009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
2026-10-05 10:42:00 +02:00
1 parent fd793b9471
commit deaaf42caa
@@ -0,0 +1,66 @@
+# 009 — Remaining path to AXP / Graphene-class ship (post clean-429)
+
+Non-normative roadmap after LAB **BOOT_OK** on Stage1+combo4+FORTIFY+Magisk+
+**CVE clean-offset 429** (denylist `CVE-2022-49980`), kernel `#47`
+(`20261001T180955Z-axp-stage1-combo4-cve-clean`). Authoritative requirements
+remain `specs/009-axp-los23-port/spec.md` + constitution.
+
+Goal (owner): **almost all** applicable AXP.OS / Graphene-class behaviour on
+LOS 23.2 sunfish Magisk track — not a blind dump, not bootloader lock.
+
+## Already landed (kernel / Magisk core)
+
+| Layer | Status |
+|-------|--------|
+| Stage1 Graphene/AH | Ship |
+| Combo4 + Clang FORTIFY | Ship |
+| Magisk preroot EXTENDROM-class | Ship |
+| CVE clean-offset 429 | Ship (LAB OK) |
+| `CVE-2022-49980` | Denylist until lock-scope port |
+| High-offset CVE (~73) | Quarantine — triage started |
+
+Recover/bisect baseline: `20260929T123401Z-axp-stage1-combo4` (`#32`).
+
+## Kernel remaining (toward “AXP CVE / Graphene depth”)
+
+1. **High-offset quarantine** — KEEP batches 1–3 **shipped** (`151944Z`).
+   nf_tables leftovers still skipped. Next kernel depth: **US-S5-1** defconfig
+   (Yama + `SLAB_FREELIST_RANDOM`), not more bulk CVE.
+2. **`CVE-2022-49980` proper port** — keep UAF fix without recursive
+   `udc_lock` (mainline lock-scope series). Optional; denylist is safe.
+3. Failed Stage1 probes (allocsize/ro/slab) — low priority vs high-offset.
+4. Graphene modern techniques / `hardened_malloc` — backlog (`docs/hardening-backlog.md`);
+   evaluate after CVE depth is stable.
+
+## Userspace / product remaining (AXP surface)
+
+From `docs/009-capability-matrix.md` / Gate G (still open or partial):
+
+| Item | Notes |
+|------|--------|
+| Release keys + AVB (unlocked) | US-S2/S3 — leave test-keys |
+| Private DNS / connectivity check | Patches exist; keep AXP-class, no axp.os endpoints |
+| Call-rec / FLAG_SECURE | `008` — selectable unlock |
+| Bundled apps (Aurora, Droidify, gallery, …) | Packaging |
+| Disable-app UX on A16 | Restore classic Disable |
+| Hosts / DNS privacy helpers | Magisk module vs ROM-native TBD |
+| WebView | LOS default (Aosmium exception) |
+| Banking / Island | Deferred |
+| Bootloader lock | Wont |
+| KernelSU swap | Optional later; do not mix Magisk ship boots |
+
+## Suggested execution order (default if owner has no preference)
+
+1. Finish high-offset **relevance filter** → small apply batches (≤10) with
+   strict applicator + LAB boot each batch.
+2. Wire **release keys** bacon of current ship pack; keep Magisk/preroot OK.
+3. Land remaining **Settings/UX** AXP clones (DNS, connectivity, disable-app)
+   if not already on LAB zip.
+4. Optional: 49980 lock-scope port; Graphene userspace / hardened_malloc spikes.
+
+## Do-not
+
+- Reflash full-503 / old kh-cve zips.
+- Bulk-apply high-offset without manual review.
+- Mix KernelSU into Magisk ship boots.
+- Treat “almost AXP/Graphene” as requiring locked bootloader.