AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
2026-09-16 21:56:22 +00:00
commit 12d2179c20
@@ -0,0 +1,106 @@
+# Data model: `009-axp-los23-port`
+
+## Entities
+
+### VanillaBaseline
+
+| Field | Type | Rules |
+|-------|------|--------|
+| source | string | `003` LOS 23.2 sunfish (or documented equivalent) |
+| manifest_rev | string | recorded repo manifest revision |
+| lab_smoke | enum | `pass` required before AXP integrate stages |
+
+### AxpCapabilitySet
+
+| Field | Type | Rules |
+|-------|------|--------|
+| category | string | e.g. google-stack, magisk, banking, call-rec, bundled-apps, hardening |
+| golden_ref | string | pointer into `002` / AXP Pro row |
+| status | enum | `required` \| `exception` \| `impossible` |
+| notes | string | WebView=exception; others default required |
+
+### VersionPinRecord
+
+| Field | Type | Rules |
+|-------|------|--------|
+| component | string | microG, GSF, Magisk, Island, Aurora, … |
+| version_name | string | human version |
+| version_code | int/string | as applicable |
+| upstream_ref | string | tag/commit/URL |
+| policy | enum | `newest_stable` \| `project_phonesky` \| `los_default` |
+| verified_on | date | LAB verification date |
+
+**Phonesky row**: `policy=project_phonesky` — must match host artifact id, not
+“newest Play on internet”.
+
+### PhoneskyHostArtifact
+
+| Field | Type | Rules |
+|-------|------|--------|
+| path | string | under `/srv/rom/prebuilts/phonesky/` (not Git) |
+| package | string | `com.android.vending` |
+| signature | string | project/patch pipeline identity |
+| privapp | bool | must be true |
+| golden_fix_gap | bool | if true → halt acceptance / reconsider |
+
+### MagiskPreinstallState
+
+| Field | Type | Rules |
+|-------|------|--------|
+| magisk_version | string | newest stable verified |
+| layout | string | measured GOLDEN/AXP preinstalled-not-fully-activated |
+| activated_on_lab | bool | true after owner completes setup |
+| denylist | set | banking packages hidden from root |
+
+**Transitions**: `flashed_preinstall` → `activated` → `denylist_configured`
+→ `banking_ready`.
+
+### SecureToggle
+
+| Field | Type | Rules |
+|-------|------|--------|
+| key | string | `allow_signature_fake` or `extendrom_call_recording` |
+| value | int | `0` default / `1` on |
+| surface | string | Developer Options |
+
+### ManagedProfileBanking
+
+| Field | Type | Rules |
+|-------|------|--------|
+| tool | string | Island (`com.oasisfeng.island…`) |
+| swissquote | enum | `pass` required |
+| yuh | enum | `pass` \| `fail_attestation_like_golden` \| `fail_regression` |
+| root_to_banks | bool | must be false |
+
+### WebViewPolicy
+
+| Field | Type | Rules |
+|-------|------|--------|
+| default_provider | string | LOS23 WebView |
+| aosmium | bool | must be false (not required/shipped) |
+| chooser_unlocked | bool | must be true |
+
+### LabAcceptanceBuild
+
+| Field | Type | Rules |
+|-------|------|--------|
+| artifact_dir | string | `/srv/rom/artifacts/009-axp-los23-port/…` |
+| hashes | map | SHA-256 of flashables |
+| version_pins | ref | VersionPinRecord set |
+| gates | ref | contracts/acceptance-gates.md checklist |
+
+### OptionalKsuRecycleAsset
+
+| Field | Type | Rules |
+|-------|------|--------|
+| path | string | existing `007` kernel/artifact |
+| used_for | string | optional debug/reference |
+| ship | bool | always false unless future spec says otherwise |
+
+## Relationships
+
+- `LabAcceptanceBuild` includes one `VersionPinRecord` set + Magisk state +
+  toggle defaults + banking results + WebViewPolicy.
+- `PhoneskyHostArtifact` feeds product packaging; never stored in Git.
+- `AxpCapabilitySet` drives which bundled packages appear in pins.
+- `OptionalKsuRecycleAsset` must not appear as required on acceptance gates.