AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/009-axp-los23-port/spec.md

@@ -0,0 +1,426 @@
+# Feature Specification: AXP LOS22 feature port to LOS23
+
+**Feature Branch**: `009-axp-los23-port`
+
+**Created**: 2026-09-16
+
+**Status**: Clarified — ready for `/speckit-plan`
+
+**Input**: User description: "009-axp based LOS22 feature port to LOS23 —
+take vanilla LineageOS 23 for sunfish and integrate the full AXP.OS (LOS22 /
+Android 15 GOLDEN) feature set into LOS23 without product exceptions; only
+versions change (newest stable for each system / bundled app that still fits
+sunfish / Android 16); use the project's already updated patched Phonesky
+(Google Play)."
+
+**Owner clarifications (2026-09-16):** Magisk like GOLDEN (newest Magisk;
+AXP-style preinstalled-but-not-fully-activated layout — measure on GOLDEN);
+hardening / signing / AVB like GOLDEN (full **AXP resurrection** on LOS23);
+WebView exception = keep LOS23 WebView (Aosmium EOL) but leave provider
+selection unlocked; Phonesky = project patched build from recent work unless
+it lacks GOLDEN-class fixes (then reconsider); microG newest stable integrated
+with that Phonesky; signature spoofing and call recording **selectable**
+(toggles); KernelSU (`007`) out of ship for now, with optional recycle of
+existing functional kernels if useful; otherwise everything equal to
+AXP/GOLDEN.
+
+## Context / non-goals
+
+**Product intent (this feature is normative for the AXP resurrection ship):**
+
+- This feature is an **AXP.OS resurrection** on LineageOS 23.2 / Android 16
+  `sunfish`: same capability set as AXP on LOS22 / GOLDEN, moved to LOS23.
+- Base ROM = LineageOS 23.2 / Android 16 `sunfish` vanilla from `003` (or the
+  best known-good vanilla-equivalent flashable baseline already proven on LAB).
+- Feature source of truth for *what* to ship = what AXP.OS Pro / GOLDEN
+  provides on LOS22 (inventory in `002`, product catalog in
+  `docs/axp-pro-parity.md`), **without omitting AXP capabilities as “decide
+  later” rows**, including Magisk-class root and AXP-class hardening /
+  signing / AVB posture that GOLDEN represents.
+- Versions = **newest stable** (or newest tagged pre-release the upstream
+  project currently ships) for each system/bundled component, constrained to
+  what still works on sunfish / non-GKI 4.14 / LOS 23.2 — not stale laptop
+  caches or shallow-clone version lies.
+- **Phonesky exception:** ship the project's **already patched / fixed
+  Phonesky** from the recent host pipeline (not “whatever newest Play APK
+  is today”). If that build is missing fixes that GOLDEN's Phonesky path
+  still needs for daily-driver parity, stop and reconsider the Phonesky
+  plan before accepting the feature.
+- **WebView exception:** do **not** ship Aosmium (EOL). Default WebView =
+  LineageOS 23's WebView. The ROM MUST keep Android's multi-provider path so
+  the owner can install another WebView later and select it (Developer
+  options → WebView implementation) — not locked to a single provider.
+- Flash / experiment **LAB only**; GOLDEN remains the read-only oracle
+  (`docs/device-roles.md`).
+
+**Relationship to earlier features:**
+
+- `001`–`003` remain shared foundation (host, GOLDEN capture, vanilla build).
+- **Two parallel product tracks** (neither deletes the other):
+  - **Standby / prior track:** `004`–`008` + `007` KernelSU (+ deferred
+    `006`/`010`–`013` as previously planned). Kept intact for later resume;
+    live on its own git branch once pushed (see plan notes).
+  - **Active Magisk-resurrection track (this feature):** AXP→LOS23 ship with
+    Magisk like GOLDEN. Does **not** rewrite or remove `004`–`008`/`007`
+    specs; it is a new Speckit directory that may **reuse** proven LAB
+    runbooks/results from those features when helpful.
+- KernelSU / SusFS from `007` stays **out of this track’s ship** for now.
+  Recycle of the two functional `007` kernels is optional (FR-016) — never an
+  acceptance gate for Magisk.
+- Project-only `FLAG_SECURE` global override may still ship if already
+  specified under `008` (not AXP catalog); it is optional relative to AXP
+  resurrection acceptance. AXP call-recording unlock **is** required and must
+  be selectable.
+
+**Out of scope for this feature (explicit):**
+
+- Flashing or modifying GOLDEN.
+- Committing proprietary Google Phonesky APK bytes, private keys, or personal
+  identifiers to Git.
+- Replacing the LOS 23.2 sunfish kernel/device stack with an unrelated prebuilt
+  (Graphene A13, stock A13, etc.).
+- Shipping Aosmium / AOSmium as the default or only WebView (EOL).
+- Building a custom AXP-style backup/restore ROM feature (personal backup
+  remains an external user tool if needed).
+- Claiming Yuh hardware-attestation PASS if GOLDEN itself currently FAILs that
+  path — reproduce GOLDEN's *workflow* and document attestation parity honestly.
+- Deleting or rewriting the standby KernelSU / split-roadmap specs
+  (`004`–`008`/`007`) — they remain valid on the standby branch/track.
+- Shipping KernelSU-Next as this track’s root (out of ship here; Magisk is
+  the resurrection root). Optional later reuse of `007` kernels is allowed
+  under FR-016 but MUST NOT delay Magisk acceptance.
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - AXP resurrection daily-driver on LAB (Priority: P1)
+
+As the owner, after flashing one LAB build produced under this feature, the
+phone boots and presents the same class of daily-driver capabilities I rely on
+with AXP on GOLDEN (Google compatibility stack, Play, managed banking profile
+workflow, selectable call recording unlock, Magisk root/hide workflow like
+GOLDEN, AXP hardening/signing posture, and AXP bundled usability apps —
+except WebView as defined here), without a checklist of deferred AXP features.
+
+**Why this priority**: This is the whole reason for the resurrection.
+
+**Independent Test**: Flash one `009` build to LAB; walk the GOLDEN daily
+checklist (microG Self-Check, Play open/install, Island profile, call-record
+toggle off/on, spoofing toggle off/on, Magisk present in AXP-like install
+state, bundled apps present, hardening/signing checks that GOLDEN implies);
+compare against `002` inventory categories.
+
+**Acceptance Scenarios**:
+
+1. **Given** LAB on a vanilla `003` baseline (or documented equivalent),
+   **When** the `009` image is flashed, **Then** the device boots to home and
+   cellular/Wi‑Fi/basic hardware still work as in the vanilla smoke.
+2. **Given** that build, **When** I compare shipped capability categories to
+   GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, managed profile
+   tool, selectable call recording unlock, Magisk/DenyList-class path,
+   DNS/hosts privacy helpers if present on GOLDEN, F‑Droid/Aurora/launcher/
+   gallery-class bundled apps, hardening/signing/AVB class), **Then** no
+   category is left as “decide / later” without an explicit obsolescence note
+   tied to Android 16 / sunfish impossibility (WebView exception allowed per
+   FR-015).
+3. **Given** Git and host artifact policy, **When** inspected, **Then** no
+   proprietary Phonesky APK bytes or secrets were committed.
+
+---
+
+### User Story 2 - Google stack: newest microG + project Phonesky (Priority: P1)
+
+As the owner, newest-stable microG + GSF Proxy integrate with the project's
+recent patched Phonesky so I can open Play, sign in as needed, and
+install/update apps the same way I do on AXP; signature spoofing is
+selectable (off = stock-safe default behaviour; on = needed Play/microG
+path).
+
+**Why this priority**: Without Play/microG parity, the ROM is not a daily
+driver.
+
+**Independent Test**: microG Self-Check; Phonesky launches; install or update
+at least one ordinary app; toggle spoofing off/on and confirm expected
+behaviour; push notifications smoke for a known test app.
+
+**Acceptance Scenarios**:
+
+1. **Given** the `009` build on LAB, **When** microG Settings Self-Check runs
+   with spoofing enabled as required, **Then** checks required for basic
+   Google compatibility pass (or each remaining failure is documented as
+   attestation/hardware outside packaging).
+2. **Given** the project's current patched Phonesky host artifacts, **When**
+   the ROM is built and flashed, **Then** `com.android.vending` is present as
+   privileged Play and opens on LAB.
+3. **Given** selectable signature spoofing, **When** the owner turns it on,
+   **Then** Play install/update works with microG without FakeStore; **When**
+   turned off, **Then** the device does not expose unrestricted spoofing to
+   arbitrary apps.
+4. **Given** version policy, **When** microG / GSF versions are recorded,
+   **Then** each is the newest stable (or tagged pre-release upstream
+   currently ships) verified on this stack; Phonesky version matches the
+   project patched artifact (not a blind “newest Play from the internet”).
+5. **Given** Play behaviour on LAB, **When** compared to GOLDEN needs, **Then**
+   if the project Phonesky lacks a GOLDEN-class fix required for daily use,
+   acceptance stops and the Phonesky plan is reconsidered.
+
+---
+
+### User Story 3 - Banking profile workflow parity (Priority: P1)
+
+As the owner, I can recreate the GOLDEN banking layout on LAB: install via the
+same store path I use on AXP, place banks in Island, and keep banking apps
+free of root via Magisk DenyList-class hiding like GOLDEN.
+
+**Why this priority**: Compatibility hard gates; daily-driver without banks
+fails the resurrection.
+
+**Independent Test**: Install Swissquote (hard gate) and attempt Yuh; run
+inside Island; Magisk DenyList (or AXP-equivalent) applied; record PASS/FAIL
+honestly vs GOLDEN.
+
+**Acceptance Scenarios**:
+
+1. **Given** Island on LAB, **When** I follow the documented GOLDEN banking
+   install order, **Then** Swissquote reaches a usable logged-in state in the
+   managed profile.
+2. **Given** Yuh on the same workflow, **When** tested, **Then** either it
+   PASSes or the failure matches the known GOLDEN attestation-class failure
+   and is documented — not a silent packaging regression.
+3. **Given** Magisk is present on the build, **When** banking apps run with
+   DenyList-class configuration, **Then** they do not receive root.
+
+---
+
+### User Story 4 - Magisk like GOLDEN + selectable call recording (Priority: P1)
+
+As the owner, Magisk is present the way AXP/GOLDEN presents it (newest Magisk;
+preinstalled but not fully activated until I finish setup — exact UX measured
+from GOLDEN), with DenyList-class hiding; call recording unlock is selectable
+like other Developer Options toggles.
+
+**Why this priority**: Root and call recording are core AXP daily behaviours.
+
+**Independent Test**: Confirm Magisk package/binary layout vs GOLDEN notes;
+complete activation on LAB if required; DenyList a test app; toggle call
+recording unlock off (restricted) and on (record allowed).
+
+**Acceptance Scenarios**:
+
+1. **Given** a fresh `009` flash, **When** inspected, **Then** Magisk is
+   present in an AXP-like preinstalled / not-fully-activated state consistent
+   with GOLDEN measurement, using the newest Magisk stable that works on this
+   stack.
+2. **Given** Magisk setup completed on LAB, **When** DenyList-class hiding is
+   configured for a banking package, **Then** that package does not receive
+   root.
+3. **Given** selectable call recording unlock, **When** OFF, **Then** stock
+   LOS country/carrier style restrictions apply; **When** ON, **Then** Dialer
+   can record on LAB without that block.
+
+---
+
+### User Story 5 - AXP usability, privacy, hardening (Priority: P2)
+
+As the owner, the ROM ships the rest of the AXP usability/privacy surface and
+GOLDEN-class hardening/signing/AVB posture at newest workable stables, with
+LOS23 WebView default and an unlocked provider chooser.
+
+**Why this priority**: Completes resurrection beyond Google/banking/root core.
+
+**Independent Test**: Package list vs `002`; open bundled apps; confirm
+default WebView is LOS and another WebView can be selected if installed;
+hardening/signing checks agreed for GOLDEN-class parity.
+
+**Acceptance Scenarios**:
+
+1. **Given** the `009` build, **When** I list bundled system/user apps in the
+   AXP usability set, **Then** each GOLDEN/AXP category is present or
+   explicitly marked impossible on Android 16/sunfish with rationale
+   (Aosmium absence is the allowed WebView exception).
+2. **Given** Developer options, **When** I open WebView implementation,
+   **Then** LOS23 WebView is available/default and the chooser is not locked
+   against future alternate providers.
+3. **Given** version policy, **When** bundled apps (except Phonesky per
+   FR-004) are recorded, **Then** each is newest stable that still runs on
+   the ROM.
+4. **Given** GOLDEN/AXP hardening and signing expectations, **When** the
+   accepted build is evaluated, **Then** equivalent class of protections /
+   signing posture is present or each gap is documented as impossible on
+   this stack — not silently dropped.
+
+---
+
+### User Story 6 - Parallel tracks stay honest (Priority: P2)
+
+As the owner, docs make clear that **this** Speckit is the Magisk AXP
+resurrection track on LOS23, while the prior KernelSU / split roadmap remains
+on standby (other branch / same `004`–`008`/`007` specs untouched).
+
+**Why this priority**: Lets either track resume without rewriting history.
+
+**Independent Test**: `specs/004`–`008`/`007` still exist unchanged in intent;
+`009` describes Magisk resurrection; git branches separate standby vs active
+work when published.
+
+**Acceptance Scenarios**:
+
+1. **Given** the repo, **When** inspected, **Then** `001`–`008`/`007` spec
+   directories remain present (not deleted by `009`).
+2. **Given** `009`, **When** read as ship intent for Magisk resurrection,
+   **Then** it does not claim to permanently retire the standby track — only
+   that KernelSU is out of *this* track’s ship for now.
+
+---
+
+### Edge Cases
+
+- Newer “stable” of a bundled app breaks Android 16 / sunfish: pin last known
+  good, document the regression, and retry when a fixed release exists.
+- Project Phonesky missing a GOLDEN-class fix: halt acceptance; reconsider
+  Phonesky patch/version plan before claiming Play parity.
+- Magisk “preinstalled but not fully installed” UX differs across Magisk
+  versions: match GOLDEN's *class* of first-boot/setup behaviour; document
+  exact measured steps from GOLDEN before freezing LAB instructions.
+- GOLDEN Yuh FAIL vs LAB FAIL: distinguish attestation/hardware class from
+  packaging/spoofing regressions.
+- Vanilla LOS already provides an AXP capability (e.g. WireGuard, encryption):
+  keep LOS behaviour; do not duplicate.
+- Dirty upgrade from older LAB experimental (incl. KernelSU) images: prefer
+  clean flash for acceptance.
+- Phonesky host artifacts missing or wrong signature: fail closed — never
+  silently fall back to FakeStore.
+- Alternate WebView installed by user later: selection must remain possible;
+  default remains LOS23 WebView until the user changes it.
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+- **FR-001**: The project MUST produce a flashable LineageOS 23.2 / Android 16
+  `sunfish` build that resurrects the AXP.OS on LOS22 / GOLDEN capability set
+  (including Magisk-class root and GOLDEN-class hardening / signing / AVB
+  posture), without leaving AXP capabilities as open “decide” omissions
+  except the WebView exception in FR-015.
+- **FR-002**: Version selection for system and bundled components (except
+  Phonesky per FR-004) MUST prefer the newest stable (or newest tagged
+  pre-release upstream currently ships) that still works on sunfish /
+  LOS 23.2; GOLDEN versions are a floor reference, not a freeze.
+- **FR-003**: The ROM MUST ship newest-stable microG Services Core and GSF
+  Proxy integrated with the project Phonesky (no FakeStore as primary Play).
+- **FR-004**: The ROM MUST ship the project's recent patched Phonesky as
+  privileged `com.android.vending`, with a documented host-side obtain /
+  patch / sign / deploy path that never commits APK bytes to Git. If that
+  artifact lacks GOLDEN-class fixes required for daily-driver Play behaviour,
+  the Phonesky plan MUST be reconsidered before acceptance.
+- **FR-005**: The ROM MUST provide **selectable** signature spoofing for the
+  microG + Phonesky path (owner-controlled toggle; default safe/off or
+  project-documented default). Spoofing MUST remain restricted/controlled —
+  not unrestricted platform spoofing for all apps.
+- **FR-006**: The ROM MUST support the GOLDEN managed-profile banking workflow
+  (Island as measured on GOLDEN) including Swissquote PASS as a hard gate.
+- **FR-007**: Banking applications MUST run without being granted root
+  (Magisk DenyList-class hiding).
+- **FR-008**: The ROM MUST include **selectable** AXP-equivalent call
+  recording unlock (toggle; OFF = stock LOS restrictions, ON = unlock).
+- **FR-009**: The ROM MUST include the AXP usability/privacy bundled surface
+  present on GOLDEN / AXP Pro (stores, launcher/gallery-class apps, DNS/hosts
+  or equivalent blockers when part of that surface) at newest workable
+  stables, subject to FR-015 for WebView.
+- **FR-010**: The ROM MUST ship **Magisk** like GOLDEN: newest Magisk stable
+  that works on this stack, in an AXP-like preinstalled but not fully
+  activated layout (exact first-boot/setup behaviour measured from GOLDEN),
+  with DenyList-class hiding sufficient for FR-007. KernelSU is **out of
+  ship for now** (not the resurrection root path).
+- **FR-011**: The feature acceptance gate MUST include GOLDEN/AXP-class
+  hardening and signing / AVB posture (as applicable on LOS 23.2 / sunfish),
+  not only apps and Google compatibility. Gaps MUST be documented as
+  impossible on this stack rather than silently omitted.
+- **FR-012**: Acceptance flashing MUST use LAB only; GOLDEN MUST remain
+  unmodified by this feature's work.
+- **FR-013**: Each shipped capability MUST be attributable (what upstream or
+  AXP behaviour it reproduces) and reversible (known-good prior LAB image
+  retained).
+- **FR-014**: This feature MUST live as a **new Speckit** (`009`) in parallel
+  with the standby KernelSU / split roadmap (`004`–`008`/`007`). Those older
+  specs MUST NOT be deleted or rewritten to match Magisk resurrection.
+  Reusable runbooks/results from them MAY be referenced. For *this* track’s
+  ship only, Magisk (not KernelSU) is the root path.
+- **FR-015**: Default WebView MUST be LineageOS 23's WebView. Aosmium MUST NOT
+  be required. The ROM MUST keep WebView provider selection available so a
+  future alternate WebView can be installed and chosen.
+- **FR-016**: Existing functional KernelSU / related kernels and artifacts
+  from `007` SHOULD be retained and MAY be recycled when useful (reference
+  boot images, differential debugging, or a later optional non-ship path).
+  Such reuse is **optional** (“si se puede, ok”), MUST NOT become an
+  acceptance requirement for Magisk resurrection, and MUST NOT imply KernelSU
+  is back in the ship path unless a future spec explicitly says so.
+
+### Key Entities
+
+- **Vanilla baseline**: The LOS 23.2 sunfish build from `003` (or documented
+  equivalent) before AXP feature integration.
+- **AXP capability set**: Inventory of features/packages/behaviours from
+  GOLDEN (`002`) plus AXP Pro catalog rows promoted by this spec
+  (resurrection target).
+- **Version pin record**: Documented package/component versions chosen for the
+  accepted `009` build (newest workable stable each; Phonesky = project
+  artifact id/version).
+- **Phonesky host artifact**: Project patched/signed Play APK and permission
+  metadata kept outside Git on the build host.
+- **Magisk preinstall state**: Measured GOLDEN/AXP layout for Magisk present
+  but not fully activated, plus LAB setup steps.
+- **LAB acceptance build**: Flashable image set + hashes + smoke/banking /
+  Magisk / hardening results for this feature.
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-001**: One LAB flash of a `009` build boots and completes the vanilla
+  hardware smoke within the same session as flash (owner can place a call,
+  use Wi‑Fi, and unlock the device).
+- **SC-002**: 100% of AXP resurrection capability categories from the agreed
+  inventory are either demonstrated on LAB or explicitly documented as
+  impossible on Android 16/sunfish — zero silent omissions (WebView exception
+  allowed only as FR-015).
+- **SC-003**: With spoofing enabled as required, microG Self-Check required
+  items and project Phonesky open/install succeed on LAB for ordinary apps on
+  the first accepted build candidate (or within one documented fix iteration).
+- **SC-004**: Swissquote managed-profile + Magisk DenyList-class workflow
+  PASSes on LAB; Yuh result is recorded and is not worse than GOLDEN for
+  packaging/spoofing reasons.
+- **SC-005**: Every bundled/system app version in the acceptance record
+  (except Phonesky) is newer than or equal to GOLDEN's measured version,
+  unless a newer release was tried and failed with a written regression note;
+  Phonesky matches the recorded project patched artifact.
+- **SC-006**: Owner can turn signature spoofing and call recording unlock off
+  and on and observe the documented behaviour each time.
+- **SC-007**: Magisk is present post-flash in the AXP-like preinstall state and
+  can be fully activated on LAB using documented steps measured from GOLDEN.
+- **SC-008**: Default WebView is LOS23's; provider selection remains available.
+- **SC-009**: Owner can perform the GOLDEN-equivalent daily checklist on LAB
+  without consulting a scatter of conflicting feature specs for what “ships”.
+
+## Assumptions
+
+- `003` vanilla LOS 23.2 sunfish is (or becomes) available as the integration
+  base; LAB stock rescue from `002` remains valid.
+- GOLDEN inventory (`002`) plus AXP Pro docs are sufficient to enumerate the
+  capability set; live `adb` re-query of GOLDEN is allowed (especially Magisk
+  preinstall/activation details).
+- “AXP resurrection” means Magisk + GOLDEN-class hardening/signing/AVB + full
+  AXP user surface on LOS23, with only the stated WebView and Phonesky-artifact
+  exceptions.
+- Island remains the managed-profile tool because that is what GOLDEN
+  actually runs (AXP docs saying “Insular” are historical naming).
+- FakeStore is never the primary Play path.
+- Selectable spoofing and selectable call recording follow the same class of
+  Developer Options UX already explored in `005`/`008` runbooks where useful.
+- Project `FLAG_SECURE` override is nice-to-have, not an AXP resurrection
+  hard gate.
+- Personal app/data backup is not a ROM feature gate.
+- Builds and long compiles run on `rom-dev01`; laptop holds docs/specs and
+  flash tools only.
+- Prior KernelSU LAB experiments (including the two functional kernels already
+  built) are **out of ship for now** but kept as recyclable assets: reuse if
+  helpful, never required for Magisk acceptance.