009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

specs/009-axp-los23-port/contracts/acceptance-gates.md

@@ -27,27 +27,39 @@
 - [ ] Activation documented and completed on LAB
 - [ ] DenyList-class hides root from a test/banking package
 
-## Gate E — Banking
+## Gate E — Banking *(deferred — not MVP)*
 
-- [ ] Island present; Swissquote PASS in managed profile workflow
-- [ ] Yuh recorded; not worse than GOLDEN for packaging/spoofing reasons
-- [ ] Banks do not receive root
+- [ ] *(Later)* Island present; Swissquote PASS in managed profile workflow
+- [ ] *(Later)* Yuh recorded; not worse than GOLDEN for packaging/spoofing
+- [ ] *(Later)* Banks do not receive root
 
 ## Gate F — Usability / WebView
 
-- [ ] Bundled AXP categories present or documented impossible
+- [ ] Bundled AXP categories present or documented impossible/deferred
 - [ ] Versions newest workable (except Phonesky rule)
 - [ ] WebView default LOS; chooser unlocked
 
-## Gate G — Hardening / signing class
+## Gate G — Hardening / signing + kernel
 
-- [ ] GOLDEN-class hardening/signing/AVB posture present **or** each gap
-      documented as impossible on this stack (no silent omit)
-- [ ] Staged known-good images retained for bisect
+- [ ] Project **release / definitive signing keys** on ship images/OTAs (not
+      AOSP test-keys); Phonesky / update identity on that key
+- [ ] GOLDEN-class **userspace** hardening + AVB *build* posture as applicable
+      on unlocked sunfish **or** each in-scope gap documented (no silent omit)
+- [x] Updated LOS23-compatible sunfish kernel + hardening attribution list
+      (FR-017 / SC-010) — see `docs/009-gate-g-kernel-attribution.md`
+      (Stage1 + combo4 + Clang FORTIFY; LAB 2026-09-29)
+- [x] Staged known-good images retained for bisect
+      (`20260929T123401Z-axp-stage1-combo4`, prior combo4-fortify, GOODMAKE)
+- [x] Localization/location AXP-vs-LOS compare **not** required yet (FR-018)
+- [x] Bootloader relock **not** a Gate G requirement (AXP/LOS unlocked norm;
+      IOdes-class lock is non-goal) — see research 2026-09-29
 
 ## Non-gates
 
 - KernelSU presence or SusFS
 - FLAG_SECURE override (optional)
 - Custom AXP backup ROM feature
+- Banking / Swissquote / Yuh (deferred owner future)
+- Localization hardening policy freeze (FR-018 later)
 - Yuh PASS if GOLDEN attestation path still FAILs equivalently
+- Bootloader lock / relock (IOdes-class); unlocked sunfish is the ship model

specs/009-axp-los23-port/plan.md

@@ -6,11 +6,13 @@
 
 ## Summary
 
-Resurrect **AXP.OS Pro on LOS22 / GOLDEN** as a single shippable LineageOS
-23.2 / Android 16 `sunfish` ROM on **LAB**: vanilla `003` base + full AXP
-capability set (Google stack, selectable spoofing, Island banking workflow,
-selectable call-recording unlock, Magisk like GOLDEN, bundled usability apps,
-GOLDEN-class hardening/signing/AVB posture).
+Resurrect **AXP.OS Pro on LOS22 / GOLDEN** as an **updated AXP-class clone**
+on LineageOS 23.2 / Android 16 `sunfish` (**LAB**): vanilla `003` base + AXP
+capability set (Google stack, selectable spoofing, selectable call-recording
+unlock, Magisk like GOLDEN, bundled usability apps / options surface,
+GOLDEN-class userspace hardening/signing/AVB, **updated hardened sunfish
+kernel**). **Banking/Island/Swissquote validation deferred** (owner future).
+**Localization hardening AXP-vs-LOS compare deferred** (FR-018).
 
 **Explicit exceptions:** LOS23 WebView default (Aosmium EOL) with unlocked
 provider chooser; Phonesky = project's recent patched artifact (reconsider if
@@ -22,7 +24,9 @@ packaging where they already match; replace the KernelSU ship path with
 AXP-style Magisk preinstall (newest Magisk); pin newest stable microG and
 bundled apps; keep Phonesky on the existing host pipeline; measure Magisk
 “preinstalled but not fully activated” behaviour on GOLDEN before freezing LAB
-setup docs.
+setup docs; port attributable kernel hardening onto current LOS23 sunfish
+kernel; stage userspace hardening; leave location-policy compare for later.
+
 
 ## Technical Context
 
@@ -88,7 +92,7 @@ specs/009-axp-los23-port/
 │   ├── magisk-preinstall.md
 │   ├── webview-surface.md
 │   └── acceptance-gates.md
-└── tasks.md                # /speckit-tasks (not this command)
+└── tasks.md                # /speckit-tasks (generated)
 ```
 
 ### Host + tree

specs/009-axp-los23-port/quickstart.md

@@ -49,29 +49,31 @@ adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
 3. Configure DenyList-class hide for a banking package **before** first open.
 4. Save Magisk version + screenshots under `…/magisk/`.
 
-## 4. Banking (Gate E)
+## 4. Banking (Gate E) — deferred
 
-1. Aurora → install Swissquote → **do not open**.
-2. DenyList → Island clone → first launch in Island → login.
-3. Repeat attempt for Yuh; classify PASS / attestation-like-GOLDEN /
-   packaging regression.
-4. Confirm banks lack root.
+Skip for MVP. Owner future. Magisk DenyList can still be smoke-tested with a
+non-bank test package under Gate D.
 
 ## 5. Usability + WebView (Gate F)
 
 1. Confirm bundled categories vs pin record.
 2. `adb shell cmd webviewupdate current` → LOS default; chooser still listed.
 
-## 6. Hardening / signing class (Gate G)
+## 6. Hardening / signing + kernel (Gate G)
 
-1. Run the hardening/signing checklist defined for this build stage.
-2. Any missing GOLDEN-class item → written impossible/gap note (no silent
+1. Userspace: follow `docs/009-hardening-signing-checklist.md` (release keys;
+   unlocked AVB; no bootloader lock).
+2. Kernel: `docs/009-gate-g-kernel-attribution.md` (Stage1+combo4+FORTIFY).
+2. Record kernel rev + hardening patches applied/skipped (FR-017).
+3. Any missing GOLDEN-class item → written impossible/gap note (no silent
    skip).
+4. Do **not** block on localization AXP-vs-LOS compare (FR-018 later).
 
 ## Pass criteria
 
 All boxes in [acceptance-gates.md](./contracts/acceptance-gates.md) for the
-claimed stage. Full resurrection acceptance = Gates A–G.
+claimed stage **except Gate E** (deferred). Full clone acceptance for current
+owner priority = Gates A–D + F–G.
 
 ## Notes
 
@@ -79,3 +81,4 @@ claimed stage. Full resurrection acceptance = Gates A–G.
 - Call-recording legality is the user’s responsibility.
 - If project Phonesky misbehaves vs GOLDEN needs → stop and reconsider; do
   not accept Gate B.
+- Localization hardening compare is explicitly postponed.

specs/009-axp-los23-port/research.md

@@ -111,15 +111,140 @@ Document impossible-on-sunfish gaps rather than silent omit.
 **Alternatives considered**: Defer all of `011`–`013` — rejected by owner.
 One mega-commit everything — rejected (attribution / bisect).
 
-## Decision: Banking workflow = GOLDEN Magisk DenyList + Island
+## Decision: Release keys yes; bootloader lock no (2026-09-29)
 
-**Decision**: Restore constitution banking steps with **Magisk DenyList**
-(not KSU profiles) + Island: Aurora install → do not open → DenyList → clone
-to Island → first launch in Island. Swissquote PASS hard gate; Yuh honest vs
-GOLDEN attestation FAIL.
+**Decision**:
+
+1. **Sign with definitive / project release keys** — required for Gate G
+   userspace. Move off AOSP test-keys for ship images/OTAs; keep Phonesky and
+   update identity on that key. Keys live only on `rom-dev01`
+   (`/srv/rom/secrets/`), never in the laptop Git tree.
+2. **Do not pursue bootloader relock** as a ship goal. AXP and LineageOS do
+   not lock the bootloader as their normal product path; Magisk preroot and
+   recovery sideload assume unlocked. IOdes-style locked bootloader is an
+   explicit non-goal for this track.
+
+**Rationale**: Clone AXP/LOS norms; avoid a locked-device model that fights
+Magisk EXTENDROM preroot. Signing still matters for update trust and
+PRESIGNED / same-identity sideload.
+
+**Alternatives considered**: IOdes-class locked AVB ship — rejected by owner
+(2026-09-29). Skip release keys entirely — rejected (Gate G / FR signing).
+
+## Decision: Banking workflow deferred (owner future)
+
+**Decision (2026-09-17)**: Banking / Island / Swissquote / Yuh validation is
+**deferred**. Not an MVP acceptance gate. Magisk DenyList-class capability
+still ships (general). Owner may resume US3 later.
+
+**Rationale**: Owner wants updated AXP clone (features, options, hardening,
+security, kernel) first; banks are a personal future problem.
+
+**Alternatives considered**: Keep Swissquote as hard gate — rejected by owner.
+
+## Decision: Updated hardened LOS23 sunfish kernel (FR-017)
+
+**Decision (refined 2026-09-18):** Ship current LineageOS 23.2–compatible
+`sunfish` kernel (`msm-4.14`) with attributable hardening. **Not** an
+unrelated Graphene A13 / stock prebuilt as base. Record applied/skipped list
+in `docs/009-kernel-hardening-map.md`.
+
+**Source priority (owner):**
+
+1. **AXP** — maximum priority; clone their sunfish kernel hardening first
+   (build sources / OTA oracle / GOLDEN). Inherited Divest-era commits that
+   already live *inside* the AXP stack are fine as part of that clone; do
+   **not** separately mine DivestOS EOL trees.
+2. **LOS 23.2** — inventory what the lineage kernel already has; avoid
+   duplicate work.
+3. **IodéOS** — LOS fork, more hardened/deblobbed; clone sources on
+   `rom-dev01` and diff for 4.14-safe ideas worth porting.
+4. **GrapheneOS** — optional extras only when they make sense on non-GKI
+   4.14 sunfish: prefer portable techniques from modern Pixel kernels /
+   docs; historical sunfish A13 patches only if still clearly valuable.
+   Do **not** treat GOS A13 sunfish tree as the base.
+
+**Out of hunt:** DivestOS as a separate research target (EOL).
+
+**Rationale**: AXP-first resurrection; GOS/Iodé as additive; honest skips on
+4.14.
+
+**Inventory (2026-09-18):** LOS `msm-4.14` @ `28f9290ae067` (`4.14.357-openela`).
+AXP `kernel_patches` @ `df3cab2155b3` on host. Graphene/AH sequential probe:
+OK=30 / SKIP_ALREADY=4 / FAIL=12. Iodé `v5-staging` manifest has no sunfish
+4.14 kernel fork. Stage 1 allowlist + apply script under
+`vendor/sunfish-a16/patches/009-kernel-hardening/`. CVE mega deferred.
+Ledger: `docs/009-kernel-hardening-map.md`.
+
+## Decision: Location / localization hardening — do not extra-cap (FR-018)
+
+**Decision (2026-09-18):** For this Magisk track, **do not** port AXP-class
+aggressive location lockdown (kernel or userspace) beyond stock LOS 23.2
+defaults. No “non-hardening location” Settings toggle for MVP — that is
+extra product surface; simpler and matches owner GPS frustration to **leave
+LOS location behaviour**. FR-018 compare doc may still note what AXP did,
+for later curiosity, without shipping those caps.
+
+**Alternatives considered**: (1) Clone AXP location caps — rejected (slow /
+frustrating fixes). (2) Owner toggle to disable caps — deferred; only if
+LOS defaults prove insufficient and owner asks later.
+
+
+## Decision: Bundled store client = Droidify; no NeoLauncher
+
+**Decision (2026-09-17):** Ship **Droidify** as the F-Droid-class client
+instead of stock F-Droid (lighter; many repos by default). Do **not**
+integrate NeoLauncher — keep LOS Launcher3. Aurora remains for Play-sideload
+workflow.
+
+## Decision: No AXP external repos / OTA servers
+
+**Decision:** Do not wire AXP market/F-Droid remote repos or AXP OTA update
+endpoints. AXP infra is EOL / servers down — no product sense. Periodic
+system-package refresh is **owner sideload** (FR-019), not network OTA.
+
+## Decision: Sideloadable system package refreshes (FR-019)
+
+**Decision (2026-09-17):** Final ROM MUST keep **microG**, **Magisk**,
+**project Phonesky**, and other bundled system/privileged apps
+**updateable without full reflash**, on a ~**2–3 month** cadence the owner
+drives. Prefer PackageManager-compatible sideload (same signing identity;
+PRESIGNED microG; continuous project key for Phonesky). Magisk: document
+manager self-update and/or recovery/boot re-patch when APK sideload alone is
+not enough. Deliver a short recovery/sideload runbook before ship; do **not**
+reintroduce AXP OTA.
+
+## Decision: Private DNS + Internet connectivity (sans axp.os)
+
+**Decision:** Port AXP-class **Private DNS** provider presets. Keep AXP-class
+**Internet connectivity** / special INTERNET permission behaviour where it
+still fits LOS 23.2, but strip any hard dependency on `axp.os` branding or
+endpoints.
+
+## Decision: Restore Disable app on Android 16
+
+**Decision:** Investigate and re-expose classic **Disable application** UX on
+A16/LOS23 where Archive replaced or hid it. Owner prefers Disable over
+Archive. Exact Settings/PackageManager patch path TBD from AXP/LOS delta
+research — must remain attributable and reversible.
+
+## Decision: AXP build sources as compile oracle
+
+**Decision:** On `rom-dev01`, prefer cloning/checking out AXP **build** +
+EXTENDROM (and axpos.org developer building docs already mirrored under
+`/srv/rom/references/axp/archive/`) to see how Magisk preroot / product packages
+are wired — before treating GOLDEN `adb` as the compile guide. GOLDEN stays the
+runtime compatibility oracle.
+
+**Decision**: Do **not** freeze localization/location lockdown policy in this
+feature’s acceptance. Later compare how much AXP “capea” location vs stock
+LOS (owner historically complains AXP is aggressive). Until then, avoid
+inventing extra location lockdown beyond what the clone already implies;
+matrix row = deferred.
+
+**Alternatives considered**: Blind-copy all AXP location patches now —
+rejected (owner wants a deliberate compare first).
 
-**Alternatives considered**: Rootless-only banking gate — incomplete vs AXP.
-Insular rename — GOLDEN runs Island.
 
 ## Decision: Version freshness policy
 

specs/009-axp-los23-port/spec.md

@@ -4,7 +4,8 @@
 
 **Created**: 2026-09-16
 
-**Status**: Clarified — ready for `/speckit-plan`
+**Status**: Spec clarified 2026-09-17 (banking deferred; kernel hardening in;
+localization compare later) — tasks updated; ready for `/speckit-implement`
 
 **Input**: User description: "009-axp based LOS22 feature port to LOS23 —
 take vanilla LineageOS 23 for sunfish and integrate the full AXP.OS (LOS22 /
@@ -24,6 +25,29 @@ with that Phonesky; signature spoofing and call recording **selectable**
 existing functional kernels if useful; otherwise everything equal to
 AXP/GOLDEN.
 
+**Owner clarifications (2026-09-17):** Primary ship interest = an **updated
+AXP clone on LOS23** (features, options, userspace hardening/security, updated
+hardened sunfish kernel). Banking / Island / Swissquote / Yuh **deferred**
+(owner future). Localization AXP-vs-LOS compare **later** (FR-018). Prefer AXP
+**build sources + docs** on `rom-dev01` as the compile oracle (how Magisk /
+product packaging is wired); GOLDEN `adb` for *runtime* behaviour, not the
+first place to reverse “how to build”. **Do not** ship NeoLauncher — keep LOS
+Launcher3. Prefer **Droidify** over stock F-Droid client (lighter; many repos
+by default) unless packaging forces otherwise. **Do not** integrate AXP
+**external** market repos or AXP **OTA** servers (EOL / servers down — no
+sense). **Do** clone AXP-class **Private DNS** presets (many provider entries).
+**Do** keep AXP-class **Internet connectivity** / special INTERNET permission
+UX where practical, but **do not** hard-wire `axp.os` branding/endpoints.
+**Wanted:** restore classic **Disable app** behaviour on Android 16 (LOS/AOSP
+replaced much of this with **Archive**, which the owner dislikes) — research
+and re-expose Disable where still feasible on A16. **Later (final ROM):**
+system components (microG, Magisk, project Phonesky, other bundled system
+apps) MUST remain **sideload-updatable** on a shipping build — owner plans
+refreshes every **2–3 months** without a full ROM reflash. Packaging MUST
+preserve update paths (same signing identity / PRESIGNED where applicable;
+document Magisk update path separately from APK sideload if boot-preroot).
+
+
 ## Context / non-goals
 
 **Product intent (this feature is normative for the AXP resurrection ship):**
@@ -83,30 +107,39 @@ AXP/GOLDEN.
 - Building a custom AXP-style backup/restore ROM feature (personal backup
   remains an external user tool if needed).
 - Claiming Yuh hardware-attestation PASS if GOLDEN itself currently FAILs that
-  path — reproduce GOLDEN's *workflow* and document attestation parity honestly.
+  path — banking attestation is deferred with the banking workflow (owner
+  future); do not treat Swissquote/Yuh as ship gates here.
 - Deleting or rewriting the standby KernelSU / split-roadmap specs
   (`004`–`008`/`007`) — they remain valid on the standby branch/track.
 - Shipping KernelSU-Next as this track’s root (out of ship here; Magisk is
   the resurrection root). Optional later reuse of `007` kernels is allowed
   under FR-016 but MUST NOT delay Magisk acceptance.
+- Resolving localization/location-hardening policy vs LOS defaults in this
+  feature’s acceptance (deferred research FR-018 — compare AXP vs LOS later).
+- Integrating AXP **external** F-Droid/market repos or AXP **OTA** update
+  servers (EOL; servers down — no sense).
+- Shipping NeoLauncher.
+- Hard-wiring `axp.os` branding/endpoints into Internet-connectivity /
+  network UX (keep the permission/connectivity *behaviour* where practical).
 
 ## User Scenarios & Testing *(mandatory)*
 
 ### User Story 1 - AXP resurrection daily-driver on LAB (Priority: P1)
 
 As the owner, after flashing one LAB build produced under this feature, the
-phone boots and presents the same class of daily-driver capabilities I rely on
-with AXP on GOLDEN (Google compatibility stack, Play, managed banking profile
-workflow, selectable call recording unlock, Magisk root/hide workflow like
-GOLDEN, AXP hardening/signing posture, and AXP bundled usability apps —
-except WebView as defined here), without a checklist of deferred AXP features.
+phone boots and presents an **updated AXP-class clone on LOS23**: Google
+compatibility stack, Play, selectable call recording unlock, Magisk root/hide
+workflow like GOLDEN, AXP options/settings surface, userspace hardening /
+signing posture, bundled usability apps, and an updated hardened sunfish
+kernel — except WebView as defined here. Banking/Island validation is
+**out of this story’s acceptance** (deferred to owner future / US3).
 
 **Why this priority**: This is the whole reason for the resurrection.
 
 **Independent Test**: Flash one `009` build to LAB; walk the GOLDEN daily
-checklist (microG Self-Check, Play open/install, Island profile, call-record
+checklist minus banking (microG Self-Check, Play open/install, call-record
 toggle off/on, spoofing toggle off/on, Magisk present in AXP-like install
-state, bundled apps present, hardening/signing checks that GOLDEN implies);
+state, bundled apps present, hardening/signing + kernel hardening checks);
 compare against `002` inventory categories.
 
 **Acceptance Scenarios**:
@@ -115,13 +148,13 @@ compare against `002` inventory categories.
    **When** the `009` image is flashed, **Then** the device boots to home and
    cellular/Wi‑Fi/basic hardware still work as in the vanilla smoke.
 2. **Given** that build, **When** I compare shipped capability categories to
-   GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, managed profile
-   tool, selectable call recording unlock, Magisk/DenyList-class path,
-   DNS/hosts privacy helpers if present on GOLDEN, F‑Droid/Aurora/launcher/
-   gallery-class bundled apps, hardening/signing/AVB class), **Then** no
-   category is left as “decide / later” without an explicit obsolescence note
-   tied to Android 16 / sunfish impossibility (WebView exception allowed per
-   FR-015).
+   GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, selectable call
+   recording unlock, Magisk/DenyList-class path, DNS/hosts privacy helpers if
+   present on GOLDEN, F‑Droid/Aurora/launcher/gallery-class bundled apps,
+   userspace hardening/signing/AVB class, kernel update + hardening class),
+   **Then** no category is left as “decide / later” without an explicit
+   obsolescence or **deferred** note (WebView exception FR-015; banking
+   deferred FR-006/FR-007; localization hardening compare deferred FR-018).
 3. **Given** Git and host artifact policy, **When** inspected, **Then** no
    proprietary Phonesky APK bytes or secrets were committed.
 
@@ -165,22 +198,22 @@ behaviour; push notifications smoke for a known test app.
 
 ---
 
-### User Story 3 - Banking profile workflow parity (Priority: P1)
+### User Story 3 - Banking profile workflow parity (Priority: P3 — deferred)
 
-As the owner, I can recreate the GOLDEN banking layout on LAB: install via the
-same store path I use on AXP, place banks in Island, and keep banking apps
-free of root via Magisk DenyList-class hiding like GOLDEN.
+As the owner, **later** I can recreate the GOLDEN banking layout on LAB:
+Island + Magisk DenyList-class hiding + Swissquote/Yuh. This is explicitly
+**not** required to accept the AXP-on-LOS23 clone for functionalities,
+options, hardening, security, or kernel work.
 
-**Why this priority**: Compatibility hard gates; daily-driver without banks
-fails the resurrection.
+**Why this priority**: Owner (2026-09-17) — banking is a future personal
+problem; do not block the updated AXP clone on bank gates.
 
-**Independent Test**: Install Swissquote (hard gate) and attempt Yuh; run
-inside Island; Magisk DenyList (or AXP-equivalent) applied; record PASS/FAIL
-honestly vs GOLDEN.
+**Independent Test** *(when owner resumes)*: Install Swissquote and attempt
+Yuh; Island; Magisk DenyList; record PASS/FAIL honestly vs GOLDEN.
 
-**Acceptance Scenarios**:
+**Acceptance Scenarios** *(deferred — not ship gates)*:
 
-1. **Given** Island on LAB, **When** I follow the documented GOLDEN banking
+1. **Given** Island on LAB, **When** the owner follows the GOLDEN banking
    install order, **Then** Swissquote reaches a usable logged-in state in the
    managed profile.
 2. **Given** Yuh on the same workflow, **When** tested, **Then** either it
@@ -211,32 +244,38 @@ recording unlock off (restricted) and on (record allowed).
    with GOLDEN measurement, using the newest Magisk stable that works on this
    stack.
 2. **Given** Magisk setup completed on LAB, **When** DenyList-class hiding is
-   configured for a banking package, **Then** that package does not receive
-   root.
+   configured for a test package, **Then** that package does not receive root
+   (banking packages deferred with US3).
 3. **Given** selectable call recording unlock, **When** OFF, **Then** stock
    LOS country/carrier style restrictions apply; **When** ON, **Then** Dialer
    can record on LAB without that block.
 
 ---
 
-### User Story 5 - AXP usability, privacy, hardening (Priority: P2)
+### User Story 5 - AXP usability, options, hardening + kernel (Priority: P1)
 
-As the owner, the ROM ships the rest of the AXP usability/privacy surface and
-GOLDEN-class hardening/signing/AVB posture at newest workable stables, with
-LOS23 WebView default and an unlocked provider chooser.
+As the owner, the ROM ships the rest of the AXP usability/privacy surface,
+AXP-class options/settings behaviour, GOLDEN-class userspace hardening /
+signing / AVB posture, and an **updated LOS 23.2 sunfish kernel with
+attributable hardening** (AXP / Graphene / Divest class where still valid on
+non-GKI 4.14), at newest workable stables, with LOS23 WebView default and an
+unlocked provider chooser. Localization/location-hardening delta vs LOS is
+**out of scope for now** (FR-018 later).
 
-**Why this priority**: Completes resurrection beyond Google/banking/root core.
+**Why this priority**: Owner (2026-09-17) — this is the core of “clon
+actualizado de AXP”, ahead of banking.
 
 **Independent Test**: Package list vs `002`; open bundled apps; confirm
-default WebView is LOS and another WebView can be selected if installed;
-hardening/signing checks agreed for GOLDEN-class parity.
+default WebView is LOS; userspace hardening/signing checks; kernel version /
+hardening patch attribution recorded for the accepted build.
 
 **Acceptance Scenarios**:
 
 1. **Given** the `009` build, **When** I list bundled system/user apps in the
    AXP usability set, **Then** each GOLDEN/AXP category is present or
    explicitly marked impossible on Android 16/sunfish with rationale
-   (Aosmium absence is the allowed WebView exception).
+   (Aosmium absence is the allowed WebView exception; banking tools may ship
+   as packages without Gate E validation).
 2. **Given** Developer options, **When** I open WebView implementation,
    **Then** LOS23 WebView is available/default and the chooser is not locked
    against future alternate providers.
@@ -244,9 +283,13 @@ hardening/signing checks agreed for GOLDEN-class parity.
    FR-004) are recorded, **Then** each is newest stable that still runs on
    the ROM.
 4. **Given** GOLDEN/AXP hardening and signing expectations, **When** the
-   accepted build is evaluated, **Then** equivalent class of protections /
-   signing posture is present or each gap is documented as impossible on
-   this stack — not silently dropped.
+   accepted build is evaluated, **Then** equivalent class of userspace
+   protections / signing posture is present or each gap is documented as
+   impossible on this stack — not silently dropped.
+5. **Given** the LOS 23.2 sunfish kernel tree, **When** the accepted boot
+   image is built, **Then** it is an updated lineage/sunfish-compatible
+   kernel (not an unrelated prebuilt) with attributable hardening patches
+   applied or each skipped hardening item documented.
 
 ---
 
@@ -291,6 +334,9 @@ work when published.
   silently fall back to FakeStore.
 - Alternate WebView installed by user later: selection must remain possible;
   default remains LOS23 WebView until the user changes it.
+- Localization/location hardening: AXP historically more aggressive than LOS
+  in places the owner dislikes; **do not decide** AXP-vs-LOS location policy
+  in this feature’s acceptance — compare later (FR-018).
 
 ## Requirements *(mandatory)*
 
@@ -298,9 +344,11 @@ work when published.
 
 - **FR-001**: The project MUST produce a flashable LineageOS 23.2 / Android 16
   `sunfish` build that resurrects the AXP.OS on LOS22 / GOLDEN capability set
-  (including Magisk-class root and GOLDEN-class hardening / signing / AVB
-  posture), without leaving AXP capabilities as open “decide” omissions
-  except the WebView exception in FR-015.
+  (including Magisk-class root, GOLDEN-class userspace hardening / signing /
+  AVB posture, and an updated hardened sunfish kernel per FR-017), without
+  leaving AXP capabilities as open “decide” omissions except documented
+  exceptions/deferrals (WebView FR-015; banking FR-006/FR-007; localization
+  compare FR-018).
 - **FR-002**: Version selection for system and bundled components (except
   Phonesky per FR-004) MUST prefer the newest stable (or newest tagged
   pre-release upstream currently ships) that still works on sunfish /
@@ -316,10 +364,13 @@ work when published.
   microG + Phonesky path (owner-controlled toggle; default safe/off or
   project-documented default). Spoofing MUST remain restricted/controlled —
   not unrestricted platform spoofing for all apps.
-- **FR-006**: The ROM MUST support the GOLDEN managed-profile banking workflow
-  (Island as measured on GOLDEN) including Swissquote PASS as a hard gate.
-- **FR-007**: Banking applications MUST run without being granted root
-  (Magisk DenyList-class hiding).
+- **FR-006**: *(Deferred — owner future)* The ROM SHOULD support the GOLDEN
+  managed-profile banking workflow (Island as measured on GOLDEN) including
+  Swissquote PASS. This is **not** an acceptance gate for the AXP clone MVP.
+- **FR-007**: *(Deferred — owner future)* Banking applications SHOULD run
+  without being granted root (Magisk DenyList-class hiding). Magisk MUST still
+  provide DenyList-class capability for general use (FR-010); bank-specific
+  validation is deferred with FR-006.
 - **FR-008**: The ROM MUST include **selectable** AXP-equivalent call
   recording unlock (toggle; OFF = stock LOS restrictions, ON = unlock).
 - **FR-009**: The ROM MUST include the AXP usability/privacy bundled surface
@@ -329,12 +380,12 @@ work when published.
 - **FR-010**: The ROM MUST ship **Magisk** like GOLDEN: newest Magisk stable
   that works on this stack, in an AXP-like preinstalled but not fully
   activated layout (exact first-boot/setup behaviour measured from GOLDEN),
-  with DenyList-class hiding sufficient for FR-007. KernelSU is **out of
-  ship for now** (not the resurrection root path).
+  with DenyList-class hiding available. KernelSU is **out of ship for now**
+  (not the resurrection root path).
 - **FR-011**: The feature acceptance gate MUST include GOLDEN/AXP-class
-  hardening and signing / AVB posture (as applicable on LOS 23.2 / sunfish),
-  not only apps and Google compatibility. Gaps MUST be documented as
-  impossible on this stack rather than silently omitted.
+  userspace hardening and signing / AVB posture (as applicable on LOS 23.2 /
+  sunfish), not only apps and Google compatibility. Gaps MUST be documented
+  as impossible on this stack rather than silently omitted.
 - **FR-012**: Acceptance flashing MUST use LAB only; GOLDEN MUST remain
   unmodified by this feature's work.
 - **FR-013**: Each shipped capability MUST be attributable (what upstream or
@@ -354,6 +405,32 @@ work when published.
   Such reuse is **optional** (“si se puede, ok”), MUST NOT become an
   acceptance requirement for Magisk resurrection, and MUST NOT imply KernelSU
   is back in the ship path unless a future spec explicitly says so.
+- **FR-017**: The ship MUST use an **updated** LineageOS 23.2–compatible
+  `sunfish` kernel (current lineage/kernel_google_sunfish or project-tracked
+  equivalent — not an unrelated Graphene A13 / stock A13 prebuilt), with
+  **attributable kernel hardening** ported from AXP / Graphene / Divest where
+  still valid on non-GKI 4.14. Skipped items MUST be documented with rationale.
+- **FR-018**: *(Deferred research — look later)* Compare how AXP/GOLDEN
+  hardens or constrains **localization / location** (network location,
+  backends, permissions, privacy toggles) versus stock LineageOS 23 behaviour.
+  Owner historically finds AXP aggressive here; do **not** freeze a
+  clone-or-LOS policy in this feature’s acceptance until that comparison
+  exists. Default until then: do not silently invent extra location lockdown
+  beyond what the rest of the AXP clone already implies; record the open
+  question in the capability matrix.
+- **FR-019**: On a **final** shipping `009` image, owner MUST be able to
+  refresh bundled **system / privileged** packages by **sideload** (or the
+  documented Magisk-equivalent path) roughly every **2–3 months**, without
+  requiring a full ROM reflash for routine bumps of at least: **microG
+  (GmsCore / companions)**, **Magisk**, **project Phonesky**, and other
+  project-bundled system apps that the capability inventory treats as
+  updatable. Packaging MUST preserve PackageManager update eligibility
+  (matching signing identity; **PRESIGNED** where upstream expects
+  self-updates; project-key continuity for Phonesky). Magisk MAY use its
+  normal manager / boot-image update flow when APK-only sideload is
+  insufficient — that path MUST be documented in the recovery/sideload
+  runbook. This does **not** restore AXP external repos or OTA (still
+  forbidden); updates are owner-driven sideload / recovery packages.
 
 ### Key Entities
 
@@ -364,13 +441,16 @@ work when published.
   (resurrection target).
 - **Version pin record**: Documented package/component versions chosen for the
   accepted `009` build (newest workable stable each; Phonesky = project
-  artifact id/version).
+  artifact id/version; kernel rev + hardening patch list).
 - **Phonesky host artifact**: Project patched/signed Play APK and permission
   metadata kept outside Git on the build host.
 - **Magisk preinstall state**: Measured GOLDEN/AXP layout for Magisk present
   but not fully activated, plus LAB setup steps.
-- **LAB acceptance build**: Flashable image set + hashes + smoke/banking /
-  Magisk / hardening results for this feature.
+- **Hardened sunfish kernel**: Updated LOS23-compatible kernel build +
+  attributed hardening patch set for FR-017.
+- **LAB acceptance build**: Flashable image set + hashes + smoke / Magisk /
+  userspace+kernel hardening results for this feature (banking evidence
+  optional/deferred).
 
 ## Success Criteria *(mandatory)*
 
@@ -380,15 +460,16 @@ work when published.
   hardware smoke within the same session as flash (owner can place a call,
   use Wi‑Fi, and unlock the device).
 - **SC-002**: 100% of AXP resurrection capability categories from the agreed
-  inventory are either demonstrated on LAB or explicitly documented as
-  impossible on Android 16/sunfish — zero silent omissions (WebView exception
-  allowed only as FR-015).
+  inventory are either demonstrated on LAB, marked deferred (banking,
+  localization compare), or explicitly documented as impossible on Android
+  16/sunfish — zero silent omissions (WebView exception allowed only as
+  FR-015).
 - **SC-003**: With spoofing enabled as required, microG Self-Check required
   items and project Phonesky open/install succeed on LAB for ordinary apps on
   the first accepted build candidate (or within one documented fix iteration).
-- **SC-004**: Swissquote managed-profile + Magisk DenyList-class workflow
-  PASSes on LAB; Yuh result is recorded and is not worse than GOLDEN for
-  packaging/spoofing reasons.
+- **SC-004**: *(Deferred with US3)* Swissquote managed-profile + Magisk
+  DenyList-class workflow PASSes on LAB when owner resumes banking; not
+  required for AXP-clone MVP acceptance.
 - **SC-005**: Every bundled/system app version in the acceptance record
   (except Phonesky) is newer than or equal to GOLDEN's measured version,
   unless a newer release was tried and failed with a written regression note;
@@ -399,7 +480,16 @@ work when published.
   can be fully activated on LAB using documented steps measured from GOLDEN.
 - **SC-008**: Default WebView is LOS23's; provider selection remains available.
 - **SC-009**: Owner can perform the GOLDEN-equivalent daily checklist on LAB
-  without consulting a scatter of conflicting feature specs for what “ships”.
+  **excluding deferred banking** without consulting a scatter of conflicting
+  feature specs for what “ships”.
+- **SC-010**: Accepted build records kernel revision + hardening attribution
+  list (applied / skipped+why) satisfying FR-017.
+- **SC-011**: Acceptance docs list, for each FR-019 component, the intended
+  update channel (sideload APK / recovery zip / Magisk self-update) and confirm
+  signing identity is not broken by packaging (PRESIGNED or project key as
+  applicable). Full 2–3 month refresh drill MAY wait until a final ROM
+  candidate; packaging regressions that block updates MUST be fixed before
+  ship.
 
 ## Assumptions
 
@@ -408,11 +498,12 @@ work when published.
 - GOLDEN inventory (`002`) plus AXP Pro docs are sufficient to enumerate the
   capability set; live `adb` re-query of GOLDEN is allowed (especially Magisk
   preinstall/activation details).
-- “AXP resurrection” means Magisk + GOLDEN-class hardening/signing/AVB + full
-  AXP user surface on LOS23, with only the stated WebView and Phonesky-artifact
-  exceptions.
-- Island remains the managed-profile tool because that is what GOLDEN
-  actually runs (AXP docs saying “Insular” are historical naming).
+- “AXP resurrection” / updated clone means Magisk + GOLDEN-class userspace
+  hardening/signing/AVB + AXP user/options surface + updated hardened kernel
+  on LOS23, with WebView, Phonesky-artifact, banking-deferral, and
+  localization-compare exceptions as stated.
+- Island / banking validation is owner-future; shipping Island as a bundled
+  app is optional and does not imply Gate E.
 - FakeStore is never the primary Play path.
 - Selectable spoofing and selectable call recording follow the same class of
   Developer Options UX already explored in `005`/`008` runbooks where useful.
@@ -424,3 +515,10 @@ work when published.
 - Prior KernelSU LAB experiments (including the two functional kernels already
   built) are **out of ship for now** but kept as recyclable assets: reuse if
   helpful, never required for Magisk acceptance.
+- Localization hardening AXP-vs-LOS comparison is intentionally postponed
+  (FR-018); do not block MVP on it.
+- No AXP-style OTA or external repos; periodic system-package refresh is
+  **owner sideload** (FR-019), not a network updater in the ROM.
+- microG stays PRESIGNED / replace-prebuilt so same-signer updates remain
+  possible; Phonesky stays on the project signing key across releases;
+  Magisk update docs cover manager + any boot re-patch when needed.

specs/009-axp-los23-port/tasks.md

@@ -0,0 +1,339 @@
+# Tasks: AXP LOS22 feature port to LOS23 (resurrection)
+
+**Input**: Design documents from `/specs/009-axp-los23-port/`  
+**Prerequisites**: `plan.md`, `spec.md`, `research.md`, `data-model.md`,
+`contracts/`, `quickstart.md`; constitution Magisk-resurrection track;
+standby KernelSU track (`004`–`008`/`007`) remains untouched
+
+**Tests**: LAB acceptance only (Gates A–G in `contracts/acceptance-gates.md`).
+No unit/contract TDD suite requested — validation tasks are adb/flash checks.
+
+**Organization**: Setup → Foundational → US1 / US2 / US4 / US5 (MVP) → US6 →
+Polish. **US3 banking is deferred (P3)** — skip for MVP. US5 includes
+**kernel update + hardening** (FR-017). Localization AXP-vs-LOS (FR-018) =
+look later, not a ship gate. Full US1 Independent Test needs US2+US4+US5
+(not banking).
+
+## Format: `[ID] [P?] [Story] Description`
+
+- **[P]**: Can run in parallel (different files, no incomplete deps)
+- **[Story]**: US1…US6 from `spec.md`
+- Include exact file paths in descriptions
+
+## Path conventions
+
+- Meta repo: `vendor/sunfish-a16/`, `docs/`, `specs/009-axp-los23-port/`
+- Build host: `/srv/rom/src/lineage/`, `/srv/rom/prebuilts/`,
+  `/srv/rom/artifacts/009-axp-los23-port/`, `/srv/rom/secrets/`
+- LAB: `11231JEC207477` only — never GOLDEN flash/modify
+- GOLDEN: `adb` read-only oracle (esp. Magisk preinstall layout)
+
+---
+
+## Phase 1: Setup (Shared Infrastructure)
+
+**Purpose**: Host dirs, runbook stubs, capability inventory scaffold
+
+- [x] T001 Create host dirs `/srv/rom/prebuilts/{magisk,axp-apps}/`,
+      `/srv/rom/artifacts/009-axp-los23-port/`, `/srv/rom/logs/009-build/`
+      on `rom-dev01` (android-build writable)
+- [x] T002 [P] Add stub `docs/009-magisk-preinstall-runbook.md` (GOLDEN
+      measure checklist, activation steps, DenyList banking order, LAB serial)
+- [x] T003 [P] Add stub `docs/009-version-pins.md` (VersionPinRecord table:
+      component / version_name / version_code / upstream_ref / policy /
+      verified_on)
+- [x] T004 [P] Add stub `docs/009-capability-matrix.md` mapping
+      `docs/002-golden-inventory.md` + `docs/axp-pro-parity.md` rows →
+      `required` / `exception` / `impossible` per `data-model.md`
+      AxpCapabilitySet
+- [x] T005 [P] Create `vendor/sunfish-a16/patches/009-axp-los23-port/README.md`
+      (Magisk-resurrection apply order; reuse `005`/`008`; no KernelSU ship;
+      attribute upstreams)
+
+**Checkpoint**: Dirs + stubs exist; no bacon yet
+
+---
+
+## Phase 2: Foundational (Blocking Prerequisites)
+
+**Purpose**: Freshness policy, GOLDEN Magisk measurement, product wiring
+baseline — MUST complete before story packages land on LAB acceptance builds
+
+**⚠️ CRITICAL**: Blocks user-story packaging/flash acceptance
+
+- [x] T006 Refresh microG + GSF to newest stable upstream (fetch tags /
+      releases; no stale host cache) into `/srv/rom/prebuilts/microg/` +
+      `VERSIONS.txt`; record pins in `docs/009-version-pins.md`
+- [x] T007 [P] Confirm project patched Phonesky still present under
+      `/srv/rom/prebuilts/phonesky/` + XMLs; record artifact id in
+      `docs/009-version-pins.md` (`policy=project_phonesky`); halt note if
+      GOLDEN-class gap suspected
+- [x] T008 [P] Fetch newest Magisk stable that targets this stack into
+      `/srv/rom/prebuilts/magisk/` + `VERSIONS.txt`; record pin in
+      `docs/009-version-pins.md`
+- [x] T009 Measure GOLDEN Magisk/Magia preinstall layout via `adb` only
+      (paths, packages, first-boot/setup UX) and write results into
+      `docs/009-magisk-preinstall-runbook.md` (FR-010 / contracts/
+      magisk-preinstall.md)
+- [x] T010 Fill `docs/009-capability-matrix.md` for all GOLDEN/AXP categories
+      (google-stack, spoofing, call-rec, Magisk, bundled apps, DNS/hosts,
+      userspace hardening/signing/AVB, **kernel hardening**, WebView=exception,
+      banking=deferred, localization=deferred FR-018); zero silent omissions
+- [x] T011 Wire Magisk-resurrection product includes in
+      `vendor/sunfish-a16/` (extend `gms.mk` / add `magisk.mk` or equivalent;
+      keep Phonesky priv-app path; **no FakeStore**; **no KernelSU** product
+      packages) and document include hook in
+      `vendor/sunfish-a16/patches/009-axp-los23-port/README.md`
+- [x] T012 Confirm `003` vanilla (or documented equivalent) known-good
+      baseline is available for LAB clean-flash acceptance; note rev in
+      `docs/009-version-pins.md` VanillaBaseline row
+- [x] T013 [P] Confirm optional `007` kernel artifacts remain on host under
+      `/srv/rom/artifacts/007-*/` for FR-016 recycle only; list paths in
+      `docs/009-magisk-preinstall-runbook.md` as non-ship
+
+**Checkpoint**: Prebuilts fresh, Magisk UX measured, product wire documented —
+story work can begin
+
+---
+
+## Phase 3: User Story 1 — AXP resurrection daily-driver on LAB (Priority: P1) 🎯 MVP framing
+
+**Goal**: One flashable `009` composition path and Gate A smoke; full
+daily-driver Independent Test completes after US2+US4+US5 (banking deferred)
+
+**Independent Test**: Flash one `009` build to LAB; walk GOLDEN checklist
+**minus banking** from `docs/009-capability-matrix.md`
+
+### Implementation for User Story 1
+
+- [x] T014 [US1] Define staged known-good image policy in
+      `docs/009-magisk-preinstall-runbook.md` (retain prior LAB image hashes
+      under `/srv/rom/artifacts/009-axp-los23-port/<build-id>/` per FR-013)
+- [ ] T015 [US1] Add LAB flash/acceptance checklist linking Gates A–G to
+      `specs/009-axp-los23-port/quickstart.md` and
+      `contracts/acceptance-gates.md` (artifact subdirs `gate-a/`…`gate-g/`)
+- [ ] T016 [US1] Produce first Magisk-track bacon on `rom-dev01` (detached
+      `/srv/rom/artifacts/bin/rom-detach` / tmux) with current wired packages;
+      logs under `/srv/rom/logs/009-build/`; images + SHA-256 under
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/`
+- [ ] T017 [US1] Clean-flash LAB `11231JEC207477` only; complete Gate A
+      (boot/home/call/Wi‑Fi/unlock); save `getprop` + notes under
+      `…/<build-id>/gate-a/`
+- [ ] T018 [US1] After US2+US4+US5 land, re-flash accepted candidate and mark
+      SC-001…SC-003 + SC-005…SC-010 / Gates A–D + F–G in
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/acceptance.md`
+      against `docs/009-capability-matrix.md` (skip Gate E / SC-004)
+- [ ] T019 [US1] Verify Git/meta-repo contains no proprietary Phonesky APK
+      bytes or secrets; document check in
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/acceptance.md`
+
+**Checkpoint**: Gate A proven; full US1 Independent Test after US2+US4+US5
+
+---
+
+## Phase 4: User Story 2 — Google stack: newest microG + project Phonesky (Priority: P1)
+
+**Goal**: Newest microG/GSF + project Phonesky + selectable restricted spoofing
+
+**Independent Test**: microG Self-Check; Phonesky open/install; spoofing
+OFF/ON per `contracts/toggles-surface.md`
+
+### Implementation for User Story 2
+
+- [ ] T020 [P] [US2] Ensure `vendor/sunfish-a16/gms.mk` +
+      `vendor/sunfish-a16/Android.mk` package refreshed microG/GSF + Phonesky
+      without FakeStore; privilege XMLs remain under
+      `vendor/sunfish-a16/permissions/` and
+      `vendor/sunfish-a16/default-permissions/`
+- [ ] T021 [P] [US2] Re-apply / verify selectable signature spoofing via
+      `vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py` on LOS
+      23.2 tree; document A16 deltas in `docs/005-spoofing-runbook.md` (or
+      `docs/009-magisk-preinstall-runbook.md` cross-link)
+- [ ] T022 [US2] Build+flash LAB image including Google stack; run Gate B
+      (Self-Check, Phonesky open, ordinary app install/update); evidence under
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/gate-b/`
+- [ ] T023 [US2] Verify Secure key `allow_signature_fake` OFF/ON behaviour per
+      `contracts/toggles-surface.md`; record in
+      `…/<build-id>/gate-c/spoofing.md`
+- [x] T024 [US2] Finalize microG/GSF/Phonesky rows in `docs/009-version-pins.md`;
+      if Phonesky lacks GOLDEN-class daily fix → FAIL closed note in
+      `…/<build-id>/gate-b/phonesky-halt.md` (do not accept)
+
+**Checkpoint**: Gate B + spoofing half of Gate C pass (or explicit Phonesky halt)
+
+---
+
+## Phase 5: User Story 3 — Banking (Priority: P3 — deferred)
+
+**Goal**: Island + Magisk DenyList banking — **owner future; not MVP**
+
+**Independent Test**: *(when resumed)* Swissquote in Island; Yuh honest; no root
+
+### Deferred tasks (do not block acceptance)
+
+- [ ] T025 [P] [US3] *(Deferred)* Stage Island under
+      `/srv/rom/prebuilts/axp-apps/` and wire into `vendor/sunfish-a16/` if
+      desired as optional package; pin in `docs/009-version-pins.md`
+- [ ] T026 [US3] *(Deferred)* Document GOLDEN banking order in
+      `docs/009-magisk-preinstall-runbook.md`
+- [ ] T027 [US3] *(Deferred)* Swissquote Gate E under
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/gate-e/swissquote/`
+- [ ] T028 [US3] *(Deferred)* Yuh classify in `…/gate-e/yuh.md`
+- [ ] T029 [US3] *(Deferred)* Banks lack root note in `…/gate-e/root-check.md`
+
+**Checkpoint**: Skipped for MVP — resume only when owner asks
+
+---
+
+## Phase 6: User Story 4 — Magisk like GOLDEN + selectable call recording (Priority: P1)
+
+**Goal**: Magisk AXP-like preinstall + DenyList; selectable call-rec unlock
+
+**Independent Test**: Preinstall state vs GOLDEN notes; activation; DenyList
+test app; call-rec OFF/ON
+
+### Implementation for User Story 4
+
+- [ ] T030 [US4] Implement Magisk AXP-like preinstall packaging from
+      `/srv/rom/prebuilts/magisk/` into `vendor/sunfish-a16/magisk.mk` (or
+      equivalent) matching `docs/009-magisk-preinstall-runbook.md` measured
+      layout (`contracts/magisk-preinstall.md`)
+- [ ] T031 [P] [US4] Re-apply / verify selectable call-rec unlock via
+      `vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py`
+      (`extendrom_call_recording`); keep default OFF; optional FLAG_SECURE
+      not required for AXP acceptance — document in
+      `docs/008-call-rec-flag-secure-runbook.md`
+- [ ] T032 [US4] Build+flash LAB; document pre-activation Magisk state vs
+      GOLDEN under `…/<build-id>/magisk/pre-activation.md` (Gate D)
+- [ ] T033 [US4] Complete Magisk activation on LAB per runbook; configure
+      DenyList-class hide for a **test** package (not bank gate); save version +
+      screenshots under `…/<build-id>/magisk/`
+- [ ] T034 [US4] Verify `extendrom_call_recording` OFF = stock restrictions,
+      ON = Dialer can record; evidence under
+      `…/<build-id>/gate-c/call-rec.md`
+- [ ] T035 [US4] Record Magisk version pin (newest workable stable) in
+      `docs/009-version-pins.md`
+
+**Checkpoint**: Gates C (call-rec) + D pass
+
+---
+
+## Phase 7: User Story 5 — Usability, options, hardening + kernel (Priority: P1)
+
+**Goal**: Bundled AXP surface; LOS23 WebView; userspace hardening/signing;
+**updated hardened sunfish kernel** (FR-017). Localization compare = later.
+
+**Independent Test**: Packages vs matrix; WebView LOS; Gate G userspace +
+kernel attribution (SC-010)
+
+### Implementation for User Story 5
+
+- [ ] T036 [P] [US5] Enumerate bundled usability packages from
+      `docs/009-capability-matrix.md` (Aurora, F-Droid/repos as on GOLDEN,
+      launcher/gallery-class, DNS/hosts helpers if required); stage newest
+      workable APKs under `/srv/rom/prebuilts/axp-apps/`
+- [ ] T037 [US5] Wire bundled apps into `vendor/sunfish-a16/` product
+      makefiles; pin all versions in `docs/009-version-pins.md`
+- [ ] T038 [P] [US5] Verify WebView policy: no Aosmium; default LOS23
+      provider; chooser unlocked — document in
+      `…/<build-id>/gate-f/webview.md` per `contracts/webview-surface.md`
+- [ ] T039 [US5] Build+flash LAB; confirm bundled categories present or
+      marked impossible/deferred in `docs/009-capability-matrix.md`; Gate F
+      evidence under `…/<build-id>/gate-f/`
+- [x] T040 [US5] Define staged userspace hardening/signing/AVB checklist in
+      `docs/009-hardening-signing-checklist.md` (GOLDEN vs LAB measured
+      2026-09-29; release keys yes / bootloader lock wont; stages US-S0…S6)
+- [ ] T041 [US5] Implement first attributable userspace hardening/signing
+      stage under `vendor/sunfish-a16/patches/009-axp-los23-port/` (US-S1
+      keygen + US-S2 wire); keep known-good prior image
+      (`20260929T123401Z-axp-stage1-combo4`)
+- [ ] T042 [US5] Inventory LOS23 sunfish kernel tree on `rom-dev01`
+      (`/srv/rom/src/lineage/kernel/google/sunfish` or manifest path); record
+      baseline rev in `docs/009-version-pins.md`
+- [ ] T043 [US5] Build attributable kernel hardening patch list (AXP /
+      Graphene / Divest → 4.14-safe) in
+      `docs/009-kernel-hardening-map.md` (applied vs skip+why)
+- [ ] T044 [US5] Apply first kernel hardening stage on LOS23 sunfish kernel;
+      rebuild boot; flash LAB; evidence under `…/<build-id>/gate-g/kernel/`
+- [ ] T045 [US5] Run Gate G userspace+kernel on accepted candidate; gaps in
+      `…/<build-id>/gate-g/gaps.md`; **do not** block on FR-018 localization
+- [x] T046 [P] [US5] *(Look later — FR-018)* Stub only:
+      `docs/009-localization-axp-vs-los.md` outlining what to compare later
+      (AXP location lockdown vs stock LOS); no policy decision in MVP
+- [ ] T046a [P] [US5] *(FR-019 — before final ship)* Write
+      `docs/009-sideload-system-updates.md`: how to refresh microG, Magisk,
+      Phonesky, and other system apps every ~2–3 months without full reflash
+      (signing identity / PRESIGNED / Magisk manager+boot path); verify
+      packaging does not break update eligibility
+
+**Checkpoint**: Gates F + G (userspace + kernel) for claimed stage; FR-018 stub
+only; FR-019 runbook before final ship
+
+---
+
+## Phase 8: User Story 6 — Parallel tracks stay honest (Priority: P2)
+
+**Goal**: Docs/branches make Magisk `009` active vs KernelSU standby clear
+
+**Independent Test**: `specs/004`–`008`/`007` still present; `009` does not
+retire standby track
+
+### Implementation for User Story 6
+
+- [ ] T047 [P] [US6] Update `docs/README.md` (and `AGENTS.md` if needed) to
+      state active Magisk-resurrection track = `009` / this repo; standby
+      KernelSU = sibling `sunfish-a16-rom` + specs `004`–`008`/`007`
+- [ ] T048 [P] [US6] Add short track note to
+      `specs/009-axp-los23-port/spec.md` only if needed (do **not** rewrite
+      standby feature specs)
+- [ ] T049 [US6] Remap relevant `docs/axp-pro-parity.md` rows to `009`
+- [ ] T050 [US6] Confirm `specs/001`–`008`/`007` directories still exist; record in
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/acceptance.md`
+- [ ] T051 [P] [US6] Document optional FR-016 KSU recycle (non-ship) in
+      `docs/009-magisk-preinstall-runbook.md` + `docs/007-kernelsu-runbook.md`
+      cross-link
+
+**Checkpoint**: Parallel-track honesty readable without rewriting history
+
+---
+
+## Phase 9: Polish & Cross-Cutting Concerns
+
+**Purpose**: Freshness audit, quickstart validation, handoff
+
+- [ ] T052 [P] Audit all `docs/009-version-pins.md` rows against freshness
+      policy; fix stale host copies if found
+- [ ] T053 [P] Run `specs/009-axp-los23-port/quickstart.md` on LAB
+      (**skip Gate E**); fix doc gaps
+- [ ] T054 Collect final artifacts under
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/`
+- [ ] T055 [P] Add/update `docs/009-gate-handoff.md` (next: banking later;
+      localization compare FR-018 later; sideload refresh cadence FR-019)
+- [ ] T056 Mark `specs/009-axp-los23-port/spec.md` Status after Gates A–D +
+      F–G
+
+---
+
+## Dependencies & Execution Order
+
+### MVP order (owner 2026-09-17)
+
+1. Setup + Foundational
+2. US2 Google stack
+3. US4 Magisk + call-rec
+4. US5 usability + **hardening + kernel**
+5. US1 full acceptance (T018) **without banking**
+6. US6 docs
+7. *(Later)* US3 banking + FR-018 localization compare
+
+### Suggested MVP scope
+
+**T001–T024 + T030–T046** (skip T025–T029)
+
+## Notes
+
+- Banking Gate E / T025–T029 = deferred (owner future)
+- Kernel hardening = in-scope (FR-017); localization policy = later (FR-018)
+- LAB only; never flash GOLDEN
+- Long builds detached on `rom-dev01`
+- Owner handles git commit / push / MR