sunfish-admin/AXP-Resurection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

009: Polish bacon fixes, OTA host scripts, and migration docs.

Browse Source 
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
sunfish-adminandCursor committed 2026-10-16 21:06:45 +02:00
1 parent 3f941e8451
commit 2d145c2878
3193 files changed
+21264 -371
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/axp-pro-parity.md
+30 -25
View File
@@ -1,6 +1,11 @@
# AXP.OS Pro feature parity matrix
Living tracker for how `sunfish-a16-rom` relates to **AXP.OS Pro** functionality.
Living tracker for how **AXP_Resurection** (`009` Magisk track) relates to
**AXP.OS Pro** functionality.
> **2026-10-10:** Ship root is **Magisk** on `009`. KernelSU / ReSukiSU / SusFS
> (`007`) is a **parallel** track (boot worked; kept for retry on current ROM —
> [`007-parallel-on-009.md`](007-parallel-on-009.md)). Never in Magisk ship bacon.
**Non-normative.** This file is a product/backlog tracker. A row becomes a
requirement only when promoted into a feature `spec.md`. For an active feature,
@@ -24,28 +29,28 @@ feature. Signing/AVB, userspace hardening, and kernel hardening remain `011`–
| Feature | AXP Pro | Our objective | Status | Source / implementation |
|---------|---------|---------------|--------|-------------------------|
| Base ROM | AXP (LOS-derived) | LineageOS 23.2 / Android 16 sunfish | todo | LOS official `lineage-23.2`; `003` |
| On-device release testing | Yes (pre-release device QA) | Yes — stage checklists + known-good builds | todo | `003` smoke; later release gate; `011` |
| ASB patch integration / backports | Yes | Prefer LOS merges; backport missing applicable patches; document non-applicable | todo | LOS first; gaps → `012`/`013` |
| SELinux enforcing | Yes | Expect **Enforcing**; measure on vanilla then keep | todo | Verify in `003`; then likely `los-provides` |
| Data encryption enforced | Yes | Expect encryption enabled; no silent weaken | todo | `003` PIN/encrypt smoke; then likely `los-provides` |
| Project signing | Yes | Own keys for release builds | todo | `011` |
| Strong signing / AVB key policy | Yes (AVB/APK/dm-verity hardening) | Project AVB + release signing policy | todo | `011` |
| Reproducible builds | Yes | Traceable builds; push toward reproducibility | todo | metadata from day one; harden in `011` |
| Privacy-focused system defaults | Yes | Decide defaults beyond LOS stock | decide | `010` |
| microG + GSF | Yes | Yes — working Self-Check / push | done | `004` packaging + `005` LAB US6 (`23.2-20260915`) |
| Patched Phonesky / Play | Yes | Yes — priv-app, updatable | done | Play 52.9.22-24 + exact-alarm; installs OK on LAB (`005`) |
| Signature spoofing | Advanced / configured | Restricted LOS + Phonesky JKS + DO toggle | done | `005` runbook; `allow_signature_fake` + `FAKE_PACKAGE` |
| Magisk / preroot | Magisk (**Magia** UI on GOLDEN, 29.0) | **Substitute:** KernelSU-Next (+ SusFS) / evaluate ReSukiSU | substitute | Captured in `002`; do **not** fix GOLDEN; project root = `007` on LAB |
| DenyList / umount for banks | Magia DenyList (pkg list in `docs/002-golden-inventory.md`) | KernelSU app profiles + verified umount | todo | `007` re-runs `006`; GOLDEN DenyList captured `002` |
| Insular work profile | AXP docs say Insular; **GOLDEN measures Island** (`com.oasisfeng.island.fdroid` 6.4.2) | Banking workflow parity (Island or equivalent) | todo | `006`; capture in `002` |
| Yuh in Insular/Island | Was FAIL ~weeks (HA); **PASS again 2026-10-02 on GOLDEN** with Vector **bootloader spoofer** (`002`) | Hard-gate Compatibility MVP (rootless in `006`); **Revolut not a hard-gate** | partial | `002`; Gate E on LAB = DenyList + PIF/teesim + Vector BL spoof (sunfish-coherent); never flash GOLDEN |
| Swissquote in Insular/Island | **PASS** on GOLDEN (owner report, DenyList) | Hard-gate Compatibility MVP (rootless in `006`) | partial | `002`; re-test in `006`/`007`/`011` |
| Unrestricted call recording | Yes | Yes — native ROM on Android 16 | todo | AXP/EXTENDROM/iodé as references only; re-validate on LOS 23.2; `008` |
| DNS blocker / privacy DNS | Yes | Wanted; exact UX TBD | decide | `010` |
| Hosts / tracker blocking | Yes | Wanted | decide | `010` |
| hardened_malloc | Yes | Wanted if cleanly portable | decide | Graphene/AXP; `012`; see hardening backlog |
| Hardened / CVE-patched kernel | Yes | LOS 23.2 kernel + Graphene/AXP/Divest backports | todo | `013` (+ selective work with `007`) |
| Base ROM | AXP (LOS-derived) | LineageOS 23.2 / Android 16 sunfish | partial | LOS `lineage-23.2`; vanilla `003` done; ship = `009` closure |
| On-device release testing | Yes (pre-release device QA) | LAB smoke + known-good zips | partial | `009` closure; first project OTA → `009-upstream-rebase-ota.md` |
| ASB patch integration / backports | Yes | Prefer LOS merges; backport missing applicable patches | partial | Stage1/CVE pack in `009`; rebase with upstream |
| SELinux enforcing | Yes | **Enforcing** on LAB ship | done | measured on Magisk closure |
| Data encryption enforced | Yes | Encryption enabled; no silent weaken | done | LAB ship |
| Project signing | Yes | Own keys for release builds | done | `release-keys` on closure zip; custody on host secrets |
| Strong signing / AVB key policy | Yes (AVB/APK/dm-verity hardening) | Project AVB unlocked (flags 0 ship) | partial | AVB0 landed; bootloader lock wont |
| Reproducible builds | Yes | Traceable builds; push toward reproducibility | todo | metadata; harden later |
| Privacy-focused system defaults | Yes | Decide defaults beyond LOS stock | decide | capability matrix / remaining |
| microG + GSF | Yes | Yes — working Self-Check / push | done | `004`/`005` → shipped in `009` |
| Patched Phonesky / Play | Yes | Yes — priv-app, updatable | done | project Phonesky + exact-alarm |
| Signature spoofing | Advanced / configured | Restricted LOS + Phonesky JKS + DO toggle | done | `005` |
| Magisk / preroot | Magisk (**Magia** UI on GOLDEN, 29.0) | **Ship Magisk** newest stable (LAB 30.7) EXTENDROM preroot | done | `009`; KSU/`007` parallel recycle (FR-016) |
| DenyList / umount for banks | Magia DenyList | Magisk DenyList + Island workflow | partial | Swissquote PASS LAB; Yuh open |
| Insular work profile | AXP docs say Insular; **GOLDEN measures Island** | Island on LAB/GOLDEN | done | vehicle for banks |
| Yuh in Insular/Island | **PASS on GOLDEN** (2026-10-02+) | Usable session on LAB Island | partial | open — install-source / Play A16 filter; see `009-yuh-golden-lab-hypothesis.md` |
| Swissquote in Insular/Island | **PASS** on GOLDEN | Same on LAB Magisk ship | done | wave 3 / closure 2026-10-09 |
| Unrestricted call recording | Yes | Native ROM DO unlock | done | `008` via `009` pack |
| DNS blocker / privacy DNS | Yes | AXP-class providers, no axp.os endpoints | partial | patches in ship bacon |
| Hosts / tracker blocking | Yes | Magisk hosts module / ROM helpers | partial | Systemless Hosts on LAB |
| hardened_malloc | Yes | 64-bit libc; camera/SF exclusions | done | `012` in closure bacon |
| Hardened / CVE-patched kernel | Yes | Stage1 + combo4 + FORTIFY + CVE pack | partial | Gate G kernel; more CVE optional |
| Deblobbing | Yes | Case-by-case; don't break HW | decide | `010` / `013` |
| AOSmium WebView | Yes | Ship usable WebView; allow installing alternate WebView providers and selecting the active one in **Developer options → WebView implementation** | decide | `010`; stock/AOSmium/Vanadium/etc. as candidates |
| WireGuard in kernel | Yes | Check if LOS 23.2 already sufficient | decide | Baseline in `003`; else `010`/`013` |
@@ -65,7 +70,7 @@ feature. Signing/AVB, userspace hardening, and kernel hardening remain `011`–
| AXP mechanism | Our default approach |
|---------------|----------------------|
| Magisk | KernelSU-Next (`007`); Magisk only as A/B diagnostic if needed |
| Magisk | **Ship on `009`** (EXTENDROM preroot). KernelSU/`007` parallel (separate boot) |
| AXP signature spoofing stack | LOS restricted spoofing + controlled Phonesky extension (`005`) |
| AXP hardened kernel tree | LOS sunfish kernel + selective backports |
| AXP Phonesky | Keep functionality; reproducible patch/sign pipeline |
@@ -80,7 +85,7 @@ Not AXP Pro catalog features. Tracked here so they are not confused with parity.
| Feature | Origin | Objective | Status | Feature # |
|---------|--------|-----------|--------|-----------|
| FLAG_SECURE override | Project requirement | Native control: Android default remains default; **global** DO override only (no per-app); screenshots + screen capture; no LSPosed/Zygisk/root module | todo | `009` / `008-call-rec-flag-secure` |
| FLAG_SECURE override | Project requirement | Native control: Android default remains default; **global** DO override only (no per-app); screenshots + screen capture; no LSPosed/Zygisk/root module | done | `008` via `009` pack |
| Optional root-unavailable boot mode | Project / msg-GrapheneOS inspiration | Diagnostic/fallback boot without root | later | after daily-driver MVP |
| Upstream deprecation / Kotlin warning hygiene | Build log noise on LOS 23.2 | **Last steps before final ROM freeze:** triage remaining compile warnings; migrate call sites API-by-API (or inherit LOS fixes); keep our patches warning-clean. Not a gate for `005`–`010` MVPs. | later | after `010` / with `011` freeze; see `docs/hardening-backlog.md` |