009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding and rebuild/sync helpers; document device roles, laptop migration, and Gitea. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-16 21:06:45 +02:00
1 parent 3f941e8451
commit 2d145c2878
@@ -0,0 +1,82 @@
+# 009 — Upstream LOS rebase → project OTA zip
+
+**Status (2026-10-10):** runbook for the next few days. Scripts for the **ship
+bacon** exist; a fully automated “sync nightly → OTA publish” pipeline does
+**not**. This track does **not** use AXP OTA servers (see FR-019 / sideload).
+
+Owner will supply a new LineageOS 23.2 sunfish build reference from
+https://download.lineageos.org/devices/sunfish/builds — treat that as the
+upstream pin to sync against, then rebacon our pack.
+
+## What is already prepared
+
+| Piece | Ready? | Path / note |
+|-------|--------|-------------|
+| Vanilla LOS tree workflow | yes (manual) | `docs/003-build-notes.md` — `repo init/sync`, `breakfast`, `mka bacon -j8` |
+| Canonical OTA entry | yes | `scripts/009-rebuild-from-los.sh` (sync optional; **wave 4 + malloc mandatory**) |
+| Pre-launch checklist | yes | `docs/009-ota-rebuild-checklist.md` |
+| Stage laptop → host | yes | `scripts/009-sync-ota-stage-to-host.sh` |
+| Ship bacon (called by the entry) | yes | `scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh` |
+| hardened_malloc + wave 4 | yes, required | `scripts/009-bacon-hardened-malloc.sh` |
+| Release keys on host | yes | `/srv/rom/secrets/android-certs` (never commit) |
+| Detached long builds | yes | `/srv/rom/artifacts/bin/rom-detach` (tmux) |
+| APK-only refresh (FR-019) | stub | `docs/009-sideload-system-updates.md` |
+| `repo sync` + patch re-apply | yes, one script | `LOS_SYNC=1 scripts/009-rebuild-from-los.sh` (tip of `lineage-23.2`; compare nightly manifest) |
+| Lineage Updater / signed incremental OTA channel | **no** | first deliverable = full recovery zip (same shape as bacon) |
+
+## Target for “first OTA”
+
+For this project, the first OTA means:
+
+1. Sync LOS `lineage-23.2` on `rom-dev01` (`LOS_SYNC=1`), or keep the tree and
+   only rebacon.
+2. `scripts/009-rebuild-from-los.sh` re-applies the pack **including wave 4
+   and hardened_malloc** (not optional on this path).
+3. Produce `AXP-Resurection-Pro-23.2-YYYYMMDD-sunfish.zip` (release-keys).
+4. Sideload on LAB. Lineage Updater is not required for the first zip.
+
+Do **not** flash GOLDEN. Prefer a second slot / keep last known-good zip.
+
+## Checklist (host `rom-dev01`)
+
+```bash
+# 1) Snapshot current tree
+ssh -F docs/ssh/config a16-build
+cd /srv/rom/src/lineage
+repo manifest -r -o /srv/rom/artifacts/009-axp-los23-port/manifest-pre-rebase-$(date -u +%Y%m%dT%H%M%SZ).xml
+
+# 2) Sync upstream (pin to the LOS build the owner names)
+repo sync -c -j8
+
+# 3) Confirm proprietary blobs / TheMuppets still match branch
+# 4) Re-apply project patches ONLY via the ship bacon wrappers (do not hand-edit
+#    out-of-tree). Prefer:
+# From a checkout of this repo on the host (path may differ):
+LOS_SYNC=1 LOS_MANIFEST=/path/to/nightly/build-manifest.xml \
+  /srv/rom/artifacts/bin/rom-detach bacon009ota -- \
+  bash /path/to/AXP_Resurection/scripts/009-rebuild-from-los.sh
+
+# 5) Postflight: zip SHA256, vendor SPL >= 2023-09-05, Magisk preroot present,
+#    Jelly/Fossify gates, release-keys fingerprint.
+
+# 6) LAB only: sideload full zip; smoke Magisk, Island, Swissquote, radio.
+```
+
+Conflict policy: if upstream breaks an apply, stop and document the minimal
+port — do not invent a second Magisk/microG design (AGENTS.md “clone AXP first”).
+
+## Gaps to fill when the new LOS build arrives
+
+- [ ] Record upstream zip name / date / SHA256 in `docs/009-version-pins.md`
+- [ ] Record our rebacon artifact dir + SHA256 + `repo manifest -r`
+- [ ] Decide whether `user` vs `userdebug` lunch stays `user` (closure = `user`)
+- [ ] Swissquote Island smoke + note Yuh still open
+- [ ] Optional: flesh FR-019 APK sideload commands (separate from full OTA zip)
+
+## Do-not
+
+- Mix KernelSU into the Magisk ship bacon
+- Run AXP `Deblob.sh` defaults
+- Leave `mka` on a laptop SSH session
+- Start a second ninja on the same `out/`
+- Lower `VENDOR_SECURITY_PATCH` below `2023-09-05`