AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/009-axp-los23-port/contracts/acceptance-gates.md

@@ -0,0 +1,53 @@
+# Contract: LAB acceptance gates (`009`)
+
+**Device**: LAB `11231JEC207477` only — never GOLDEN  
+**Evidence**: `/srv/rom/artifacts/009-axp-los23-port/<build-id>/`
+
+## Gate A — Boot / hardware
+
+- [ ] Clean flash boots to home
+- [ ] Call + Wi‑Fi + unlock smoke (vanilla class)
+
+## Gate B — Google stack
+
+- [ ] microG Self-Check required items pass with spoofing ON as needed
+- [ ] Project Phonesky opens; ordinary app install/update works
+- [ ] No FakeStore primary
+- [ ] Version pins: microG/GSF newest stable; Phonesky = project artifact
+- [ ] If Play lacks GOLDEN-class fix → **FAIL closed** (reconsider Phonesky)
+
+## Gate C — Toggles
+
+- [ ] Spoofing OFF/ON behaviour per `toggles-surface.md`
+- [ ] Call-rec OFF/ON behaviour per `toggles-surface.md`
+
+## Gate D — Magisk
+
+- [ ] Preinstall state matches measured GOLDEN/AXP class
+- [ ] Activation documented and completed on LAB
+- [ ] DenyList-class hides root from a test/banking package
+
+## Gate E — Banking
+
+- [ ] Island present; Swissquote PASS in managed profile workflow
+- [ ] Yuh recorded; not worse than GOLDEN for packaging/spoofing reasons
+- [ ] Banks do not receive root
+
+## Gate F — Usability / WebView
+
+- [ ] Bundled AXP categories present or documented impossible
+- [ ] Versions newest workable (except Phonesky rule)
+- [ ] WebView default LOS; chooser unlocked
+
+## Gate G — Hardening / signing class
+
+- [ ] GOLDEN-class hardening/signing/AVB posture present **or** each gap
+      documented as impossible on this stack (no silent omit)
+- [ ] Staged known-good images retained for bisect
+
+## Non-gates
+
+- KernelSU presence or SusFS
+- FLAG_SECURE override (optional)
+- Custom AXP backup ROM feature
+- Yuh PASS if GOLDEN attestation path still FAILs equivalently