apply.
+
+**Why this priority**: Core `008` value; small surface; matches EXTENDROM/AXP
+intent without porting full AXP recording UX.
+
+**Independent Test**: Toggle setting; `settings get secure
+extendrom_call_recording`; attempt call recording on LAB Dialer with
+toggle on vs off.
+
+**Acceptance Scenarios**:
+
+1. **Given** a build with this feature on LAB, **When** Developer Options is
+   opened, **Then** a switch for disabling call-recording region restrictions
+   is visible (with a short legal responsibility summary).
+2. **Given** the switch is OFF (default), **When** Dialer evaluates recording
+   eligibility, **Then** stock country/region rules apply.
+3. **Given** the switch is ON, **When** the user records a call with the
+   system Dialer, **Then** recording is not refused solely due to region /
+   country policy, and a recording artifact is produced.
+4. **Given** Developer Options is disabled globally, **When** that happens,
+   **Then** `extendrom_call_recording` returns to `0`.
+
+---
+
+### User Story 2 - Global FLAG_SECURE / screenshot override (Priority: P1)
+
+As a LAB/daily-driver user, I can enable **Allow screenshots of secure
+windows** under Developer Options. When ON, screenshots and screen capture
+work even if apps set `FLAG_SECURE`. When OFF, Android’s normal secure-window
+behaviour applies. The override is **global** (all apps).
+
+**Why this priority**: Constitution `009` project requirement; same DO pattern
+as spoofing.
+
+**Independent Test**: App or screen that sets `FLAG_SECURE`; capture with
+toggle OFF (expect fail) and ON (expect success);
+`settings get secure disable_secure_windows`.
+
+**Acceptance Scenarios**:
+
+1. **Given** a build with this feature on LAB, **When** Developer Options is
+   opened, **Then** a switch for secure-window screenshot override is visible.
+2. **Given** the switch is OFF (default), **When** the user tries to screenshot
+   a `FLAG_SECURE` window, **Then** capture is blocked as on stock.
+3. **Given** the switch is ON, **When** the user screenshots or screen-records
+   that same window, **Then** capture succeeds.
+4. **Given** Developer Options is disabled globally, **When** that happens,
+   **Then** `disable_secure_windows` returns to `0`.
+
+---
+
+### User Story 3 - Native, attributable packaging (Priority: P2)
+
+As a maintainer, both behaviours ship in the bacon/ROM tree via
+`vendor/sunfish-a16` patches (idempotent apply), sourced from EXTENDROM /
+AXP GOLDEN call-rec (and native FLAG_SECURE work), without Magisk modules.
+
+**Why this priority**: Constitution: native ROM, attributable, reversible.
+
+**Independent Test**: Patch script dry-run; tree markers; no Magisk zip in
+artifacts required for the feature to work after flash.
+
+**Acceptance Scenarios**:
+
+1. **Given** a clean LOS tree after `repo sync`, **When** the apply script
+   runs, **Then** it is idempotent and records source attribution.
+2. **Given** a flashed LAB image, **When** Magisk is not installed, **Then**
+   both toggles still function.
+
+---
+
+### Edge Cases
+
+- Dialer path renamed on A16 → re-locate gate; do not assume A11 overlay paths.
+- Call recording legal in some jurisdictions only → UI must warn; feature does
+  not claim legality.
+- Some capture paths (DRM / hardware buffers) may still block — document if a
+  specific path remains blocked after toggle ON.
+- `user` builds: follow same policy as `005` for whether DO toggles are
+  available (document decision in plan if it differs from `userdebug` LAB).
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+- **FR-001**: System MUST expose Developer Options switch **Disable call
+  recording restrictions** backed by
+  `Settings.Secure.extendrom_call_recording` ∈ {`0`,`1`}, default `0`.
+- **FR-002**: When that setting is `1`, Dialer MUST NOT deny call recording
+  solely due to country/region restriction logic.
+- **FR-003**: When that setting is `0`, Dialer MUST use stock restriction
+  behaviour.
+- **FR-004**: System MUST expose Developer Options switch **Allow screenshots
+  of secure windows** backed by
+  `Settings.Secure.disable_secure_windows` (DO: `allow_flag_secure_override`) ∈ {`0`,`1`}, default `0`.
+- **FR-005**: When that setting is `1`, system screenshot and screen-capture
+  paths MUST allow capture of windows that set `FLAG_SECURE` (global).
+- **FR-006**: When that setting is `0`, `FLAG_SECURE` MUST behave as stock.
+- **FR-007**: Both settings MUST reset to `0` when Developer Options is turned
+  off (same pattern as EXTENDROM / `005`).
+- **FR-008**: Implementation MUST NOT require Magisk, LSPosed, or Zygisk at
+  runtime.
+- **FR-009**: Patches MUST be attributable (EXTENDROM/`er.sh` F_CALLREC for
+  call-rec; native frameworks for FLAG_SECURE) and apply via
+  `vendor/sunfish-a16/patches/…`.
+- **FR-010**: Validation MUST be LAB-only (`11231JEC207477`).
+
+### Key Entities
+
+- **SecureSetting**: `extendrom_call_recording`,
+  `disable_secure_windows`.
+- **DeveloperOptionsController**: preference controllers writing those
+  settings.
+- **DialerRecordingPolicy**: country/region gate gated by call-rec setting.
+- **SecureCapturePolicy**: framework capture/`FLAG_SECURE` enforcement gated
+  by screenshot setting.
+
+## Success Criteria *(mandatory)*
+
+- **SC-001**: On LAB, both settings read `0` after fresh boot / DO off.
+- **SC-002**: With call-rec toggle ON, operator completes a recorded call and
+  stores evidence under `/srv/rom/artifacts/008-…/call-rec/`.
+- **SC-003**: With screenshot toggle ON, operator captures a previously secure
+  window; evidence under `/srv/rom/artifacts/008-…/flag-secure/`.
+- **SC-004**: Toggles OFF restore stock deny behaviour for the same tests.
+- **SC-005**: Feature works on a Magisk-free LAB image.
+
+## Assumptions
+
+- LOS 23.2 Dialer still has an identifiable country/region recording gate (or
+  equivalent CarrierConfig path) that can be overridden.
+- “Screenshot” includes the system screenshot gesture and common screen-record
+  entry points; exotic DRM paths may remain blocked (document).
+- FLAG_SECURE is **global only** (not planned: per-app lists).
+- `007` remains incomplete; this feature does not depend on KernelSU.
+
+## Out of scope
+
+- AXP full call-recording automation UI.
+- Per-app FLAG_SECURE lists.
+- Relocked AVB / signed release (`011`).
+- Banking PASS (`007`).