009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding and rebuild/sync helpers; document device roles, laptop migration, and Gitea. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-16 21:06:45 +02:00
1 parent 3f941e8451
commit 2d145c2878
@@ -0,0 +1,149 @@
+# Laptop migration — AXPR (2026-10-16)
+
+Portable bundle for moving **AXP_Resurection** + **sunfish-a16-rom** to a new
+machine without Cursor chat history. Agents should read this file after
+`AGENTS.md` and `docs/009-handoff-20261008.md`.
+
+## USB layout (this export)
+
+```
+AXPR/
+  README-FIRST.md              → copy of this doc (short pointer)
+  MANIFEST.txt                 → rsync timestamp + paths
+  Workspaces/
+    AXP_Resurection/           → full git tree (incl. uncommitted WT)
+    sunfish-a16-rom/           → parallel KernelSU / standby meta repo
+  laptop-home/
+    ssh/id_ed25519_rom_dev01   → rom-dev01 / a16.ssystems.de (mode 600 on restore)
+    ssh/id_ed25519_rom_dev01.pub
+    android/                   → adbkey + debug.keystore (optional USB debug)
+```
+
+**Not on USB (stays on server):** Lineage `out/`, ccache, release keys
+(`/srv/rom/secrets/android-certs`), prebuilt APKs under `/srv/rom/prebuilts/`,
+AXP reference trees under `/srv/rom/references/`.
+
+## New laptop — minimum setup
+
+1. Restore workspaces under `~/Workspaces/` (or any path; update scripts if moved).
+2. Install private key:
+   ```bash
+   mkdir -p ~/.ssh && chmod 700 ~/.ssh
+   cp laptop-home/ssh/id_ed25519_rom_dev01 ~/.ssh/
+   chmod 600 ~/.ssh/id_ed25519_rom_dev01
+   ```
+3. Wire SSH (repo ships client config):
+   ```sshconfig
+   # in ~/.ssh/config
+   Include ~/Workspaces/AXP_Resurection/docs/ssh/config
+   ```
+4. Verify host:
+   ```bash
+   ssh -F ~/Workspaces/AXP_Resurection/docs/ssh/config a16-build 'whoami; hostname'
+   ```
+5. **Gitea + web UI** — see [Gitea and services](#gitea-and-services) below.
+6. Optional: `cp laptop-home/android/adbkey* ~/.android/` for same ADB RSA trust.
+
+Host runbook: `docs/001-host-runbook.md`. Device roles: `docs/device-roles.md`.
+
+## Gitea and services
+
+| Layer | What |
+|-------|------|
+| URL | https://a16.ssystems.de/ (Gitea), https://a16.ssystems.de/semaphore/ |
+| Edge auth | nginx **HTTP Basic** (user `sunfish`) — password on host only: `/srv/rom/secrets/web-htpasswd.txt` (read as root on `rom-dev01`; not in Git) |
+| Gitea login | `sunfish-admin` — app password/token on host: `/srv/rom/secrets/gitea-admin.txt` |
+| Git transport | HTTPS through nginx (`DISABLE_SSH=true` on Gitea) |
+
+**Clone / update (canonical branches):**
+
+```bash
+git clone https://a16.ssystems.de/sunfish-admin/AXP-Resurection.git
+cd AXP-Resurection && git checkout 009-axp-los23-port
+
+git clone https://a16.ssystems.de/sunfish-admin/sunfish-a16-rom.git
+cd sunfish-a16-rom && git checkout standby-ksu-split-roadmap
+```
+
+Configure `git credential` or a personal access token in Gitea (Settings →
+Applications) on the new laptop. Without credentials, `git fetch`/`push` fails
+after nginx Basic.
+
+**Branches (2026-10-16):**
+
+| Repo | Ship / active branch | Notes |
+|------|----------------------|--------|
+| `AXP-Resurection` | `009-axp-los23-port` | Magisk 009; `main` is older |
+| `sunfish-a16-rom` | `standby-ksu-split-roadmap` | KernelSU parallel; `main` |
+
+**Not in Git:** `artifacts/` bootanimation PNG tree (~GB; optional on USB bundle),
+`/srv/rom/prebuilts/`, release keys, SSH private key (USB `laptop-home/ssh/`).
+
+## Git state at export (AXP_Resurection)
+
+| Item | Value |
+|------|--------|
+| Branch | `009-axp-los23-port` |
+| vs `origin` | Should match Gitea after 2026-10-16 push from old laptop |
+| `artifacts/` | Gitignored (bootanimation frames); keep USB copy if needed |
+
+After push, a fresh `git clone` + `checkout 009-axp-los23-port` is enough for
+code/docs; large host-only paths stay on `rom-dev01`.
+
+Remotes:
+
+- `AXP_Resurection` → `https://a16.ssystems.de/sunfish-admin/AXP-Resurection.git`
+- `sunfish-a16-rom` → `https://a16.ssystems.de/sunfish-admin/sunfish-a16-rom.git`
+
+## Host build in flight (2026-10-16 evening)
+
+Full **polish bacon** (configstore + EuiccDisabler + thermal CDEV log fixes):
+
+| Field | Value |
+|-------|--------|
+| Stage on host | `/srv/rom/artifacts/009-axp-los23-port/worktree-20261016-polish` |
+| tmux session | `bacon009polish20261016` |
+| Status | `/srv/rom/artifacts/detach-bacon009polish20261016.status` |
+| Log | `/srv/rom/artifacts/detach-bacon009polish20261016-20261016T183009Z.log` |
+| Command | `AXP_PROJECT_SOURCE=<stage> LOS_SYNC=0 LOS_DATE=20261016 bash <stage>/scripts/009-rebuild-from-los.sh` |
+| Expected zip | `AXP-Resurection-Pro-23.2-20261016-sunfish.zip` (if postflight passes) |
+
+Monitor from any laptop with SSH:
+
+```bash
+ssh -F docs/ssh/config a16-build cat /srv/rom/artifacts/detach-bacon009polish20261016.status
+ssh -F docs/ssh/config a16-build tail -30 /srv/rom/artifacts/detach-bacon009polish20261016-20261016T183009Z.log
+```
+
+After a **fix** on the laptop tree:
+
+```bash
+./scripts/009-sync-ota-stage-to-host.sh
+./scripts/009-relaunch-polish-bacon.sh
+```
+
+(`009-relaunch-polish-bacon.sh` = sync + `rom-detach` same session name.)
+
+## Polish fixes (uncommitted WT) — summary
+
+Detail: `docs/009-lab-polish-20261016.md`.
+
+| Issue | Apply script / gate |
+|-------|---------------------|
+| configstore VINTF crash-loop | `apply_009_drop_lab_only_commands.py` restores `disable_configstore`; bacon postflight |
+| EuiccDisabler crash | `apply_009_euicc_disabler_guard.py` (after euicc drop) |
+| pixel-thermal false CDEV ERROR | `apply_009_thermal_cdev_log.py` |
+| media_quality / SLIM_0_RX | documented; **no ship fix** |
+
+Tests: `tests/test_009_next_bacon_guards.py` (polish guards).
+
+## Agent onboarding (no chat history)
+
+1. `AGENTS.md`
+2. `docs/009-handoff-20261008.md`
+3. `docs/009-laptop-migration-20261016.md` (this file)
+4. `docs/device-roles.md` + `docs/009-lab-polish-20261016.md`
+5. `docs/009-ota-rebuild-checklist.md` before any bacon
+
+**Security:** USB holds a **private SSH key**. Encrypt the stick or wipe after
+restore; never commit keys to Git.