009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path, and adds deblob appliers plus tests; docs capture Swissquote fix and parity. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-09 17:31:01 +02:00
1 parent deaaf42caa
commit 3f941e8451
@@ -0,0 +1,99 @@
+# Closure parity — AXP (GOLDEN) vs AXPR (LAB) — 2026-10-09
+
+Status after **wave 3** boot on LAB slot `_a`. Swissquote 9.11.0 in Island
+**PASS** (owner confirmed). Root cause for the prior `-69` / `onPrivilegedAccess`
+was **Lineage tools on system** (`bash`, `htop`, `nano`, `unrar`,
+`system/addon.d/50-lineage.sh`), removed in wave 3 — not Magisk PIF/cmdline.
+
+GOLDEN was not on USB for this pass; oracle uses
+`/srv/rom/references/axp/golden/2026-09-13/` plus prior live diffs.
+
+## Ship candidate (closure baseline)
+
+| Item | Value |
+|------|--------|
+| Dir | `20261009T145241Z-axp-stage1-combo4-cve-hi-releasekeys` |
+| Zip | `AXP-Resurection-Pro-23.2-20261009-sunfish.zip` |
+| SHA256 | `7cd20e4d218bc04f0b4a31838a5bb9040db36148a2b38d90342b3bc9f224a5fd` |
+| `boot.img` | Same dir (Magisk preroot, AVB flags 0) |
+| deblob | wave1 euicc + wave2 carrier/rcs + wave3 lineage tools |
+| Do not re-sideload | Owner booted this zip once |
+
+## Identity / Gate G (LAB measured)
+
+| Check | LAB | GOLDEN ref | Notes |
+|-------|-----|------------|-------|
+| `ro.build.type` | `user` | `user` | OK |
+| `ro.build.tags` | `release-keys` | `release-keys` | OK |
+| `ro.debuggable` | `0` | `0` | OK |
+| SPL system | `2026-09-01` | `2026-03-03` | LOS23 newer |
+| SPL vendor | `2023-09-05` | `2023-08-05` | deliberate AXPR guard |
+| SELinux | Enforcing | Enforcing | OK |
+| Boot state | orange / unlocked | same | OK |
+| Phonesky | `/system/priv-app/Phonesky` | AXP path variant | function OK |
+| microG | `/system_ext/app/GmsCore` | often `/data` update on GOLDEN | version may differ |
+
+## System surface (commands)
+
+**Removed in wave 3 (was LAB-only, absent on GOLDEN):** `bash`, `htop`,
+`nano`, `unrar`, `addon.d/50-lineage.sh`.
+
+**Still LAB-only vs GOLDEN (deferred wave 4):** Qualcomm `diag_*`, `test_diag`,
+`imsrcsd`, `disable_configstore`, AOSP debug bins (`bpftool`, `alloctop`,
+`pbtombstone`, `apexd-lsof.sh`). Not required for Swissquote PASS.
+
+**Kept like GOLDEN:** `curl` (`/system/bin`), `vim` (`/system_ext`).
+
+## Recovery / boot
+
+Sunfish: **recovery-as-boot** only (`boot_a` / `boot_b`). No `fastboot flash
+recovery`. Scratch install: flash `boot.img` to both slots → recovery → factory
+reset → sideload full zip → reboot system.
+
+## Repo vs next bacon
+
+- `apply_009_drop_lab_only_commands.py` exists but is **commented out** in the
+  ship script (wave 4 deferred).
+- Optional later: `scripts/009-bacon-hardened-malloc.sh` (012) — separate bacon;
+  not in the booted wave 3 image.
+- Host keys: `/srv/rom/secrets/android-certs` (2026-10-09); `~/.android-certs`
+  symlinks there. Backup `~/backups/android-certs-secrets-20261009T1517Z.tar.gz`.
+
+## Physical-SIM call gate
+
+Before any wave beyond carrier/rcs deblob: owner places a **mobile-network**
+voice call on LAB (SIM in slot, not Wi‑Fi calling only). Note result and time
+in `docs/009-handoff-20261008.md`.
+
+## GOLDEN parity capture
+
+When GOLDEN `11071JEC203839` is on USB (read-only oracle):
+
+```bash
+adb -s 11071JEC203839 shell pm list packages -f | sort > /tmp/golden-packages.txt
+adb -s 11231JEC207477 shell pm list packages -f | sort > /tmp/lab-packages.txt
+diff -u /tmp/golden-packages.txt /tmp/lab-packages.txt
+adb -s 11071JEC203839 shell cat /proc/cmdline > /tmp/golden-cmdline.txt
+adb -s 11231JEC207477 shell cat /proc/cmdline > /tmp/lab-cmdline.txt
+```
+
+Offline fallback: `/srv/rom/references/axp/golden/2026-09-13/` (not a live
+cmdline). Refresh this doc when a live GOLDEN dump exists.
+
+## Follow-on bacons (not the booted closure zip)
+
+| Script | Purpose |
+|--------|---------|
+| `scripts/009-bacon-wave4-deblob.sh` | wave 4 lab-only command drops |
+| `scripts/009-bacon-hardened-malloc.sh` | 012 hardened_malloc (2 GiB regions) |
+
+Launch on `rom-dev01` via `rom-detach`; never two ninjas on one `out/`.
+
+## Scratch reinstall
+
+Owner-driven virgin `/data` with the **same** closure zip: flash `boot.img` to
+both slots → recovery factory reset → sideload → reboot system from menu.
+
+## Open (non-blocking)
+
+- LOS 23 nightly rebase; regen plan/tasks.