009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
2026-10-05 10:42:00 +02:00
1 parent fd793b9471
commit deaaf42caa
@@ -0,0 +1,58 @@
+# 009 AXP capability matrix (resurrection track)
+
+Maps GOLDEN/`002` + `docs/axp-pro-parity.md` → ship status for **Magisk AXP
+clone on LOS23**. Authoritative requirements remain `specs/009-axp-los23-port/spec.md`.
+
+Status: `required` | `exception` | `deferred` | `impossible`
+
+| category | golden_ref | status | notes |
+|----------|------------|--------|-------|
+| Base LOS 23.2 sunfish | `003` | required | Vanilla baseline before AXP integrate |
+| microG + GSF | `002` / `004` | required | Newest stable |
+| Phonesky (project patched) | `002` / `004` | required | Host artifact; FakeStore forbidden |
+| Selectable signature spoofing | `005` / GOLDEN `allow_signature_fake` | required | Restricted; DO toggle |
+| Selectable call-recording unlock | `008` / GOLDEN `extendrom_call_recording` | required | EXTENDROM key |
+| Magisk preroot + DenyList-class | GOLDEN Magisk 29.0 / Magia | required | Newest Magisk; EXTENDROM-class boot patch |
+| Bundled usability apps (Aurora, Droidify, gallery, …) | `002` / parity | required | Newest workable; **Droidify** (light + many default repos); **no NeoLauncher** |
+| Private DNS presets (AXP-class provider list) | AXP Settings | required | Clone AXP private-DNS entries; no AXP OTA/repos |
+| Internet connectivity / INTERNET special permission UX | AXP/Graphene-class | required | Keep behaviour; **do not** integrate `axp.os` endpoints/branding |
+| Disable app (classic) vs Archive | AOSP/LOS A16 Archive | required | Restore usable **Disable** on A16; Archive alone disliked by owner |
+| DNS/hosts privacy helpers | parity / GOLDEN modules `hosts` | required | If in AXP surface; Magisk module vs ROM-native TBD |
+| Userspace hardening / AVB (unlocked) | parity `011`–`012` pulled into `009` | required | Staged; gaps documented; no bootloader lock |
+| Release / definitive signing keys | GOLDEN / plan `/srv/rom/secrets` | required | Ship off test-keys; Phonesky same identity |
+| Bootloader lock / relock | IOdes-class | wont | AXP/LOS unlocked norm; Magisk preroot assumes unlocked |
+| Kernel update + hardening | parity / FR-017 | required | LOS23 sunfish kernel + attributable patches |
+| WebView | GOLDEN Aosmium | exception | LOS23 WebView default; chooser unlocked; no Aosmium |
+| Banking / Island / Swissquote / Yuh | `002` Gate E | deferred | Owner future (2026-09-17); not MVP |
+| Localization / location hardening AXP vs LOS | owner complaint | deferred | FR-018 — **do not extra-cap** vs LOS for ship (2026-09-18); no MVP toggle; compare doc later only |
+| NeoLauncher | AXP default | wont | Owner: do not integrate; LOS Launcher3 |
+| F-Droid client (`org.fdroid.fdroid`) | GOLDEN | substitute | Prefer **Droidify** |
+| AXP external market repos / AXP OTA servers | AXP EOL infra | wont | Servers down / EOL — do not wire |
+| Sideloadable system package refresh (microG, Magisk, Phonesky, …) | owner cadence ~2–3 mo | required | FR-019 — same-signer / PRESIGNED / Magisk update path; no OTA |
+| KernelSU / SusFS | `007` | deferred | Out of ship; optional recycle FR-016 |
+| AXP backup ROM feature | parity | impossible / wont | External NeoBackup only |
+| FLAG_SECURE global override | project `008` | deferred | Nice-to-have; not AXP hard gate |
+
+## Bundled packages observed on GOLDEN (2026-09-17 `pm list packages -s`)
+
+| package | role | matrix |
+|---------|------|--------|
+| `com.aurora.store` | Aurora | required (pin newest) |
+| `com.looker.droidify` | Droidify (F-Droid client) | required — preferred over `org.fdroid.fdroid` |
+| `org.fdroid.fdroid` | F-Droid | substitute / skip unless packaging forces it |
+| `org.fossify.gallery` | Fossify Gallery | required |
+| `com.stevesoltys.seedvault` | Seedvault | often los-provides |
+| `com.android.launcher3` | Launcher | los-provides — **no NeoLauncher** |
+| `org.axpos.aosmium` / `_wv` | Aosmium | exception — do not ship; LOS WebView |
+| `com.google.android.gsf` | GSF | required |
+| `com.android.vending` | Phonesky | required (project artifact) |
+
+User-installed (not system): Island, banks, Magisk manager (hidden pkg), etc.
+
+## Build oracle note
+
+Prefer AXP **build tree + docs** on `rom-dev01` (see axpos.org developer
+building / EXTENDROM preroot) to learn Magisk/product packaging. GOLDEN `adb`
+is for runtime behaviour, not the first compile reference. Host currently has
+rendered docs under `/srv/rom/references/axp/archive/…`; full AXP `build`
+checkout still to stage.