AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/009-axp-los23-port/research.md

@@ -0,0 +1,130 @@
+# Research: `009-axp-los23-port`
+
+## Decision: Product = AXP resurrection on LOS 23.2 (parallel track)
+
+**Decision**: Treat `009` as the normative ship feature **for the Magisk AXP
+resurrection track** that ports the AXP.OS / GOLDEN LOS22 capability set onto
+LineageOS 23.2 vanilla (`003`), with only the explicit exceptions in the spec
+(WebView, Phonesky artifact, optional KSU recycle). Keep the prior KernelSU /
+split roadmap (`004`–`008`/`007` + deferred items) on a **standby git branch**
+without deleting or rewriting those specs.
+
+**Rationale**: Owner wants Magisk “todo igual” to AXP now, without throwing
+away the earlier KSU investment; either track may resume later.
+
+**Alternatives considered**: Hard-supersede/delete the split roadmap —
+rejected (owner wants standby). Continue only KSU track — rejected for
+current ship preference.
+
+## Decision: Magisk ship root (constitution variance)
+
+**Decision**: Ship **Magisk** like GOLDEN — newest Magisk stable that works on
+sunfish / LOS 23.2 — in an AXP-like **preinstalled but not fully activated**
+layout. Measure the exact first-boot/setup UX on GOLDEN (`adb` only) before
+freezing LAB instructions. DenyList-class hiding for banks.
+
+**Rationale**: FR-010 / owner clarification; true AXP resurrection requires
+Magisk/Magia-class root, not KernelSU.
+
+**Alternatives considered**:
+
+- KernelSU-Next (`007`) as ship — rejected for this feature (out of ship for
+  now).
+- Rootless ship — rejected (banking DenyList workflow is part of GOLDEN).
+- Magisk only as temporary A/B diagnostic — insufficient for resurrection
+  acceptance.
+
+**Follow-up (non-blocking)**: Amend constitution Root architecture section in
+a later docs pass so it no longer contradicts Magisk-as-ship.
+
+## Decision: Optional recycle of `007` kernels (FR-016)
+
+**Decision**: Keep the two functional KernelSU kernels/artifacts. Reuse only
+if helpful (boot reference, differential debug, later optional path). Never
+gate Magisk acceptance on KSU work.
+
+**Alternatives considered**: Delete `007` artifacts — rejected (sunk cost;
+optional value). Force dual-boot Magisk+KSU ship — rejected (complexity).
+
+## Decision: Reuse `004`/`005` Google stack; bump microG; keep project Phonesky
+
+**Decision**:
+
+- microG GmsCore + GSF = **newest stable** (or newest tagged pre-release
+  upstream ships) verified on this stack; integrate with Phonesky as in AXP.
+- Phonesky = **project patched artifact** from the recent host pipeline
+  (`docs/004-phonesky-runbook.md` / `/srv/rom/prebuilts/phonesky/`), not a
+  blind newest Play download.
+- If LAB shows missing GOLDEN-class Play fixes with that artifact → **halt**
+  and reconsider Phonesky (spec edge case), do not silently ship FakeStore.
+- Signature spoofing = selectable DO toggle (`allow_signature_fake` class from
+  `005`); restricted grants for microG + Phonesky only.
+
+**Alternatives considered**: Newest Play APK every week without project patch
+pipeline — rejected (breaks reproducible priv-app signing). FakeStore —
+forbidden. Re-implement spoofing from scratch — reuse `005` unless A16 gaps.
+
+## Decision: Selectable call recording = EXTENDROM / `008` model
+
+**Decision**: Ship selectable call-recording unlock using GOLDEN-compatible
+`Settings.Secure.extendrom_call_recording` + Dialer gate (EXTENDROM
+`F_CALLREC` / `008` research). Default OFF.
+
+**Alternatives considered**: Magisk Dialer RRO — rejected (not selectable /
+not native). Blind old XML overlays — rejected for A16.
+
+**Note**: Project `FLAG_SECURE` override remains optional vs AXP acceptance;
+may ship if `008` work is cheap to include.
+
+## Decision: WebView = LOS23 default, chooser unlocked
+
+**Decision**: Do not ship Aosmium (EOL). Default = LineageOS 23 WebView.
+Preserve Android multi-provider selection (Developer options → WebView
+implementation).
+
+**Alternatives considered**: Bundle Vanadium/AOSmium fork — rejected (EOL /
+out of scope). Lock single provider — rejected (FR-015).
+
+## Decision: Bundled apps = GOLDEN/AXP categories @ newest stable
+
+**Decision**: Enumerate categories from `002` + AXP Pro catalog (Island,
+Aurora, F-Droid/repos as on GOLDEN, launcher/gallery-class, DNS/hosts privacy
+helpers if present). Install newest workable stables; pin versions in the
+acceptance record. Island remains the managed-profile tool (measured on
+GOLDEN).
+
+**Alternatives considered**: LOS defaults only — fails resurrection. Exact
+GOLDEN version freeze — rejected (owner wants newest stables except
+Phonesky).
+
+## Decision: Hardening / signing / AVB inside `009` (staged)
+
+**Decision**: Acceptance includes GOLDEN-class hardening and signing/AVB
+posture **as applicable** on LOS 23.2 / sunfish. Implement in **stages inside
+`009`** (functional Magisk+Google+apps first, then hardening/signing gates),
+but do not open a separate competing feature number for ship ownership.
+Document impossible-on-sunfish gaps rather than silent omit.
+
+**Rationale**: Owner Q2 = full resurrection; still obey constitution
+“small attributable reversible changes” via staged known-good LAB images.
+
+**Alternatives considered**: Defer all of `011`–`013` — rejected by owner.
+One mega-commit everything — rejected (attribution / bisect).
+
+## Decision: Banking workflow = GOLDEN Magisk DenyList + Island
+
+**Decision**: Restore constitution banking steps with **Magisk DenyList**
+(not KSU profiles) + Island: Aurora install → do not open → DenyList → clone
+to Island → first launch in Island. Swissquote PASS hard gate; Yuh honest vs
+GOLDEN attestation FAIL.
+
+**Alternatives considered**: Rootless-only banking gate — incomplete vs AXP.
+Insular rename — GOLDEN runs Island.
+
+## Decision: Version freshness policy
+
+**Decision**: Before long builds: `git fetch --tags` / refresh upstreams for
+microG, Magisk, bundled apps; record tag/commit + version codes; never ship
+from shallow or stale laptop caches (AGENTS.md lesson from `007`).
+
+**Alternatives considered**: Trust whatever is already on the host — rejected.