AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
2026-09-16 21:56:22 +00:00
commit 12d2179c20
@@ -0,0 +1,43 @@
+# Specification Quality Checklist: AXP LOS22 feature port to LOS23
+
+**Purpose**: Validate specification completeness and quality before proceeding to planning  
+**Created**: 2026-09-16  
+**Updated**: 2026-09-16 (owner clarifications applied)  
+**Feature**: [spec.md](../spec.md)
+
+## Content Quality
+
+- [x] No implementation details (languages, frameworks, APIs)
+- [x] Focused on user value and business needs
+- [x] Written for non-technical stakeholders
+- [x] All mandatory sections completed
+
+## Requirement Completeness
+
+- [x] No [NEEDS CLARIFICATION] markers remain
+- [x] Requirements are testable and unambiguous
+- [x] Success criteria are measurable
+- [x] Success criteria are technology-agnostic (no implementation details)
+- [x] All acceptance scenarios are defined
+- [x] Edge cases are identified
+- [x] Scope is clearly bounded
+- [x] Dependencies and assumptions identified
+
+## Feature Readiness
+
+- [x] All functional requirements have clear acceptance criteria
+- [x] User scenarios cover primary flows
+- [x] Feature meets measurable outcomes defined in Success Criteria
+- [x] No implementation details leak into specification
+
+## Notes
+
+- Clarifications resolved: Magisk like GOLDEN (newest; AXP preinstall state);
+  full AXP resurrection including hardening/signing/AVB; WebView = LOS23
+  default with chooser unlocked (Aosmium EOL); Phonesky = project recent
+  patched artifact (reconsider if GOLDEN-class fixes missing); microG newest
+  + integrated; spoofing and call recording selectable; KernelSU out of ship
+  for now with optional recycle of existing `007` functional kernels (FR-016).
+- Named product components (microG, Phonesky, Magisk, Island) appear because
+  they are the resurrection surface, not implementation design.
+- Ready for `/speckit-plan` (optional `/speckit-clarify` only if new gaps).
@@ -0,0 +1,53 @@
+# Contract: LAB acceptance gates (`009`)
+
+**Device**: LAB `11231JEC207477` only — never GOLDEN  
+**Evidence**: `/srv/rom/artifacts/009-axp-los23-port/<build-id>/`
+
+## Gate A — Boot / hardware
+
+- [ ] Clean flash boots to home
+- [ ] Call + Wi‑Fi + unlock smoke (vanilla class)
+
+## Gate B — Google stack
+
+- [ ] microG Self-Check required items pass with spoofing ON as needed
+- [ ] Project Phonesky opens; ordinary app install/update works
+- [ ] No FakeStore primary
+- [ ] Version pins: microG/GSF newest stable; Phonesky = project artifact
+- [ ] If Play lacks GOLDEN-class fix → **FAIL closed** (reconsider Phonesky)
+
+## Gate C — Toggles
+
+- [ ] Spoofing OFF/ON behaviour per `toggles-surface.md`
+- [ ] Call-rec OFF/ON behaviour per `toggles-surface.md`
+
+## Gate D — Magisk
+
+- [ ] Preinstall state matches measured GOLDEN/AXP class
+- [ ] Activation documented and completed on LAB
+- [ ] DenyList-class hides root from a test/banking package
+
+## Gate E — Banking
+
+- [ ] Island present; Swissquote PASS in managed profile workflow
+- [ ] Yuh recorded; not worse than GOLDEN for packaging/spoofing reasons
+- [ ] Banks do not receive root
+
+## Gate F — Usability / WebView
+
+- [ ] Bundled AXP categories present or documented impossible
+- [ ] Versions newest workable (except Phonesky rule)
+- [ ] WebView default LOS; chooser unlocked
+
+## Gate G — Hardening / signing class
+
+- [ ] GOLDEN-class hardening/signing/AVB posture present **or** each gap
+      documented as impossible on this stack (no silent omit)
+- [ ] Staged known-good images retained for bisect
+
+## Non-gates
+
+- KernelSU presence or SusFS
+- FLAG_SECURE override (optional)
+- Custom AXP backup ROM feature
+- Yuh PASS if GOLDEN attestation path still FAILs equivalently
@@ -0,0 +1,38 @@
+# Contract: Magisk preinstall (AXP / GOLDEN class)
+
+**Ship root**: Magisk (newest stable that works on this stack)  
+**Not ship**: KernelSU / SusFS (`007` optional recycle only)
+
+## Behavioural contract
+
+1. After a clean `009` flash, Magisk is **present** in an AXP-like
+   **preinstalled but not fully activated** state (exact files/UI measured
+   from GOLDEN — document in LAB runbook).
+2. Owner can complete activation on LAB using documented steps.
+3. DenyList-class configuration can hide root from banking packages before
+   first process start (GOLDEN workflow).
+4. Magisk version in the version-pin record is newest workable stable, not an
+   accidental stale host copy.
+
+## Banking interaction
+
+Aurora install → do not open → DenyList (incl. processes) → Island clone →
+first launch in Island. Banks MUST NOT receive root.
+
+## Out of contract
+
+- Shipping Magia branding specifically ( Magisk upstream UI OK if behaviour
+  matches).
+- Requiring KernelSU coexistence on the same ship image.
+
+## Verification
+
+```bash
+# After flash (pre-activation): document paths/props matching GOLDEN notes
+adb shell ls -l /system_ext/bin/magisk 2>/dev/null || true
+adb shell pm list packages | grep -iE 'magisk|magia'
+
+# After activation: Magisk app reports version; DenyList configurable
+```
+
+Evidence under `/srv/rom/artifacts/009-axp-los23-port/magisk/`.
@@ -0,0 +1,38 @@
+# Contract: system packages (AXP resurrection)
+
+**Device**: LAB only  
+**Build**: `009` product with Google stack + bundled AXP usability set
+
+## Required packages (minimum)
+
+| Role | Package | Notes |
+|------|---------|--------|
+| microG | `com.google.android.gms` | Newest stable verified; system |
+| GSF Proxy | `com.google.android.gsf` | Newest stable verified |
+| Phonesky | `com.android.vending` | Project patched priv-app; host artifact |
+| Island | `com.oasisfeng.island…` | GOLDEN tool; newest workable |
+| Magisk UI / stubs | as measured on GOLDEN | Preinstall layout; not fully activated until setup |
+
+FakeStore / conflicting Companion MUST NOT be the primary Play path.
+
+## Bundled usability set
+
+Ship GOLDEN/AXP categories at newest workable stables (Aurora, F-Droid/repos as
+on GOLDEN, launcher/gallery-class, DNS/hosts helpers if in inventory). Exact
+package list = version-pin record derived from `002` + acceptance notes.
+
+## WebView
+
+- Default provider = LOS23 WebView package.
+- Aosmium MUST NOT be required.
+- `cmd webviewupdate` / Developer options chooser MUST remain usable.
+
+## Verification snippets
+
+```bash
+adb shell pm path com.google.android.gms
+adb shell pm path com.google.android.gsf
+adb shell pm path com.android.vending
+adb shell cmd package list packages | grep -E 'island|aurora|fdroid|magisk|magia'
+adb shell cmd webviewupdate current
+```
@@ -0,0 +1,36 @@
+# Contract: selectable toggles (spoofing + call recording)
+
+**Surface**: Developer Options (AXP-like)  
+**Defaults**: OFF (`0`) unless a documented project default says otherwise
+
+## Signature spoofing
+
+| Item | Value |
+|------|--------|
+| Secure key | `allow_signature_fake` (GOLDEN/AXP class from `005`) |
+| OFF | Spoofing has no effect even if prior grants exist |
+| ON | Authorized packages (microG, Phonesky) may use restricted spoofing |
+| Forbidden | Unrestricted platform spoofing for arbitrary apps |
+
+```bash
+adb shell settings get secure allow_signature_fake
+# expect 0/null default; 1 when enabled
+```
+
+## Call recording unlock
+
+| Item | Value |
+|------|--------|
+| Secure key | `extendrom_call_recording` |
+| OFF | Stock LOS country/carrier-style Dialer policy |
+| ON | Dialer `canRecordInCurrentCountry()` allows recording |
+
+```bash
+adb shell settings get secure extendrom_call_recording
+# expect 0/null default; 1 when enabled
+```
+
+## Optional (not AXP hard gate)
+
+`disable_secure_windows` / FLAG_SECURE override may ship if already wired
+(`008`); absence does not fail AXP resurrection acceptance.
@@ -0,0 +1,16 @@
+# Contract: WebView policy
+
+| Rule | Requirement |
+|------|-------------|
+| Default | LineageOS 23 WebView |
+| Aosmium | Not shipped / not required (EOL) |
+| Chooser | Developer options → WebView implementation remains available |
+| Future | User may install an alternate WebView and select it |
+
+```bash
+adb shell cmd webviewupdate current
+# default should be LOS provider, not org.axpos.aosmium
+
+adb shell cmd webviewupdate
+# provider list / update path must not be locked to a single forced package
+```
@@ -0,0 +1,106 @@
+# Data model: `009-axp-los23-port`
+
+## Entities
+
+### VanillaBaseline
+
+| Field | Type | Rules |
+|-------|------|--------|
+| source | string | `003` LOS 23.2 sunfish (or documented equivalent) |
+| manifest_rev | string | recorded repo manifest revision |
+| lab_smoke | enum | `pass` required before AXP integrate stages |
+
+### AxpCapabilitySet
+
+| Field | Type | Rules |
+|-------|------|--------|
+| category | string | e.g. google-stack, magisk, banking, call-rec, bundled-apps, hardening |
+| golden_ref | string | pointer into `002` / AXP Pro row |
+| status | enum | `required` \| `exception` \| `impossible` |
+| notes | string | WebView=exception; others default required |
+
+### VersionPinRecord
+
+| Field | Type | Rules |
+|-------|------|--------|
+| component | string | microG, GSF, Magisk, Island, Aurora, … |
+| version_name | string | human version |
+| version_code | int/string | as applicable |
+| upstream_ref | string | tag/commit/URL |
+| policy | enum | `newest_stable` \| `project_phonesky` \| `los_default` |
+| verified_on | date | LAB verification date |
+
+**Phonesky row**: `policy=project_phonesky` — must match host artifact id, not
+“newest Play on internet”.
+
+### PhoneskyHostArtifact
+
+| Field | Type | Rules |
+|-------|------|--------|
+| path | string | under `/srv/rom/prebuilts/phonesky/` (not Git) |
+| package | string | `com.android.vending` |
+| signature | string | project/patch pipeline identity |
+| privapp | bool | must be true |
+| golden_fix_gap | bool | if true → halt acceptance / reconsider |
+
+### MagiskPreinstallState
+
+| Field | Type | Rules |
+|-------|------|--------|
+| magisk_version | string | newest stable verified |
+| layout | string | measured GOLDEN/AXP preinstalled-not-fully-activated |
+| activated_on_lab | bool | true after owner completes setup |
+| denylist | set | banking packages hidden from root |
+
+**Transitions**: `flashed_preinstall` → `activated` → `denylist_configured`
+→ `banking_ready`.
+
+### SecureToggle
+
+| Field | Type | Rules |
+|-------|------|--------|
+| key | string | `allow_signature_fake` or `extendrom_call_recording` |
+| value | int | `0` default / `1` on |
+| surface | string | Developer Options |
+
+### ManagedProfileBanking
+
+| Field | Type | Rules |
+|-------|------|--------|
+| tool | string | Island (`com.oasisfeng.island…`) |
+| swissquote | enum | `pass` required |
+| yuh | enum | `pass` \| `fail_attestation_like_golden` \| `fail_regression` |
+| root_to_banks | bool | must be false |
+
+### WebViewPolicy
+
+| Field | Type | Rules |
+|-------|------|--------|
+| default_provider | string | LOS23 WebView |
+| aosmium | bool | must be false (not required/shipped) |
+| chooser_unlocked | bool | must be true |
+
+### LabAcceptanceBuild
+
+| Field | Type | Rules |
+|-------|------|--------|
+| artifact_dir | string | `/srv/rom/artifacts/009-axp-los23-port/…` |
+| hashes | map | SHA-256 of flashables |
+| version_pins | ref | VersionPinRecord set |
+| gates | ref | contracts/acceptance-gates.md checklist |
+
+### OptionalKsuRecycleAsset
+
+| Field | Type | Rules |
+|-------|------|--------|
+| path | string | existing `007` kernel/artifact |
+| used_for | string | optional debug/reference |
+| ship | bool | always false unless future spec says otherwise |
+
+## Relationships
+
+- `LabAcceptanceBuild` includes one `VersionPinRecord` set + Magisk state +
+  toggle defaults + banking results + WebViewPolicy.
+- `PhoneskyHostArtifact` feeds product packaging; never stored in Git.
+- `AxpCapabilitySet` drives which bundled packages appear in pins.
+- `OptionalKsuRecycleAsset` must not appear as required on acceptance gates.
@@ -0,0 +1,130 @@
+# Implementation Plan: AXP LOS22 feature port to LOS23 (resurrection)
+
+**Branch**: `009-axp-los23-port` | **Date**: 2026-09-16 | **Spec**: [spec.md](./spec.md)
+
+**Input**: Feature specification from `/specs/009-axp-los23-port/spec.md`
+
+## Summary
+
+Resurrect **AXP.OS Pro on LOS22 / GOLDEN** as a single shippable LineageOS
+23.2 / Android 16 `sunfish` ROM on **LAB**: vanilla `003` base + full AXP
+capability set (Google stack, selectable spoofing, Island banking workflow,
+selectable call-recording unlock, Magisk like GOLDEN, bundled usability apps,
+GOLDEN-class hardening/signing/AVB posture).
+
+**Explicit exceptions:** LOS23 WebView default (Aosmium EOL) with unlocked
+provider chooser; Phonesky = project's recent patched artifact (reconsider if
+GOLDEN-class fixes missing); KernelSU (`007`) out of ship for now with optional
+recycle of existing functional kernels (FR-016).
+
+**Approach:** reuse proven `004`/`005`/`008` runbooks and `vendor/sunfish-a16`
+packaging where they already match; replace the KernelSU ship path with
+AXP-style Magisk preinstall (newest Magisk); pin newest stable microG and
+bundled apps; keep Phonesky on the existing host pipeline; measure Magisk
+“preinstalled but not fully activated” behaviour on GOLDEN before freezing LAB
+setup docs.
+
+## Technical Context
+
+**Language/Version**: Android product makefiles / Soong; Java/Kotlin Settings +
+Dialer + frameworks patches; bash runbooks on `rom-dev01`  
+**Primary Dependencies**: LOS 23.2 sunfish tree; microG + GSF releases; project
+patched Phonesky host artifacts; Magisk (newest stable that works on this
+stack); Island; AXP/GOLDEN inventory (`002`); EXTENDROM call-rec reference;
+existing `vendor/sunfish-a16` overlays/patches from `004`/`005`/`008`  
+**Storage**: Host `/srv/rom/prebuilts/`, `/srv/rom/secrets/`,
+`/srv/rom/artifacts/009-axp-los23-port/`; meta-repo docs + `vendor/sunfish-a16`
+scripts (no proprietary APKs in Git)  
+**Testing**: LAB flash/`adb`; microG Self-Check; Play install; Island +
+Swissquote/Yuh; Magisk DenyList-class; DO toggles; version-pin record  
+**Target Platform**: Pixel 4a LAB `11231JEC207477`; Android 16 / LOS 23.2  
+**Project Type**: Android custom ROM (product overlay + attributable patches)  
+**Performance Goals**: N/A (daily-driver correctness / parity)  
+**Constraints**: LAB only; no GOLDEN flash; no Phonesky bytes in Git; Magisk
+ship root (not KernelSU); newest stables except Phonesky artifact rule;
+attributable reversible changes; long builds detached on `rom-dev01`  
+**Scale/Scope**: Full AXP resurrection surface in one feature (Google stack,
+toggles, Magisk, bundled apps, hardening/signing class); **parallel track**
+to the standby KernelSU / split roadmap (`004`–`008`/`007`), reusing their
+artifacts without deleting that track
+
+## Constitution Check
+
+*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
+
+| Gate | Status |
+|------|--------|
+| LAB only; never GOLDEN | pass |
+| Spec-as-source for active feature requirements | pass (`009` normative for ship) |
+| Functionality first; AXP compatibility oracle | pass (resurrection goal) |
+| No proprietary Google APKs / secrets in Git | pass (host paths) |
+| Phonesky priv-app; no FakeStore primary | pass |
+| Restricted selectable spoofing (not open platform) | pass (reuse `005` class) |
+| Native call-rec unlock; re-validate A16 | pass (reuse `008` / EXTENDROM) |
+| Prefer native over LSPosed/Zygisk modules for ROM features | pass |
+| Small attributable reversible changes | pass (staged integrate; known-good images) |
+| Base = LOS 23.2 sunfish stack (no unrelated prebuilt kernel) | pass |
+| Constitution default root = KernelSU; no Magisk production stage | **variance** — see Complexity Tracking (owner ship decision in `009`) |
+| Signing/AVB historically `011` | **variance** — GOLDEN-class signing/AVB posture pulled into `009` acceptance (may stage inside feature) |
+
+**Post-design**: Magisk ship + signing/AVB-in-`009` remain justified variances;
+KernelSU recycle stays optional (FR-016). Recommend a later constitution
+amendment to align Root architecture text with Magisk resurrection — not
+blocking this plan.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/009-axp-los23-port/
+├── plan.md                 # this file
+├── research.md             # Phase 0
+├── data-model.md           # Phase 1
+├── quickstart.md           # Phase 1
+├── contracts/
+│   ├── packages.md
+│   ├── toggles-surface.md
+│   ├── magisk-preinstall.md
+│   ├── webview-surface.md
+│   └── acceptance-gates.md
+└── tasks.md                # /speckit-tasks (not this command)
+```
+
+### Host + tree
+
+```text
+# Meta-repo
+vendor/sunfish-a16/                    # product mk, permissions, patch apply
+docs/002-golden-inventory.md
+docs/004-phonesky-runbook.md
+docs/005-spoofing-runbook.md
+docs/008-call-rec-flag-secure-runbook.md
+docs/axp-pro-parity.md                 # non-normative; remap rows → 009 after tasks
+
+# rom-dev01
+/srv/rom/src/lineage/                  # LOS 23.2 sunfish tree
+/srv/rom/prebuilts/microg/             # newest microG + GSF
+/srv/rom/prebuilts/phonesky/           # project patched Phonesky (+ XMLs)
+/srv/rom/prebuilts/magisk/             # Magisk artifacts for AXP-like preinstall
+/srv/rom/prebuilts/axp-apps/           # bundled usability apps (newest stables)
+/srv/rom/secrets/                      # Phonesky / later release keys (never Git)
+/srv/rom/artifacts/009-axp-los23-port/ # images, hashes, version pins, LAB evidence
+/srv/rom/artifacts/007-…/              # optional KSU kernels (recycle only)
+```
+
+**Structure Decision**: Same meta-repo pattern as `004`/`005`/`008` —
+attributable packaging and patches via `vendor/sunfish-a16`; heavy tree and
+proprietary blobs only on `rom-dev01`. No megapatch dumps in Git.
+
+## Complexity Tracking
+
+| Violation | Why Needed | Simpler Alternative Rejected Because |
+|-----------|------------|--------------------------------------|
+| Magisk as ship root (constitution prefers KernelSU; forbids Magisk production stage) | Owner chose **AXP resurrection** = Magisk like GOLDEN (`009` FR-010); KSU out of ship for now | Keeping KernelSU abandons “todo igual que AXP”; Magisk A/B-only diagnostic does not meet ship parity |
+| GOLDEN-class hardening/signing/AVB inside `009` (was split `011`–`013`) | Owner Q2 = full resurrection, not apps-only | Deferring signing/hardening recreates the decide-scatter `009` was meant to end |
+| Single Magisk-resurrection feature owns large surface | Simplifies current ship without deleting standby KSU track | Re-merging both tracks into one ambiguous roadmap recreates decide-scatter |
+
+## Phase 0 / Phase 1
+
+See `research.md`, `data-model.md`, `contracts/*`, `quickstart.md`.
@@ -0,0 +1,81 @@
+# Quickstart: `009` AXP resurrection (LAB validation)
+
+**Device**: LAB only `11231JEC207477`  
+**Never**: flash / wipe / Magisk-change GOLDEN  
+**Evidence**: `/srv/rom/artifacts/009-axp-los23-port/<build-id>/`  
+**Contracts**: [packages](./contracts/packages.md),
+[toggles](./contracts/toggles-surface.md),
+[magisk](./contracts/magisk-preinstall.md),
+[webview](./contracts/webview-surface.md),
+[gates](./contracts/acceptance-gates.md)
+
+## Prerequisites
+
+- `003` vanilla (or documented equivalent) known-good on LAB at least once
+- Host artifacts: newest microG/GSF, project Phonesky, Magisk prebuilts,
+  bundled app set — under `/srv/rom/prebuilts/` (not Git)
+- GOLDEN Magisk preinstall notes measured (`adb` only) and copied into the
+  build’s magisk runbook snippet
+- Prefer **clean flash** for acceptance (dirty upgrade from KSU LAB images is
+  best-effort only)
+
+## 1. Flash + Gate A
+
+1. Flash `009` images from artifact dir; record SHA-256.
+2. Boot → unlock → place call → Wi‑Fi.
+3. Save `getprop` + brief notes under `…/gate-a/`.
+
+## 2. Google stack + toggles (Gates B/C)
+
+1. Enable Developer Options.
+2. Turn **Allow signature spoofing** ON; grant microG + Phonesky as required
+   (`005` runbook class).
+3. microG Self-Check → screenshot.
+4. Open Phonesky → install/update one ordinary app.
+5. Confirm Secure keys:
+
+```bash
+adb -s 11231JEC207477 shell settings get secure allow_signature_fake
+adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
+```
+
+6. Call-rec: ON → record a call → OFF → note stock policy.
+7. Record version pins (microG, GSF, Phonesky artifact id).
+
+## 3. Magisk (Gate D)
+
+1. Document pre-activation state vs GOLDEN notes.
+2. Complete Magisk activation per runbook.
+3. Configure DenyList-class hide for a banking package **before** first open.
+4. Save Magisk version + screenshots under `…/magisk/`.
+
+## 4. Banking (Gate E)
+
+1. Aurora → install Swissquote → **do not open**.
+2. DenyList → Island clone → first launch in Island → login.
+3. Repeat attempt for Yuh; classify PASS / attestation-like-GOLDEN /
+   packaging regression.
+4. Confirm banks lack root.
+
+## 5. Usability + WebView (Gate F)
+
+1. Confirm bundled categories vs pin record.
+2. `adb shell cmd webviewupdate current` → LOS default; chooser still listed.
+
+## 6. Hardening / signing class (Gate G)
+
+1. Run the hardening/signing checklist defined for this build stage.
+2. Any missing GOLDEN-class item → written impossible/gap note (no silent
+   skip).
+
+## Pass criteria
+
+All boxes in [acceptance-gates.md](./contracts/acceptance-gates.md) for the
+claimed stage. Full resurrection acceptance = Gates A–G.
+
+## Notes
+
+- Optional `007` kernels: may flash for debug only; do not claim ship.
+- Call-recording legality is the user’s responsibility.
+- If project Phonesky misbehaves vs GOLDEN needs → stop and reconsider; do
+  not accept Gate B.
@@ -0,0 +1,130 @@
+# Research: `009-axp-los23-port`
+
+## Decision: Product = AXP resurrection on LOS 23.2 (parallel track)
+
+**Decision**: Treat `009` as the normative ship feature **for the Magisk AXP
+resurrection track** that ports the AXP.OS / GOLDEN LOS22 capability set onto
+LineageOS 23.2 vanilla (`003`), with only the explicit exceptions in the spec
+(WebView, Phonesky artifact, optional KSU recycle). Keep the prior KernelSU /
+split roadmap (`004`–`008`/`007` + deferred items) on a **standby git branch**
+without deleting or rewriting those specs.
+
+**Rationale**: Owner wants Magisk “todo igual” to AXP now, without throwing
+away the earlier KSU investment; either track may resume later.
+
+**Alternatives considered**: Hard-supersede/delete the split roadmap —
+rejected (owner wants standby). Continue only KSU track — rejected for
+current ship preference.
+
+## Decision: Magisk ship root (constitution variance)
+
+**Decision**: Ship **Magisk** like GOLDEN — newest Magisk stable that works on
+sunfish / LOS 23.2 — in an AXP-like **preinstalled but not fully activated**
+layout. Measure the exact first-boot/setup UX on GOLDEN (`adb` only) before
+freezing LAB instructions. DenyList-class hiding for banks.
+
+**Rationale**: FR-010 / owner clarification; true AXP resurrection requires
+Magisk/Magia-class root, not KernelSU.
+
+**Alternatives considered**:
+
+- KernelSU-Next (`007`) as ship — rejected for this feature (out of ship for
+  now).
+- Rootless ship — rejected (banking DenyList workflow is part of GOLDEN).
+- Magisk only as temporary A/B diagnostic — insufficient for resurrection
+  acceptance.
+
+**Follow-up (non-blocking)**: Amend constitution Root architecture section in
+a later docs pass so it no longer contradicts Magisk-as-ship.
+
+## Decision: Optional recycle of `007` kernels (FR-016)
+
+**Decision**: Keep the two functional KernelSU kernels/artifacts. Reuse only
+if helpful (boot reference, differential debug, later optional path). Never
+gate Magisk acceptance on KSU work.
+
+**Alternatives considered**: Delete `007` artifacts — rejected (sunk cost;
+optional value). Force dual-boot Magisk+KSU ship — rejected (complexity).
+
+## Decision: Reuse `004`/`005` Google stack; bump microG; keep project Phonesky
+
+**Decision**:
+
+- microG GmsCore + GSF = **newest stable** (or newest tagged pre-release
+  upstream ships) verified on this stack; integrate with Phonesky as in AXP.
+- Phonesky = **project patched artifact** from the recent host pipeline
+  (`docs/004-phonesky-runbook.md` / `/srv/rom/prebuilts/phonesky/`), not a
+  blind newest Play download.
+- If LAB shows missing GOLDEN-class Play fixes with that artifact → **halt**
+  and reconsider Phonesky (spec edge case), do not silently ship FakeStore.
+- Signature spoofing = selectable DO toggle (`allow_signature_fake` class from
+  `005`); restricted grants for microG + Phonesky only.
+
+**Alternatives considered**: Newest Play APK every week without project patch
+pipeline — rejected (breaks reproducible priv-app signing). FakeStore —
+forbidden. Re-implement spoofing from scratch — reuse `005` unless A16 gaps.
+
+## Decision: Selectable call recording = EXTENDROM / `008` model
+
+**Decision**: Ship selectable call-recording unlock using GOLDEN-compatible
+`Settings.Secure.extendrom_call_recording` + Dialer gate (EXTENDROM
+`F_CALLREC` / `008` research). Default OFF.
+
+**Alternatives considered**: Magisk Dialer RRO — rejected (not selectable /
+not native). Blind old XML overlays — rejected for A16.
+
+**Note**: Project `FLAG_SECURE` override remains optional vs AXP acceptance;
+may ship if `008` work is cheap to include.
+
+## Decision: WebView = LOS23 default, chooser unlocked
+
+**Decision**: Do not ship Aosmium (EOL). Default = LineageOS 23 WebView.
+Preserve Android multi-provider selection (Developer options → WebView
+implementation).
+
+**Alternatives considered**: Bundle Vanadium/AOSmium fork — rejected (EOL /
+out of scope). Lock single provider — rejected (FR-015).
+
+## Decision: Bundled apps = GOLDEN/AXP categories @ newest stable
+
+**Decision**: Enumerate categories from `002` + AXP Pro catalog (Island,
+Aurora, F-Droid/repos as on GOLDEN, launcher/gallery-class, DNS/hosts privacy
+helpers if present). Install newest workable stables; pin versions in the
+acceptance record. Island remains the managed-profile tool (measured on
+GOLDEN).
+
+**Alternatives considered**: LOS defaults only — fails resurrection. Exact
+GOLDEN version freeze — rejected (owner wants newest stables except
+Phonesky).
+
+## Decision: Hardening / signing / AVB inside `009` (staged)
+
+**Decision**: Acceptance includes GOLDEN-class hardening and signing/AVB
+posture **as applicable** on LOS 23.2 / sunfish. Implement in **stages inside
+`009`** (functional Magisk+Google+apps first, then hardening/signing gates),
+but do not open a separate competing feature number for ship ownership.
+Document impossible-on-sunfish gaps rather than silent omit.
+
+**Rationale**: Owner Q2 = full resurrection; still obey constitution
+“small attributable reversible changes” via staged known-good LAB images.
+
+**Alternatives considered**: Defer all of `011`–`013` — rejected by owner.
+One mega-commit everything — rejected (attribution / bisect).
+
+## Decision: Banking workflow = GOLDEN Magisk DenyList + Island
+
+**Decision**: Restore constitution banking steps with **Magisk DenyList**
+(not KSU profiles) + Island: Aurora install → do not open → DenyList → clone
+to Island → first launch in Island. Swissquote PASS hard gate; Yuh honest vs
+GOLDEN attestation FAIL.
+
+**Alternatives considered**: Rootless-only banking gate — incomplete vs AXP.
+Insular rename — GOLDEN runs Island.
+
+## Decision: Version freshness policy
+
+**Decision**: Before long builds: `git fetch --tags` / refresh upstreams for
+microG, Magisk, bundled apps; record tag/commit + version codes; never ship
+from shallow or stale laptop caches (AGENTS.md lesson from `007`).
+
+**Alternatives considered**: Trust whatever is already on the host — rejected.
@@ -0,0 +1,426 @@
+# Feature Specification: AXP LOS22 feature port to LOS23
+
+**Feature Branch**: `009-axp-los23-port`
+
+**Created**: 2026-09-16
+
+**Status**: Clarified — ready for `/speckit-plan`
+
+**Input**: User description: "009-axp based LOS22 feature port to LOS23 —
+take vanilla LineageOS 23 for sunfish and integrate the full AXP.OS (LOS22 /
+Android 15 GOLDEN) feature set into LOS23 without product exceptions; only
+versions change (newest stable for each system / bundled app that still fits
+sunfish / Android 16); use the project's already updated patched Phonesky
+(Google Play)."
+
+**Owner clarifications (2026-09-16):** Magisk like GOLDEN (newest Magisk;
+AXP-style preinstalled-but-not-fully-activated layout — measure on GOLDEN);
+hardening / signing / AVB like GOLDEN (full **AXP resurrection** on LOS23);
+WebView exception = keep LOS23 WebView (Aosmium EOL) but leave provider
+selection unlocked; Phonesky = project patched build from recent work unless
+it lacks GOLDEN-class fixes (then reconsider); microG newest stable integrated
+with that Phonesky; signature spoofing and call recording **selectable**
+(toggles); KernelSU (`007`) out of ship for now, with optional recycle of
+existing functional kernels if useful; otherwise everything equal to
+AXP/GOLDEN.
+
+## Context / non-goals
+
+**Product intent (this feature is normative for the AXP resurrection ship):**
+
+- This feature is an **AXP.OS resurrection** on LineageOS 23.2 / Android 16
+  `sunfish`: same capability set as AXP on LOS22 / GOLDEN, moved to LOS23.
+- Base ROM = LineageOS 23.2 / Android 16 `sunfish` vanilla from `003` (or the
+  best known-good vanilla-equivalent flashable baseline already proven on LAB).
+- Feature source of truth for *what* to ship = what AXP.OS Pro / GOLDEN
+  provides on LOS22 (inventory in `002`, product catalog in
+  `docs/axp-pro-parity.md`), **without omitting AXP capabilities as “decide
+  later” rows**, including Magisk-class root and AXP-class hardening /
+  signing / AVB posture that GOLDEN represents.
+- Versions = **newest stable** (or newest tagged pre-release the upstream
+  project currently ships) for each system/bundled component, constrained to
+  what still works on sunfish / non-GKI 4.14 / LOS 23.2 — not stale laptop
+  caches or shallow-clone version lies.
+- **Phonesky exception:** ship the project's **already patched / fixed
+  Phonesky** from the recent host pipeline (not “whatever newest Play APK
+  is today”). If that build is missing fixes that GOLDEN's Phonesky path
+  still needs for daily-driver parity, stop and reconsider the Phonesky
+  plan before accepting the feature.
+- **WebView exception:** do **not** ship Aosmium (EOL). Default WebView =
+  LineageOS 23's WebView. The ROM MUST keep Android's multi-provider path so
+  the owner can install another WebView later and select it (Developer
+  options → WebView implementation) — not locked to a single provider.
+- Flash / experiment **LAB only**; GOLDEN remains the read-only oracle
+  (`docs/device-roles.md`).
+
+**Relationship to earlier features:**
+
+- `001`–`003` remain shared foundation (host, GOLDEN capture, vanilla build).
+- **Two parallel product tracks** (neither deletes the other):
+  - **Standby / prior track:** `004`–`008` + `007` KernelSU (+ deferred
+    `006`/`010`–`013` as previously planned). Kept intact for later resume;
+    live on its own git branch once pushed (see plan notes).
+  - **Active Magisk-resurrection track (this feature):** AXP→LOS23 ship with
+    Magisk like GOLDEN. Does **not** rewrite or remove `004`–`008`/`007`
+    specs; it is a new Speckit directory that may **reuse** proven LAB
+    runbooks/results from those features when helpful.
+- KernelSU / SusFS from `007` stays **out of this track’s ship** for now.
+  Recycle of the two functional `007` kernels is optional (FR-016) — never an
+  acceptance gate for Magisk.
+- Project-only `FLAG_SECURE` global override may still ship if already
+  specified under `008` (not AXP catalog); it is optional relative to AXP
+  resurrection acceptance. AXP call-recording unlock **is** required and must
+  be selectable.
+
+**Out of scope for this feature (explicit):**
+
+- Flashing or modifying GOLDEN.
+- Committing proprietary Google Phonesky APK bytes, private keys, or personal
+  identifiers to Git.
+- Replacing the LOS 23.2 sunfish kernel/device stack with an unrelated prebuilt
+  (Graphene A13, stock A13, etc.).
+- Shipping Aosmium / AOSmium as the default or only WebView (EOL).
+- Building a custom AXP-style backup/restore ROM feature (personal backup
+  remains an external user tool if needed).
+- Claiming Yuh hardware-attestation PASS if GOLDEN itself currently FAILs that
+  path — reproduce GOLDEN's *workflow* and document attestation parity honestly.
+- Deleting or rewriting the standby KernelSU / split-roadmap specs
+  (`004`–`008`/`007`) — they remain valid on the standby branch/track.
+- Shipping KernelSU-Next as this track’s root (out of ship here; Magisk is
+  the resurrection root). Optional later reuse of `007` kernels is allowed
+  under FR-016 but MUST NOT delay Magisk acceptance.
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - AXP resurrection daily-driver on LAB (Priority: P1)
+
+As the owner, after flashing one LAB build produced under this feature, the
+phone boots and presents the same class of daily-driver capabilities I rely on
+with AXP on GOLDEN (Google compatibility stack, Play, managed banking profile
+workflow, selectable call recording unlock, Magisk root/hide workflow like
+GOLDEN, AXP hardening/signing posture, and AXP bundled usability apps —
+except WebView as defined here), without a checklist of deferred AXP features.
+
+**Why this priority**: This is the whole reason for the resurrection.
+
+**Independent Test**: Flash one `009` build to LAB; walk the GOLDEN daily
+checklist (microG Self-Check, Play open/install, Island profile, call-record
+toggle off/on, spoofing toggle off/on, Magisk present in AXP-like install
+state, bundled apps present, hardening/signing checks that GOLDEN implies);
+compare against `002` inventory categories.
+
+**Acceptance Scenarios**:
+
+1. **Given** LAB on a vanilla `003` baseline (or documented equivalent),
+   **When** the `009` image is flashed, **Then** the device boots to home and
+   cellular/Wi‑Fi/basic hardware still work as in the vanilla smoke.
+2. **Given** that build, **When** I compare shipped capability categories to
+   GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, managed profile
+   tool, selectable call recording unlock, Magisk/DenyList-class path,
+   DNS/hosts privacy helpers if present on GOLDEN, F‑Droid/Aurora/launcher/
+   gallery-class bundled apps, hardening/signing/AVB class), **Then** no
+   category is left as “decide / later” without an explicit obsolescence note
+   tied to Android 16 / sunfish impossibility (WebView exception allowed per
+   FR-015).
+3. **Given** Git and host artifact policy, **When** inspected, **Then** no
+   proprietary Phonesky APK bytes or secrets were committed.
+
+---
+
+### User Story 2 - Google stack: newest microG + project Phonesky (Priority: P1)
+
+As the owner, newest-stable microG + GSF Proxy integrate with the project's
+recent patched Phonesky so I can open Play, sign in as needed, and
+install/update apps the same way I do on AXP; signature spoofing is
+selectable (off = stock-safe default behaviour; on = needed Play/microG
+path).
+
+**Why this priority**: Without Play/microG parity, the ROM is not a daily
+driver.
+
+**Independent Test**: microG Self-Check; Phonesky launches; install or update
+at least one ordinary app; toggle spoofing off/on and confirm expected
+behaviour; push notifications smoke for a known test app.
+
+**Acceptance Scenarios**:
+
+1. **Given** the `009` build on LAB, **When** microG Settings Self-Check runs
+   with spoofing enabled as required, **Then** checks required for basic
+   Google compatibility pass (or each remaining failure is documented as
+   attestation/hardware outside packaging).
+2. **Given** the project's current patched Phonesky host artifacts, **When**
+   the ROM is built and flashed, **Then** `com.android.vending` is present as
+   privileged Play and opens on LAB.
+3. **Given** selectable signature spoofing, **When** the owner turns it on,
+   **Then** Play install/update works with microG without FakeStore; **When**
+   turned off, **Then** the device does not expose unrestricted spoofing to
+   arbitrary apps.
+4. **Given** version policy, **When** microG / GSF versions are recorded,
+   **Then** each is the newest stable (or tagged pre-release upstream
+   currently ships) verified on this stack; Phonesky version matches the
+   project patched artifact (not a blind “newest Play from the internet”).
+5. **Given** Play behaviour on LAB, **When** compared to GOLDEN needs, **Then**
+   if the project Phonesky lacks a GOLDEN-class fix required for daily use,
+   acceptance stops and the Phonesky plan is reconsidered.
+
+---
+
+### User Story 3 - Banking profile workflow parity (Priority: P1)
+
+As the owner, I can recreate the GOLDEN banking layout on LAB: install via the
+same store path I use on AXP, place banks in Island, and keep banking apps
+free of root via Magisk DenyList-class hiding like GOLDEN.
+
+**Why this priority**: Compatibility hard gates; daily-driver without banks
+fails the resurrection.
+
+**Independent Test**: Install Swissquote (hard gate) and attempt Yuh; run
+inside Island; Magisk DenyList (or AXP-equivalent) applied; record PASS/FAIL
+honestly vs GOLDEN.
+
+**Acceptance Scenarios**:
+
+1. **Given** Island on LAB, **When** I follow the documented GOLDEN banking
+   install order, **Then** Swissquote reaches a usable logged-in state in the
+   managed profile.
+2. **Given** Yuh on the same workflow, **When** tested, **Then** either it
+   PASSes or the failure matches the known GOLDEN attestation-class failure
+   and is documented — not a silent packaging regression.
+3. **Given** Magisk is present on the build, **When** banking apps run with
+   DenyList-class configuration, **Then** they do not receive root.
+
+---
+
+### User Story 4 - Magisk like GOLDEN + selectable call recording (Priority: P1)
+
+As the owner, Magisk is present the way AXP/GOLDEN presents it (newest Magisk;
+preinstalled but not fully activated until I finish setup — exact UX measured
+from GOLDEN), with DenyList-class hiding; call recording unlock is selectable
+like other Developer Options toggles.
+
+**Why this priority**: Root and call recording are core AXP daily behaviours.
+
+**Independent Test**: Confirm Magisk package/binary layout vs GOLDEN notes;
+complete activation on LAB if required; DenyList a test app; toggle call
+recording unlock off (restricted) and on (record allowed).
+
+**Acceptance Scenarios**:
+
+1. **Given** a fresh `009` flash, **When** inspected, **Then** Magisk is
+   present in an AXP-like preinstalled / not-fully-activated state consistent
+   with GOLDEN measurement, using the newest Magisk stable that works on this
+   stack.
+2. **Given** Magisk setup completed on LAB, **When** DenyList-class hiding is
+   configured for a banking package, **Then** that package does not receive
+   root.
+3. **Given** selectable call recording unlock, **When** OFF, **Then** stock
+   LOS country/carrier style restrictions apply; **When** ON, **Then** Dialer
+   can record on LAB without that block.
+
+---
+
+### User Story 5 - AXP usability, privacy, hardening (Priority: P2)
+
+As the owner, the ROM ships the rest of the AXP usability/privacy surface and
+GOLDEN-class hardening/signing/AVB posture at newest workable stables, with
+LOS23 WebView default and an unlocked provider chooser.
+
+**Why this priority**: Completes resurrection beyond Google/banking/root core.
+
+**Independent Test**: Package list vs `002`; open bundled apps; confirm
+default WebView is LOS and another WebView can be selected if installed;
+hardening/signing checks agreed for GOLDEN-class parity.
+
+**Acceptance Scenarios**:
+
+1. **Given** the `009` build, **When** I list bundled system/user apps in the
+   AXP usability set, **Then** each GOLDEN/AXP category is present or
+   explicitly marked impossible on Android 16/sunfish with rationale
+   (Aosmium absence is the allowed WebView exception).
+2. **Given** Developer options, **When** I open WebView implementation,
+   **Then** LOS23 WebView is available/default and the chooser is not locked
+   against future alternate providers.
+3. **Given** version policy, **When** bundled apps (except Phonesky per
+   FR-004) are recorded, **Then** each is newest stable that still runs on
+   the ROM.
+4. **Given** GOLDEN/AXP hardening and signing expectations, **When** the
+   accepted build is evaluated, **Then** equivalent class of protections /
+   signing posture is present or each gap is documented as impossible on
+   this stack — not silently dropped.
+
+---
+
+### User Story 6 - Parallel tracks stay honest (Priority: P2)
+
+As the owner, docs make clear that **this** Speckit is the Magisk AXP
+resurrection track on LOS23, while the prior KernelSU / split roadmap remains
+on standby (other branch / same `004`–`008`/`007` specs untouched).
+
+**Why this priority**: Lets either track resume without rewriting history.
+
+**Independent Test**: `specs/004`–`008`/`007` still exist unchanged in intent;
+`009` describes Magisk resurrection; git branches separate standby vs active
+work when published.
+
+**Acceptance Scenarios**:
+
+1. **Given** the repo, **When** inspected, **Then** `001`–`008`/`007` spec
+   directories remain present (not deleted by `009`).
+2. **Given** `009`, **When** read as ship intent for Magisk resurrection,
+   **Then** it does not claim to permanently retire the standby track — only
+   that KernelSU is out of *this* track’s ship for now.
+
+---
+
+### Edge Cases
+
+- Newer “stable” of a bundled app breaks Android 16 / sunfish: pin last known
+  good, document the regression, and retry when a fixed release exists.
+- Project Phonesky missing a GOLDEN-class fix: halt acceptance; reconsider
+  Phonesky patch/version plan before claiming Play parity.
+- Magisk “preinstalled but not fully installed” UX differs across Magisk
+  versions: match GOLDEN's *class* of first-boot/setup behaviour; document
+  exact measured steps from GOLDEN before freezing LAB instructions.
+- GOLDEN Yuh FAIL vs LAB FAIL: distinguish attestation/hardware class from
+  packaging/spoofing regressions.
+- Vanilla LOS already provides an AXP capability (e.g. WireGuard, encryption):
+  keep LOS behaviour; do not duplicate.
+- Dirty upgrade from older LAB experimental (incl. KernelSU) images: prefer
+  clean flash for acceptance.
+- Phonesky host artifacts missing or wrong signature: fail closed — never
+  silently fall back to FakeStore.
+- Alternate WebView installed by user later: selection must remain possible;
+  default remains LOS23 WebView until the user changes it.
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+- **FR-001**: The project MUST produce a flashable LineageOS 23.2 / Android 16
+  `sunfish` build that resurrects the AXP.OS on LOS22 / GOLDEN capability set
+  (including Magisk-class root and GOLDEN-class hardening / signing / AVB
+  posture), without leaving AXP capabilities as open “decide” omissions
+  except the WebView exception in FR-015.
+- **FR-002**: Version selection for system and bundled components (except
+  Phonesky per FR-004) MUST prefer the newest stable (or newest tagged
+  pre-release upstream currently ships) that still works on sunfish /
+  LOS 23.2; GOLDEN versions are a floor reference, not a freeze.
+- **FR-003**: The ROM MUST ship newest-stable microG Services Core and GSF
+  Proxy integrated with the project Phonesky (no FakeStore as primary Play).
+- **FR-004**: The ROM MUST ship the project's recent patched Phonesky as
+  privileged `com.android.vending`, with a documented host-side obtain /
+  patch / sign / deploy path that never commits APK bytes to Git. If that
+  artifact lacks GOLDEN-class fixes required for daily-driver Play behaviour,
+  the Phonesky plan MUST be reconsidered before acceptance.
+- **FR-005**: The ROM MUST provide **selectable** signature spoofing for the
+  microG + Phonesky path (owner-controlled toggle; default safe/off or
+  project-documented default). Spoofing MUST remain restricted/controlled —
+  not unrestricted platform spoofing for all apps.
+- **FR-006**: The ROM MUST support the GOLDEN managed-profile banking workflow
+  (Island as measured on GOLDEN) including Swissquote PASS as a hard gate.
+- **FR-007**: Banking applications MUST run without being granted root
+  (Magisk DenyList-class hiding).
+- **FR-008**: The ROM MUST include **selectable** AXP-equivalent call
+  recording unlock (toggle; OFF = stock LOS restrictions, ON = unlock).
+- **FR-009**: The ROM MUST include the AXP usability/privacy bundled surface
+  present on GOLDEN / AXP Pro (stores, launcher/gallery-class apps, DNS/hosts
+  or equivalent blockers when part of that surface) at newest workable
+  stables, subject to FR-015 for WebView.
+- **FR-010**: The ROM MUST ship **Magisk** like GOLDEN: newest Magisk stable
+  that works on this stack, in an AXP-like preinstalled but not fully
+  activated layout (exact first-boot/setup behaviour measured from GOLDEN),
+  with DenyList-class hiding sufficient for FR-007. KernelSU is **out of
+  ship for now** (not the resurrection root path).
+- **FR-011**: The feature acceptance gate MUST include GOLDEN/AXP-class
+  hardening and signing / AVB posture (as applicable on LOS 23.2 / sunfish),
+  not only apps and Google compatibility. Gaps MUST be documented as
+  impossible on this stack rather than silently omitted.
+- **FR-012**: Acceptance flashing MUST use LAB only; GOLDEN MUST remain
+  unmodified by this feature's work.
+- **FR-013**: Each shipped capability MUST be attributable (what upstream or
+  AXP behaviour it reproduces) and reversible (known-good prior LAB image
+  retained).
+- **FR-014**: This feature MUST live as a **new Speckit** (`009`) in parallel
+  with the standby KernelSU / split roadmap (`004`–`008`/`007`). Those older
+  specs MUST NOT be deleted or rewritten to match Magisk resurrection.
+  Reusable runbooks/results from them MAY be referenced. For *this* track’s
+  ship only, Magisk (not KernelSU) is the root path.
+- **FR-015**: Default WebView MUST be LineageOS 23's WebView. Aosmium MUST NOT
+  be required. The ROM MUST keep WebView provider selection available so a
+  future alternate WebView can be installed and chosen.
+- **FR-016**: Existing functional KernelSU / related kernels and artifacts
+  from `007` SHOULD be retained and MAY be recycled when useful (reference
+  boot images, differential debugging, or a later optional non-ship path).
+  Such reuse is **optional** (“si se puede, ok”), MUST NOT become an
+  acceptance requirement for Magisk resurrection, and MUST NOT imply KernelSU
+  is back in the ship path unless a future spec explicitly says so.
+
+### Key Entities
+
+- **Vanilla baseline**: The LOS 23.2 sunfish build from `003` (or documented
+  equivalent) before AXP feature integration.
+- **AXP capability set**: Inventory of features/packages/behaviours from
+  GOLDEN (`002`) plus AXP Pro catalog rows promoted by this spec
+  (resurrection target).
+- **Version pin record**: Documented package/component versions chosen for the
+  accepted `009` build (newest workable stable each; Phonesky = project
+  artifact id/version).
+- **Phonesky host artifact**: Project patched/signed Play APK and permission
+  metadata kept outside Git on the build host.
+- **Magisk preinstall state**: Measured GOLDEN/AXP layout for Magisk present
+  but not fully activated, plus LAB setup steps.
+- **LAB acceptance build**: Flashable image set + hashes + smoke/banking /
+  Magisk / hardening results for this feature.
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-001**: One LAB flash of a `009` build boots and completes the vanilla
+  hardware smoke within the same session as flash (owner can place a call,
+  use Wi‑Fi, and unlock the device).
+- **SC-002**: 100% of AXP resurrection capability categories from the agreed
+  inventory are either demonstrated on LAB or explicitly documented as
+  impossible on Android 16/sunfish — zero silent omissions (WebView exception
+  allowed only as FR-015).
+- **SC-003**: With spoofing enabled as required, microG Self-Check required
+  items and project Phonesky open/install succeed on LAB for ordinary apps on
+  the first accepted build candidate (or within one documented fix iteration).
+- **SC-004**: Swissquote managed-profile + Magisk DenyList-class workflow
+  PASSes on LAB; Yuh result is recorded and is not worse than GOLDEN for
+  packaging/spoofing reasons.
+- **SC-005**: Every bundled/system app version in the acceptance record
+  (except Phonesky) is newer than or equal to GOLDEN's measured version,
+  unless a newer release was tried and failed with a written regression note;
+  Phonesky matches the recorded project patched artifact.
+- **SC-006**: Owner can turn signature spoofing and call recording unlock off
+  and on and observe the documented behaviour each time.
+- **SC-007**: Magisk is present post-flash in the AXP-like preinstall state and
+  can be fully activated on LAB using documented steps measured from GOLDEN.
+- **SC-008**: Default WebView is LOS23's; provider selection remains available.
+- **SC-009**: Owner can perform the GOLDEN-equivalent daily checklist on LAB
+  without consulting a scatter of conflicting feature specs for what “ships”.
+
+## Assumptions
+
+- `003` vanilla LOS 23.2 sunfish is (or becomes) available as the integration
+  base; LAB stock rescue from `002` remains valid.
+- GOLDEN inventory (`002`) plus AXP Pro docs are sufficient to enumerate the
+  capability set; live `adb` re-query of GOLDEN is allowed (especially Magisk
+  preinstall/activation details).
+- “AXP resurrection” means Magisk + GOLDEN-class hardening/signing/AVB + full
+  AXP user surface on LOS23, with only the stated WebView and Phonesky-artifact
+  exceptions.
+- Island remains the managed-profile tool because that is what GOLDEN
+  actually runs (AXP docs saying “Insular” are historical naming).
+- FakeStore is never the primary Play path.
+- Selectable spoofing and selectable call recording follow the same class of
+  Developer Options UX already explored in `005`/`008` runbooks where useful.
+- Project `FLAG_SECURE` override is nice-to-have, not an AXP resurrection
+  hard gate.
+- Personal app/data backup is not a ROM feature gate.
+- Builds and long compiles run on `rom-dev01`; laptop holds docs/specs and
+  flash tools only.
+- Prior KernelSU LAB experiments (including the two functional kernels already
+  built) are **out of ship for now** but kept as recyclable assets: reuse if
+  helpful, never required for Magisk acceptance.