AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/009-axp-los23-port/quickstart.md

@@ -0,0 +1,81 @@
+# Quickstart: `009` AXP resurrection (LAB validation)
+
+**Device**: LAB only `11231JEC207477`  
+**Never**: flash / wipe / Magisk-change GOLDEN  
+**Evidence**: `/srv/rom/artifacts/009-axp-los23-port/<build-id>/`  
+**Contracts**: [packages](./contracts/packages.md),
+[toggles](./contracts/toggles-surface.md),
+[magisk](./contracts/magisk-preinstall.md),
+[webview](./contracts/webview-surface.md),
+[gates](./contracts/acceptance-gates.md)
+
+## Prerequisites
+
+- `003` vanilla (or documented equivalent) known-good on LAB at least once
+- Host artifacts: newest microG/GSF, project Phonesky, Magisk prebuilts,
+  bundled app set — under `/srv/rom/prebuilts/` (not Git)
+- GOLDEN Magisk preinstall notes measured (`adb` only) and copied into the
+  build’s magisk runbook snippet
+- Prefer **clean flash** for acceptance (dirty upgrade from KSU LAB images is
+  best-effort only)
+
+## 1. Flash + Gate A
+
+1. Flash `009` images from artifact dir; record SHA-256.
+2. Boot → unlock → place call → Wi‑Fi.
+3. Save `getprop` + brief notes under `…/gate-a/`.
+
+## 2. Google stack + toggles (Gates B/C)
+
+1. Enable Developer Options.
+2. Turn **Allow signature spoofing** ON; grant microG + Phonesky as required
+   (`005` runbook class).
+3. microG Self-Check → screenshot.
+4. Open Phonesky → install/update one ordinary app.
+5. Confirm Secure keys:
+
+```bash
+adb -s 11231JEC207477 shell settings get secure allow_signature_fake
+adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
+```
+
+6. Call-rec: ON → record a call → OFF → note stock policy.
+7. Record version pins (microG, GSF, Phonesky artifact id).
+
+## 3. Magisk (Gate D)
+
+1. Document pre-activation state vs GOLDEN notes.
+2. Complete Magisk activation per runbook.
+3. Configure DenyList-class hide for a banking package **before** first open.
+4. Save Magisk version + screenshots under `…/magisk/`.
+
+## 4. Banking (Gate E)
+
+1. Aurora → install Swissquote → **do not open**.
+2. DenyList → Island clone → first launch in Island → login.
+3. Repeat attempt for Yuh; classify PASS / attestation-like-GOLDEN /
+   packaging regression.
+4. Confirm banks lack root.
+
+## 5. Usability + WebView (Gate F)
+
+1. Confirm bundled categories vs pin record.
+2. `adb shell cmd webviewupdate current` → LOS default; chooser still listed.
+
+## 6. Hardening / signing class (Gate G)
+
+1. Run the hardening/signing checklist defined for this build stage.
+2. Any missing GOLDEN-class item → written impossible/gap note (no silent
+   skip).
+
+## Pass criteria
+
+All boxes in [acceptance-gates.md](./contracts/acceptance-gates.md) for the
+claimed stage. Full resurrection acceptance = Gates A–G.
+
+## Notes
+
+- Optional `007` kernels: may flash for debug only; do not claim ship.
+- Call-recording legality is the user’s responsibility.
+- If project Phonesky misbehaves vs GOLDEN needs → stop and reconsider; do
+  not accept Gate B.