009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

specs/009-axp-los23-port/contracts/acceptance-gates.md

@@ -27,27 +27,39 @@
 - [ ] Activation documented and completed on LAB
 - [ ] DenyList-class hides root from a test/banking package
 
-## Gate E — Banking
+## Gate E — Banking *(deferred — not MVP)*
 
-- [ ] Island present; Swissquote PASS in managed profile workflow
-- [ ] Yuh recorded; not worse than GOLDEN for packaging/spoofing reasons
-- [ ] Banks do not receive root
+- [ ] *(Later)* Island present; Swissquote PASS in managed profile workflow
+- [ ] *(Later)* Yuh recorded; not worse than GOLDEN for packaging/spoofing
+- [ ] *(Later)* Banks do not receive root
 
 ## Gate F — Usability / WebView
 
-- [ ] Bundled AXP categories present or documented impossible
+- [ ] Bundled AXP categories present or documented impossible/deferred
 - [ ] Versions newest workable (except Phonesky rule)
 - [ ] WebView default LOS; chooser unlocked
 
-## Gate G — Hardening / signing class
+## Gate G — Hardening / signing + kernel
 
-- [ ] GOLDEN-class hardening/signing/AVB posture present **or** each gap
-      documented as impossible on this stack (no silent omit)
-- [ ] Staged known-good images retained for bisect
+- [ ] Project **release / definitive signing keys** on ship images/OTAs (not
+      AOSP test-keys); Phonesky / update identity on that key
+- [ ] GOLDEN-class **userspace** hardening + AVB *build* posture as applicable
+      on unlocked sunfish **or** each in-scope gap documented (no silent omit)
+- [x] Updated LOS23-compatible sunfish kernel + hardening attribution list
+      (FR-017 / SC-010) — see `docs/009-gate-g-kernel-attribution.md`
+      (Stage1 + combo4 + Clang FORTIFY; LAB 2026-09-29)
+- [x] Staged known-good images retained for bisect
+      (`20260929T123401Z-axp-stage1-combo4`, prior combo4-fortify, GOODMAKE)
+- [x] Localization/location AXP-vs-LOS compare **not** required yet (FR-018)
+- [x] Bootloader relock **not** a Gate G requirement (AXP/LOS unlocked norm;
+      IOdes-class lock is non-goal) — see research 2026-09-29
 
 ## Non-gates
 
 - KernelSU presence or SusFS
 - FLAG_SECURE override (optional)
 - Custom AXP backup ROM feature
+- Banking / Swissquote / Yuh (deferred owner future)
+- Localization hardening policy freeze (FR-018 later)
 - Yuh PASS if GOLDEN attestation path still FAILs equivalently
+- Bootloader lock / relock (IOdes-class); unlocked sunfish is the ship model