009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

specs/009-axp-los23-port/tasks.md

@@ -0,0 +1,339 @@
+# Tasks: AXP LOS22 feature port to LOS23 (resurrection)
+
+**Input**: Design documents from `/specs/009-axp-los23-port/`  
+**Prerequisites**: `plan.md`, `spec.md`, `research.md`, `data-model.md`,
+`contracts/`, `quickstart.md`; constitution Magisk-resurrection track;
+standby KernelSU track (`004`–`008`/`007`) remains untouched
+
+**Tests**: LAB acceptance only (Gates A–G in `contracts/acceptance-gates.md`).
+No unit/contract TDD suite requested — validation tasks are adb/flash checks.
+
+**Organization**: Setup → Foundational → US1 / US2 / US4 / US5 (MVP) → US6 →
+Polish. **US3 banking is deferred (P3)** — skip for MVP. US5 includes
+**kernel update + hardening** (FR-017). Localization AXP-vs-LOS (FR-018) =
+look later, not a ship gate. Full US1 Independent Test needs US2+US4+US5
+(not banking).
+
+## Format: `[ID] [P?] [Story] Description`
+
+- **[P]**: Can run in parallel (different files, no incomplete deps)
+- **[Story]**: US1…US6 from `spec.md`
+- Include exact file paths in descriptions
+
+## Path conventions
+
+- Meta repo: `vendor/sunfish-a16/`, `docs/`, `specs/009-axp-los23-port/`
+- Build host: `/srv/rom/src/lineage/`, `/srv/rom/prebuilts/`,
+  `/srv/rom/artifacts/009-axp-los23-port/`, `/srv/rom/secrets/`
+- LAB: `11231JEC207477` only — never GOLDEN flash/modify
+- GOLDEN: `adb` read-only oracle (esp. Magisk preinstall layout)
+
+---
+
+## Phase 1: Setup (Shared Infrastructure)
+
+**Purpose**: Host dirs, runbook stubs, capability inventory scaffold
+
+- [x] T001 Create host dirs `/srv/rom/prebuilts/{magisk,axp-apps}/`,
+      `/srv/rom/artifacts/009-axp-los23-port/`, `/srv/rom/logs/009-build/`
+      on `rom-dev01` (android-build writable)
+- [x] T002 [P] Add stub `docs/009-magisk-preinstall-runbook.md` (GOLDEN
+      measure checklist, activation steps, DenyList banking order, LAB serial)
+- [x] T003 [P] Add stub `docs/009-version-pins.md` (VersionPinRecord table:
+      component / version_name / version_code / upstream_ref / policy /
+      verified_on)
+- [x] T004 [P] Add stub `docs/009-capability-matrix.md` mapping
+      `docs/002-golden-inventory.md` + `docs/axp-pro-parity.md` rows →
+      `required` / `exception` / `impossible` per `data-model.md`
+      AxpCapabilitySet
+- [x] T005 [P] Create `vendor/sunfish-a16/patches/009-axp-los23-port/README.md`
+      (Magisk-resurrection apply order; reuse `005`/`008`; no KernelSU ship;
+      attribute upstreams)
+
+**Checkpoint**: Dirs + stubs exist; no bacon yet
+
+---
+
+## Phase 2: Foundational (Blocking Prerequisites)
+
+**Purpose**: Freshness policy, GOLDEN Magisk measurement, product wiring
+baseline — MUST complete before story packages land on LAB acceptance builds
+
+**⚠️ CRITICAL**: Blocks user-story packaging/flash acceptance
+
+- [x] T006 Refresh microG + GSF to newest stable upstream (fetch tags /
+      releases; no stale host cache) into `/srv/rom/prebuilts/microg/` +
+      `VERSIONS.txt`; record pins in `docs/009-version-pins.md`
+- [x] T007 [P] Confirm project patched Phonesky still present under
+      `/srv/rom/prebuilts/phonesky/` + XMLs; record artifact id in
+      `docs/009-version-pins.md` (`policy=project_phonesky`); halt note if
+      GOLDEN-class gap suspected
+- [x] T008 [P] Fetch newest Magisk stable that targets this stack into
+      `/srv/rom/prebuilts/magisk/` + `VERSIONS.txt`; record pin in
+      `docs/009-version-pins.md`
+- [x] T009 Measure GOLDEN Magisk/Magia preinstall layout via `adb` only
+      (paths, packages, first-boot/setup UX) and write results into
+      `docs/009-magisk-preinstall-runbook.md` (FR-010 / contracts/
+      magisk-preinstall.md)
+- [x] T010 Fill `docs/009-capability-matrix.md` for all GOLDEN/AXP categories
+      (google-stack, spoofing, call-rec, Magisk, bundled apps, DNS/hosts,
+      userspace hardening/signing/AVB, **kernel hardening**, WebView=exception,
+      banking=deferred, localization=deferred FR-018); zero silent omissions
+- [x] T011 Wire Magisk-resurrection product includes in
+      `vendor/sunfish-a16/` (extend `gms.mk` / add `magisk.mk` or equivalent;
+      keep Phonesky priv-app path; **no FakeStore**; **no KernelSU** product
+      packages) and document include hook in
+      `vendor/sunfish-a16/patches/009-axp-los23-port/README.md`
+- [x] T012 Confirm `003` vanilla (or documented equivalent) known-good
+      baseline is available for LAB clean-flash acceptance; note rev in
+      `docs/009-version-pins.md` VanillaBaseline row
+- [x] T013 [P] Confirm optional `007` kernel artifacts remain on host under
+      `/srv/rom/artifacts/007-*/` for FR-016 recycle only; list paths in
+      `docs/009-magisk-preinstall-runbook.md` as non-ship
+
+**Checkpoint**: Prebuilts fresh, Magisk UX measured, product wire documented —
+story work can begin
+
+---
+
+## Phase 3: User Story 1 — AXP resurrection daily-driver on LAB (Priority: P1) 🎯 MVP framing
+
+**Goal**: One flashable `009` composition path and Gate A smoke; full
+daily-driver Independent Test completes after US2+US4+US5 (banking deferred)
+
+**Independent Test**: Flash one `009` build to LAB; walk GOLDEN checklist
+**minus banking** from `docs/009-capability-matrix.md`
+
+### Implementation for User Story 1
+
+- [x] T014 [US1] Define staged known-good image policy in
+      `docs/009-magisk-preinstall-runbook.md` (retain prior LAB image hashes
+      under `/srv/rom/artifacts/009-axp-los23-port/<build-id>/` per FR-013)
+- [ ] T015 [US1] Add LAB flash/acceptance checklist linking Gates A–G to
+      `specs/009-axp-los23-port/quickstart.md` and
+      `contracts/acceptance-gates.md` (artifact subdirs `gate-a/`…`gate-g/`)
+- [ ] T016 [US1] Produce first Magisk-track bacon on `rom-dev01` (detached
+      `/srv/rom/artifacts/bin/rom-detach` / tmux) with current wired packages;
+      logs under `/srv/rom/logs/009-build/`; images + SHA-256 under
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/`
+- [ ] T017 [US1] Clean-flash LAB `11231JEC207477` only; complete Gate A
+      (boot/home/call/Wi‑Fi/unlock); save `getprop` + notes under
+      `…/<build-id>/gate-a/`
+- [ ] T018 [US1] After US2+US4+US5 land, re-flash accepted candidate and mark
+      SC-001…SC-003 + SC-005…SC-010 / Gates A–D + F–G in
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/acceptance.md`
+      against `docs/009-capability-matrix.md` (skip Gate E / SC-004)
+- [ ] T019 [US1] Verify Git/meta-repo contains no proprietary Phonesky APK
+      bytes or secrets; document check in
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/acceptance.md`
+
+**Checkpoint**: Gate A proven; full US1 Independent Test after US2+US4+US5
+
+---
+
+## Phase 4: User Story 2 — Google stack: newest microG + project Phonesky (Priority: P1)
+
+**Goal**: Newest microG/GSF + project Phonesky + selectable restricted spoofing
+
+**Independent Test**: microG Self-Check; Phonesky open/install; spoofing
+OFF/ON per `contracts/toggles-surface.md`
+
+### Implementation for User Story 2
+
+- [ ] T020 [P] [US2] Ensure `vendor/sunfish-a16/gms.mk` +
+      `vendor/sunfish-a16/Android.mk` package refreshed microG/GSF + Phonesky
+      without FakeStore; privilege XMLs remain under
+      `vendor/sunfish-a16/permissions/` and
+      `vendor/sunfish-a16/default-permissions/`
+- [ ] T021 [P] [US2] Re-apply / verify selectable signature spoofing via
+      `vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py` on LOS
+      23.2 tree; document A16 deltas in `docs/005-spoofing-runbook.md` (or
+      `docs/009-magisk-preinstall-runbook.md` cross-link)
+- [ ] T022 [US2] Build+flash LAB image including Google stack; run Gate B
+      (Self-Check, Phonesky open, ordinary app install/update); evidence under
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/gate-b/`
+- [ ] T023 [US2] Verify Secure key `allow_signature_fake` OFF/ON behaviour per
+      `contracts/toggles-surface.md`; record in
+      `…/<build-id>/gate-c/spoofing.md`
+- [x] T024 [US2] Finalize microG/GSF/Phonesky rows in `docs/009-version-pins.md`;
+      if Phonesky lacks GOLDEN-class daily fix → FAIL closed note in
+      `…/<build-id>/gate-b/phonesky-halt.md` (do not accept)
+
+**Checkpoint**: Gate B + spoofing half of Gate C pass (or explicit Phonesky halt)
+
+---
+
+## Phase 5: User Story 3 — Banking (Priority: P3 — deferred)
+
+**Goal**: Island + Magisk DenyList banking — **owner future; not MVP**
+
+**Independent Test**: *(when resumed)* Swissquote in Island; Yuh honest; no root
+
+### Deferred tasks (do not block acceptance)
+
+- [ ] T025 [P] [US3] *(Deferred)* Stage Island under
+      `/srv/rom/prebuilts/axp-apps/` and wire into `vendor/sunfish-a16/` if
+      desired as optional package; pin in `docs/009-version-pins.md`
+- [ ] T026 [US3] *(Deferred)* Document GOLDEN banking order in
+      `docs/009-magisk-preinstall-runbook.md`
+- [ ] T027 [US3] *(Deferred)* Swissquote Gate E under
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/gate-e/swissquote/`
+- [ ] T028 [US3] *(Deferred)* Yuh classify in `…/gate-e/yuh.md`
+- [ ] T029 [US3] *(Deferred)* Banks lack root note in `…/gate-e/root-check.md`
+
+**Checkpoint**: Skipped for MVP — resume only when owner asks
+
+---
+
+## Phase 6: User Story 4 — Magisk like GOLDEN + selectable call recording (Priority: P1)
+
+**Goal**: Magisk AXP-like preinstall + DenyList; selectable call-rec unlock
+
+**Independent Test**: Preinstall state vs GOLDEN notes; activation; DenyList
+test app; call-rec OFF/ON
+
+### Implementation for User Story 4
+
+- [ ] T030 [US4] Implement Magisk AXP-like preinstall packaging from
+      `/srv/rom/prebuilts/magisk/` into `vendor/sunfish-a16/magisk.mk` (or
+      equivalent) matching `docs/009-magisk-preinstall-runbook.md` measured
+      layout (`contracts/magisk-preinstall.md`)
+- [ ] T031 [P] [US4] Re-apply / verify selectable call-rec unlock via
+      `vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py`
+      (`extendrom_call_recording`); keep default OFF; optional FLAG_SECURE
+      not required for AXP acceptance — document in
+      `docs/008-call-rec-flag-secure-runbook.md`
+- [ ] T032 [US4] Build+flash LAB; document pre-activation Magisk state vs
+      GOLDEN under `…/<build-id>/magisk/pre-activation.md` (Gate D)
+- [ ] T033 [US4] Complete Magisk activation on LAB per runbook; configure
+      DenyList-class hide for a **test** package (not bank gate); save version +
+      screenshots under `…/<build-id>/magisk/`
+- [ ] T034 [US4] Verify `extendrom_call_recording` OFF = stock restrictions,
+      ON = Dialer can record; evidence under
+      `…/<build-id>/gate-c/call-rec.md`
+- [ ] T035 [US4] Record Magisk version pin (newest workable stable) in
+      `docs/009-version-pins.md`
+
+**Checkpoint**: Gates C (call-rec) + D pass
+
+---
+
+## Phase 7: User Story 5 — Usability, options, hardening + kernel (Priority: P1)
+
+**Goal**: Bundled AXP surface; LOS23 WebView; userspace hardening/signing;
+**updated hardened sunfish kernel** (FR-017). Localization compare = later.
+
+**Independent Test**: Packages vs matrix; WebView LOS; Gate G userspace +
+kernel attribution (SC-010)
+
+### Implementation for User Story 5
+
+- [ ] T036 [P] [US5] Enumerate bundled usability packages from
+      `docs/009-capability-matrix.md` (Aurora, F-Droid/repos as on GOLDEN,
+      launcher/gallery-class, DNS/hosts helpers if required); stage newest
+      workable APKs under `/srv/rom/prebuilts/axp-apps/`
+- [ ] T037 [US5] Wire bundled apps into `vendor/sunfish-a16/` product
+      makefiles; pin all versions in `docs/009-version-pins.md`
+- [ ] T038 [P] [US5] Verify WebView policy: no Aosmium; default LOS23
+      provider; chooser unlocked — document in
+      `…/<build-id>/gate-f/webview.md` per `contracts/webview-surface.md`
+- [ ] T039 [US5] Build+flash LAB; confirm bundled categories present or
+      marked impossible/deferred in `docs/009-capability-matrix.md`; Gate F
+      evidence under `…/<build-id>/gate-f/`
+- [x] T040 [US5] Define staged userspace hardening/signing/AVB checklist in
+      `docs/009-hardening-signing-checklist.md` (GOLDEN vs LAB measured
+      2026-09-29; release keys yes / bootloader lock wont; stages US-S0…S6)
+- [ ] T041 [US5] Implement first attributable userspace hardening/signing
+      stage under `vendor/sunfish-a16/patches/009-axp-los23-port/` (US-S1
+      keygen + US-S2 wire); keep known-good prior image
+      (`20260929T123401Z-axp-stage1-combo4`)
+- [ ] T042 [US5] Inventory LOS23 sunfish kernel tree on `rom-dev01`
+      (`/srv/rom/src/lineage/kernel/google/sunfish` or manifest path); record
+      baseline rev in `docs/009-version-pins.md`
+- [ ] T043 [US5] Build attributable kernel hardening patch list (AXP /
+      Graphene / Divest → 4.14-safe) in
+      `docs/009-kernel-hardening-map.md` (applied vs skip+why)
+- [ ] T044 [US5] Apply first kernel hardening stage on LOS23 sunfish kernel;
+      rebuild boot; flash LAB; evidence under `…/<build-id>/gate-g/kernel/`
+- [ ] T045 [US5] Run Gate G userspace+kernel on accepted candidate; gaps in
+      `…/<build-id>/gate-g/gaps.md`; **do not** block on FR-018 localization
+- [x] T046 [P] [US5] *(Look later — FR-018)* Stub only:
+      `docs/009-localization-axp-vs-los.md` outlining what to compare later
+      (AXP location lockdown vs stock LOS); no policy decision in MVP
+- [ ] T046a [P] [US5] *(FR-019 — before final ship)* Write
+      `docs/009-sideload-system-updates.md`: how to refresh microG, Magisk,
+      Phonesky, and other system apps every ~2–3 months without full reflash
+      (signing identity / PRESIGNED / Magisk manager+boot path); verify
+      packaging does not break update eligibility
+
+**Checkpoint**: Gates F + G (userspace + kernel) for claimed stage; FR-018 stub
+only; FR-019 runbook before final ship
+
+---
+
+## Phase 8: User Story 6 — Parallel tracks stay honest (Priority: P2)
+
+**Goal**: Docs/branches make Magisk `009` active vs KernelSU standby clear
+
+**Independent Test**: `specs/004`–`008`/`007` still present; `009` does not
+retire standby track
+
+### Implementation for User Story 6
+
+- [ ] T047 [P] [US6] Update `docs/README.md` (and `AGENTS.md` if needed) to
+      state active Magisk-resurrection track = `009` / this repo; standby
+      KernelSU = sibling `sunfish-a16-rom` + specs `004`–`008`/`007`
+- [ ] T048 [P] [US6] Add short track note to
+      `specs/009-axp-los23-port/spec.md` only if needed (do **not** rewrite
+      standby feature specs)
+- [ ] T049 [US6] Remap relevant `docs/axp-pro-parity.md` rows to `009`
+- [ ] T050 [US6] Confirm `specs/001`–`008`/`007` directories still exist; record in
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/acceptance.md`
+- [ ] T051 [P] [US6] Document optional FR-016 KSU recycle (non-ship) in
+      `docs/009-magisk-preinstall-runbook.md` + `docs/007-kernelsu-runbook.md`
+      cross-link
+
+**Checkpoint**: Parallel-track honesty readable without rewriting history
+
+---
+
+## Phase 9: Polish & Cross-Cutting Concerns
+
+**Purpose**: Freshness audit, quickstart validation, handoff
+
+- [ ] T052 [P] Audit all `docs/009-version-pins.md` rows against freshness
+      policy; fix stale host copies if found
+- [ ] T053 [P] Run `specs/009-axp-los23-port/quickstart.md` on LAB
+      (**skip Gate E**); fix doc gaps
+- [ ] T054 Collect final artifacts under
+      `/srv/rom/artifacts/009-axp-los23-port/<build-id>/`
+- [ ] T055 [P] Add/update `docs/009-gate-handoff.md` (next: banking later;
+      localization compare FR-018 later; sideload refresh cadence FR-019)
+- [ ] T056 Mark `specs/009-axp-los23-port/spec.md` Status after Gates A–D +
+      F–G
+
+---
+
+## Dependencies & Execution Order
+
+### MVP order (owner 2026-09-17)
+
+1. Setup + Foundational
+2. US2 Google stack
+3. US4 Magisk + call-rec
+4. US5 usability + **hardening + kernel**
+5. US1 full acceptance (T018) **without banking**
+6. US6 docs
+7. *(Later)* US3 banking + FR-018 localization compare
+
+### Suggested MVP scope
+
+**T001–T024 + T030–T046** (skip T025–T029)
+
+## Notes
+
+- Banking Gate E / T025–T029 = deferred (owner future)
+- Kernel hardening = in-scope (FR-017); localization policy = later (FR-018)
+- LAB only; never flash GOLDEN
+- Long builds detached on `rom-dev01`
+- Owner handles git commit / push / MR