009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

specs/009-axp-los23-port/spec.md

@@ -4,7 +4,8 @@
 
 **Created**: 2026-09-16
 
-**Status**: Clarified — ready for `/speckit-plan`
+**Status**: Spec clarified 2026-09-17 (banking deferred; kernel hardening in;
+localization compare later) — tasks updated; ready for `/speckit-implement`
 
 **Input**: User description: "009-axp based LOS22 feature port to LOS23 —
 take vanilla LineageOS 23 for sunfish and integrate the full AXP.OS (LOS22 /
@@ -24,6 +25,29 @@ with that Phonesky; signature spoofing and call recording **selectable**
 existing functional kernels if useful; otherwise everything equal to
 AXP/GOLDEN.
 
+**Owner clarifications (2026-09-17):** Primary ship interest = an **updated
+AXP clone on LOS23** (features, options, userspace hardening/security, updated
+hardened sunfish kernel). Banking / Island / Swissquote / Yuh **deferred**
+(owner future). Localization AXP-vs-LOS compare **later** (FR-018). Prefer AXP
+**build sources + docs** on `rom-dev01` as the compile oracle (how Magisk /
+product packaging is wired); GOLDEN `adb` for *runtime* behaviour, not the
+first place to reverse “how to build”. **Do not** ship NeoLauncher — keep LOS
+Launcher3. Prefer **Droidify** over stock F-Droid client (lighter; many repos
+by default) unless packaging forces otherwise. **Do not** integrate AXP
+**external** market repos or AXP **OTA** servers (EOL / servers down — no
+sense). **Do** clone AXP-class **Private DNS** presets (many provider entries).
+**Do** keep AXP-class **Internet connectivity** / special INTERNET permission
+UX where practical, but **do not** hard-wire `axp.os` branding/endpoints.
+**Wanted:** restore classic **Disable app** behaviour on Android 16 (LOS/AOSP
+replaced much of this with **Archive**, which the owner dislikes) — research
+and re-expose Disable where still feasible on A16. **Later (final ROM):**
+system components (microG, Magisk, project Phonesky, other bundled system
+apps) MUST remain **sideload-updatable** on a shipping build — owner plans
+refreshes every **2–3 months** without a full ROM reflash. Packaging MUST
+preserve update paths (same signing identity / PRESIGNED where applicable;
+document Magisk update path separately from APK sideload if boot-preroot).
+
+
 ## Context / non-goals
 
 **Product intent (this feature is normative for the AXP resurrection ship):**
@@ -83,30 +107,39 @@ AXP/GOLDEN.
 - Building a custom AXP-style backup/restore ROM feature (personal backup
   remains an external user tool if needed).
 - Claiming Yuh hardware-attestation PASS if GOLDEN itself currently FAILs that
-  path — reproduce GOLDEN's *workflow* and document attestation parity honestly.
+  path — banking attestation is deferred with the banking workflow (owner
+  future); do not treat Swissquote/Yuh as ship gates here.
 - Deleting or rewriting the standby KernelSU / split-roadmap specs
   (`004`–`008`/`007`) — they remain valid on the standby branch/track.
 - Shipping KernelSU-Next as this track’s root (out of ship here; Magisk is
   the resurrection root). Optional later reuse of `007` kernels is allowed
   under FR-016 but MUST NOT delay Magisk acceptance.
+- Resolving localization/location-hardening policy vs LOS defaults in this
+  feature’s acceptance (deferred research FR-018 — compare AXP vs LOS later).
+- Integrating AXP **external** F-Droid/market repos or AXP **OTA** update
+  servers (EOL; servers down — no sense).
+- Shipping NeoLauncher.
+- Hard-wiring `axp.os` branding/endpoints into Internet-connectivity /
+  network UX (keep the permission/connectivity *behaviour* where practical).
 
 ## User Scenarios & Testing *(mandatory)*
 
 ### User Story 1 - AXP resurrection daily-driver on LAB (Priority: P1)
 
 As the owner, after flashing one LAB build produced under this feature, the
-phone boots and presents the same class of daily-driver capabilities I rely on
-with AXP on GOLDEN (Google compatibility stack, Play, managed banking profile
-workflow, selectable call recording unlock, Magisk root/hide workflow like
-GOLDEN, AXP hardening/signing posture, and AXP bundled usability apps —
-except WebView as defined here), without a checklist of deferred AXP features.
+phone boots and presents an **updated AXP-class clone on LOS23**: Google
+compatibility stack, Play, selectable call recording unlock, Magisk root/hide
+workflow like GOLDEN, AXP options/settings surface, userspace hardening /
+signing posture, bundled usability apps, and an updated hardened sunfish
+kernel — except WebView as defined here. Banking/Island validation is
+**out of this story’s acceptance** (deferred to owner future / US3).
 
 **Why this priority**: This is the whole reason for the resurrection.
 
 **Independent Test**: Flash one `009` build to LAB; walk the GOLDEN daily
-checklist (microG Self-Check, Play open/install, Island profile, call-record
+checklist minus banking (microG Self-Check, Play open/install, call-record
 toggle off/on, spoofing toggle off/on, Magisk present in AXP-like install
-state, bundled apps present, hardening/signing checks that GOLDEN implies);
+state, bundled apps present, hardening/signing + kernel hardening checks);
 compare against `002` inventory categories.
 
 **Acceptance Scenarios**:
@@ -115,13 +148,13 @@ compare against `002` inventory categories.
    **When** the `009` image is flashed, **Then** the device boots to home and
    cellular/Wi‑Fi/basic hardware still work as in the vanilla smoke.
 2. **Given** that build, **When** I compare shipped capability categories to
-   GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, managed profile
-   tool, selectable call recording unlock, Magisk/DenyList-class path,
-   DNS/hosts privacy helpers if present on GOLDEN, F‑Droid/Aurora/launcher/
-   gallery-class bundled apps, hardening/signing/AVB class), **Then** no
-   category is left as “decide / later” without an explicit obsolescence note
-   tied to Android 16 / sunfish impossibility (WebView exception allowed per
-   FR-015).
+   GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, selectable call
+   recording unlock, Magisk/DenyList-class path, DNS/hosts privacy helpers if
+   present on GOLDEN, F‑Droid/Aurora/launcher/gallery-class bundled apps,
+   userspace hardening/signing/AVB class, kernel update + hardening class),
+   **Then** no category is left as “decide / later” without an explicit
+   obsolescence or **deferred** note (WebView exception FR-015; banking
+   deferred FR-006/FR-007; localization hardening compare deferred FR-018).
 3. **Given** Git and host artifact policy, **When** inspected, **Then** no
    proprietary Phonesky APK bytes or secrets were committed.
 
@@ -165,22 +198,22 @@ behaviour; push notifications smoke for a known test app.
 
 ---
 
-### User Story 3 - Banking profile workflow parity (Priority: P1)
+### User Story 3 - Banking profile workflow parity (Priority: P3 — deferred)
 
-As the owner, I can recreate the GOLDEN banking layout on LAB: install via the
-same store path I use on AXP, place banks in Island, and keep banking apps
-free of root via Magisk DenyList-class hiding like GOLDEN.
+As the owner, **later** I can recreate the GOLDEN banking layout on LAB:
+Island + Magisk DenyList-class hiding + Swissquote/Yuh. This is explicitly
+**not** required to accept the AXP-on-LOS23 clone for functionalities,
+options, hardening, security, or kernel work.
 
-**Why this priority**: Compatibility hard gates; daily-driver without banks
-fails the resurrection.
+**Why this priority**: Owner (2026-09-17) — banking is a future personal
+problem; do not block the updated AXP clone on bank gates.
 
-**Independent Test**: Install Swissquote (hard gate) and attempt Yuh; run
-inside Island; Magisk DenyList (or AXP-equivalent) applied; record PASS/FAIL
-honestly vs GOLDEN.
+**Independent Test** *(when owner resumes)*: Install Swissquote and attempt
+Yuh; Island; Magisk DenyList; record PASS/FAIL honestly vs GOLDEN.
 
-**Acceptance Scenarios**:
+**Acceptance Scenarios** *(deferred — not ship gates)*:
 
-1. **Given** Island on LAB, **When** I follow the documented GOLDEN banking
+1. **Given** Island on LAB, **When** the owner follows the GOLDEN banking
    install order, **Then** Swissquote reaches a usable logged-in state in the
    managed profile.
 2. **Given** Yuh on the same workflow, **When** tested, **Then** either it
@@ -211,32 +244,38 @@ recording unlock off (restricted) and on (record allowed).
    with GOLDEN measurement, using the newest Magisk stable that works on this
    stack.
 2. **Given** Magisk setup completed on LAB, **When** DenyList-class hiding is
-   configured for a banking package, **Then** that package does not receive
-   root.
+   configured for a test package, **Then** that package does not receive root
+   (banking packages deferred with US3).
 3. **Given** selectable call recording unlock, **When** OFF, **Then** stock
    LOS country/carrier style restrictions apply; **When** ON, **Then** Dialer
    can record on LAB without that block.
 
 ---
 
-### User Story 5 - AXP usability, privacy, hardening (Priority: P2)
+### User Story 5 - AXP usability, options, hardening + kernel (Priority: P1)
 
-As the owner, the ROM ships the rest of the AXP usability/privacy surface and
-GOLDEN-class hardening/signing/AVB posture at newest workable stables, with
-LOS23 WebView default and an unlocked provider chooser.
+As the owner, the ROM ships the rest of the AXP usability/privacy surface,
+AXP-class options/settings behaviour, GOLDEN-class userspace hardening /
+signing / AVB posture, and an **updated LOS 23.2 sunfish kernel with
+attributable hardening** (AXP / Graphene / Divest class where still valid on
+non-GKI 4.14), at newest workable stables, with LOS23 WebView default and an
+unlocked provider chooser. Localization/location-hardening delta vs LOS is
+**out of scope for now** (FR-018 later).
 
-**Why this priority**: Completes resurrection beyond Google/banking/root core.
+**Why this priority**: Owner (2026-09-17) — this is the core of “clon
+actualizado de AXP”, ahead of banking.
 
 **Independent Test**: Package list vs `002`; open bundled apps; confirm
-default WebView is LOS and another WebView can be selected if installed;
-hardening/signing checks agreed for GOLDEN-class parity.
+default WebView is LOS; userspace hardening/signing checks; kernel version /
+hardening patch attribution recorded for the accepted build.
 
 **Acceptance Scenarios**:
 
 1. **Given** the `009` build, **When** I list bundled system/user apps in the
    AXP usability set, **Then** each GOLDEN/AXP category is present or
    explicitly marked impossible on Android 16/sunfish with rationale
-   (Aosmium absence is the allowed WebView exception).
+   (Aosmium absence is the allowed WebView exception; banking tools may ship
+   as packages without Gate E validation).
 2. **Given** Developer options, **When** I open WebView implementation,
    **Then** LOS23 WebView is available/default and the chooser is not locked
    against future alternate providers.
@@ -244,9 +283,13 @@ hardening/signing checks agreed for GOLDEN-class parity.
    FR-004) are recorded, **Then** each is newest stable that still runs on
    the ROM.
 4. **Given** GOLDEN/AXP hardening and signing expectations, **When** the
-   accepted build is evaluated, **Then** equivalent class of protections /
-   signing posture is present or each gap is documented as impossible on
-   this stack — not silently dropped.
+   accepted build is evaluated, **Then** equivalent class of userspace
+   protections / signing posture is present or each gap is documented as
+   impossible on this stack — not silently dropped.
+5. **Given** the LOS 23.2 sunfish kernel tree, **When** the accepted boot
+   image is built, **Then** it is an updated lineage/sunfish-compatible
+   kernel (not an unrelated prebuilt) with attributable hardening patches
+   applied or each skipped hardening item documented.
 
 ---
 
@@ -291,6 +334,9 @@ work when published.
   silently fall back to FakeStore.
 - Alternate WebView installed by user later: selection must remain possible;
   default remains LOS23 WebView until the user changes it.
+- Localization/location hardening: AXP historically more aggressive than LOS
+  in places the owner dislikes; **do not decide** AXP-vs-LOS location policy
+  in this feature’s acceptance — compare later (FR-018).
 
 ## Requirements *(mandatory)*
 
@@ -298,9 +344,11 @@ work when published.
 
 - **FR-001**: The project MUST produce a flashable LineageOS 23.2 / Android 16
   `sunfish` build that resurrects the AXP.OS on LOS22 / GOLDEN capability set
-  (including Magisk-class root and GOLDEN-class hardening / signing / AVB
-  posture), without leaving AXP capabilities as open “decide” omissions
-  except the WebView exception in FR-015.
+  (including Magisk-class root, GOLDEN-class userspace hardening / signing /
+  AVB posture, and an updated hardened sunfish kernel per FR-017), without
+  leaving AXP capabilities as open “decide” omissions except documented
+  exceptions/deferrals (WebView FR-015; banking FR-006/FR-007; localization
+  compare FR-018).
 - **FR-002**: Version selection for system and bundled components (except
   Phonesky per FR-004) MUST prefer the newest stable (or newest tagged
   pre-release upstream currently ships) that still works on sunfish /
@@ -316,10 +364,13 @@ work when published.
   microG + Phonesky path (owner-controlled toggle; default safe/off or
   project-documented default). Spoofing MUST remain restricted/controlled —
   not unrestricted platform spoofing for all apps.
-- **FR-006**: The ROM MUST support the GOLDEN managed-profile banking workflow
-  (Island as measured on GOLDEN) including Swissquote PASS as a hard gate.
-- **FR-007**: Banking applications MUST run without being granted root
-  (Magisk DenyList-class hiding).
+- **FR-006**: *(Deferred — owner future)* The ROM SHOULD support the GOLDEN
+  managed-profile banking workflow (Island as measured on GOLDEN) including
+  Swissquote PASS. This is **not** an acceptance gate for the AXP clone MVP.
+- **FR-007**: *(Deferred — owner future)* Banking applications SHOULD run
+  without being granted root (Magisk DenyList-class hiding). Magisk MUST still
+  provide DenyList-class capability for general use (FR-010); bank-specific
+  validation is deferred with FR-006.
 - **FR-008**: The ROM MUST include **selectable** AXP-equivalent call
   recording unlock (toggle; OFF = stock LOS restrictions, ON = unlock).
 - **FR-009**: The ROM MUST include the AXP usability/privacy bundled surface
@@ -329,12 +380,12 @@ work when published.
 - **FR-010**: The ROM MUST ship **Magisk** like GOLDEN: newest Magisk stable
   that works on this stack, in an AXP-like preinstalled but not fully
   activated layout (exact first-boot/setup behaviour measured from GOLDEN),
-  with DenyList-class hiding sufficient for FR-007. KernelSU is **out of
-  ship for now** (not the resurrection root path).
+  with DenyList-class hiding available. KernelSU is **out of ship for now**
+  (not the resurrection root path).
 - **FR-011**: The feature acceptance gate MUST include GOLDEN/AXP-class
-  hardening and signing / AVB posture (as applicable on LOS 23.2 / sunfish),
-  not only apps and Google compatibility. Gaps MUST be documented as
-  impossible on this stack rather than silently omitted.
+  userspace hardening and signing / AVB posture (as applicable on LOS 23.2 /
+  sunfish), not only apps and Google compatibility. Gaps MUST be documented
+  as impossible on this stack rather than silently omitted.
 - **FR-012**: Acceptance flashing MUST use LAB only; GOLDEN MUST remain
   unmodified by this feature's work.
 - **FR-013**: Each shipped capability MUST be attributable (what upstream or
@@ -354,6 +405,32 @@ work when published.
   Such reuse is **optional** (“si se puede, ok”), MUST NOT become an
   acceptance requirement for Magisk resurrection, and MUST NOT imply KernelSU
   is back in the ship path unless a future spec explicitly says so.
+- **FR-017**: The ship MUST use an **updated** LineageOS 23.2–compatible
+  `sunfish` kernel (current lineage/kernel_google_sunfish or project-tracked
+  equivalent — not an unrelated Graphene A13 / stock A13 prebuilt), with
+  **attributable kernel hardening** ported from AXP / Graphene / Divest where
+  still valid on non-GKI 4.14. Skipped items MUST be documented with rationale.
+- **FR-018**: *(Deferred research — look later)* Compare how AXP/GOLDEN
+  hardens or constrains **localization / location** (network location,
+  backends, permissions, privacy toggles) versus stock LineageOS 23 behaviour.
+  Owner historically finds AXP aggressive here; do **not** freeze a
+  clone-or-LOS policy in this feature’s acceptance until that comparison
+  exists. Default until then: do not silently invent extra location lockdown
+  beyond what the rest of the AXP clone already implies; record the open
+  question in the capability matrix.
+- **FR-019**: On a **final** shipping `009` image, owner MUST be able to
+  refresh bundled **system / privileged** packages by **sideload** (or the
+  documented Magisk-equivalent path) roughly every **2–3 months**, without
+  requiring a full ROM reflash for routine bumps of at least: **microG
+  (GmsCore / companions)**, **Magisk**, **project Phonesky**, and other
+  project-bundled system apps that the capability inventory treats as
+  updatable. Packaging MUST preserve PackageManager update eligibility
+  (matching signing identity; **PRESIGNED** where upstream expects
+  self-updates; project-key continuity for Phonesky). Magisk MAY use its
+  normal manager / boot-image update flow when APK-only sideload is
+  insufficient — that path MUST be documented in the recovery/sideload
+  runbook. This does **not** restore AXP external repos or OTA (still
+  forbidden); updates are owner-driven sideload / recovery packages.
 
 ### Key Entities
 
@@ -364,13 +441,16 @@ work when published.
   (resurrection target).
 - **Version pin record**: Documented package/component versions chosen for the
   accepted `009` build (newest workable stable each; Phonesky = project
-  artifact id/version).
+  artifact id/version; kernel rev + hardening patch list).
 - **Phonesky host artifact**: Project patched/signed Play APK and permission
   metadata kept outside Git on the build host.
 - **Magisk preinstall state**: Measured GOLDEN/AXP layout for Magisk present
   but not fully activated, plus LAB setup steps.
-- **LAB acceptance build**: Flashable image set + hashes + smoke/banking /
-  Magisk / hardening results for this feature.
+- **Hardened sunfish kernel**: Updated LOS23-compatible kernel build +
+  attributed hardening patch set for FR-017.
+- **LAB acceptance build**: Flashable image set + hashes + smoke / Magisk /
+  userspace+kernel hardening results for this feature (banking evidence
+  optional/deferred).
 
 ## Success Criteria *(mandatory)*
 
@@ -380,15 +460,16 @@ work when published.
   hardware smoke within the same session as flash (owner can place a call,
   use Wi‑Fi, and unlock the device).
 - **SC-002**: 100% of AXP resurrection capability categories from the agreed
-  inventory are either demonstrated on LAB or explicitly documented as
-  impossible on Android 16/sunfish — zero silent omissions (WebView exception
-  allowed only as FR-015).
+  inventory are either demonstrated on LAB, marked deferred (banking,
+  localization compare), or explicitly documented as impossible on Android
+  16/sunfish — zero silent omissions (WebView exception allowed only as
+  FR-015).
 - **SC-003**: With spoofing enabled as required, microG Self-Check required
   items and project Phonesky open/install succeed on LAB for ordinary apps on
   the first accepted build candidate (or within one documented fix iteration).
-- **SC-004**: Swissquote managed-profile + Magisk DenyList-class workflow
-  PASSes on LAB; Yuh result is recorded and is not worse than GOLDEN for
-  packaging/spoofing reasons.
+- **SC-004**: *(Deferred with US3)* Swissquote managed-profile + Magisk
+  DenyList-class workflow PASSes on LAB when owner resumes banking; not
+  required for AXP-clone MVP acceptance.
 - **SC-005**: Every bundled/system app version in the acceptance record
   (except Phonesky) is newer than or equal to GOLDEN's measured version,
   unless a newer release was tried and failed with a written regression note;
@@ -399,7 +480,16 @@ work when published.
   can be fully activated on LAB using documented steps measured from GOLDEN.
 - **SC-008**: Default WebView is LOS23's; provider selection remains available.
 - **SC-009**: Owner can perform the GOLDEN-equivalent daily checklist on LAB
-  without consulting a scatter of conflicting feature specs for what “ships”.
+  **excluding deferred banking** without consulting a scatter of conflicting
+  feature specs for what “ships”.
+- **SC-010**: Accepted build records kernel revision + hardening attribution
+  list (applied / skipped+why) satisfying FR-017.
+- **SC-011**: Acceptance docs list, for each FR-019 component, the intended
+  update channel (sideload APK / recovery zip / Magisk self-update) and confirm
+  signing identity is not broken by packaging (PRESIGNED or project key as
+  applicable). Full 2–3 month refresh drill MAY wait until a final ROM
+  candidate; packaging regressions that block updates MUST be fixed before
+  ship.
 
 ## Assumptions
 
@@ -408,11 +498,12 @@ work when published.
 - GOLDEN inventory (`002`) plus AXP Pro docs are sufficient to enumerate the
   capability set; live `adb` re-query of GOLDEN is allowed (especially Magisk
   preinstall/activation details).
-- “AXP resurrection” means Magisk + GOLDEN-class hardening/signing/AVB + full
-  AXP user surface on LOS23, with only the stated WebView and Phonesky-artifact
-  exceptions.
-- Island remains the managed-profile tool because that is what GOLDEN
-  actually runs (AXP docs saying “Insular” are historical naming).
+- “AXP resurrection” / updated clone means Magisk + GOLDEN-class userspace
+  hardening/signing/AVB + AXP user/options surface + updated hardened kernel
+  on LOS23, with WebView, Phonesky-artifact, banking-deferral, and
+  localization-compare exceptions as stated.
+- Island / banking validation is owner-future; shipping Island as a bundled
+  app is optional and does not imply Gate E.
 - FakeStore is never the primary Play path.
 - Selectable spoofing and selectable call recording follow the same class of
   Developer Options UX already explored in `005`/`008` runbooks where useful.
@@ -424,3 +515,10 @@ work when published.
 - Prior KernelSU LAB experiments (including the two functional kernels already
   built) are **out of ship for now** but kept as recyclable assets: reuse if
   helpful, never required for Magisk acceptance.
+- Localization hardening AXP-vs-LOS comparison is intentionally postponed
+  (FR-018); do not block MVP on it.
+- No AXP-style OTA or external repos; periodic system-package refresh is
+  **owner sideload** (FR-019), not a network updater in the ROM.
+- microG stays PRESIGNED / replace-prebuilt so same-signer updates remain
+  possible; Phonesky stays on the project signing key across releases;
+  Magisk update docs cover manager + any boot re-patch when needed.