AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/009-axp-los23-port/contracts/toggles-surface.md

@@ -0,0 +1,36 @@
+# Contract: selectable toggles (spoofing + call recording)
+
+**Surface**: Developer Options (AXP-like)  
+**Defaults**: OFF (`0`) unless a documented project default says otherwise
+
+## Signature spoofing
+
+| Item | Value |
+|------|--------|
+| Secure key | `allow_signature_fake` (GOLDEN/AXP class from `005`) |
+| OFF | Spoofing has no effect even if prior grants exist |
+| ON | Authorized packages (microG, Phonesky) may use restricted spoofing |
+| Forbidden | Unrestricted platform spoofing for arbitrary apps |
+
+```bash
+adb shell settings get secure allow_signature_fake
+# expect 0/null default; 1 when enabled
+```
+
+## Call recording unlock
+
+| Item | Value |
+|------|--------|
+| Secure key | `extendrom_call_recording` |
+| OFF | Stock LOS country/carrier-style Dialer policy |
+| ON | Dialer `canRecordInCurrentCountry()` allows recording |
+
+```bash
+adb shell settings get secure extendrom_call_recording
+# expect 0/null default; 1 when enabled
+```
+
+## Optional (not AXP hard gate)
+
+`disable_secure_windows` / FLAG_SECURE override may ship if already wired
+(`008`); absence does not fail AXP resurrection acceptance.