# Android 15 (AXP GOLDEN) → Android 16 (LOS 23.2) — developer delta

Living notes for porting **AXP / GrapheneOS ideas** onto our base without
blind copy. Non-normative until a row is promoted into a feature `spec.md`.

| Ours (LAB target) | GOLDEN (oracle) |
|-------------------|-----------------|
| LineageOS **23.2** / Android **16** | AXP Pro / LOS-derived **22.2** / Android **15** |
| `BUILD_ID=BP4A.251205.006`, SDK **36** tree | SDK **35**, `ro.build.version.release=15` |
| Device: sunfish (same silicon) | sunfish |

**Working rule (owner):** prefer AXP A15 scheme when still valid; if A16 is
easier, use it; if harder, redesign the *path* to the **same end state**.

---

## 1. Already measured on this project

| Area | A15 / AXP behaviour | A16 / LOS 23.2 reality | Adaptation |
|------|---------------------|------------------------|------------|
| Phonesky on `/system/priv-app` | Works on GOLDEN | `artifact_path_requirements` / `generic_system.mk` rejects device-specific `system/` installs unless allow-listed | Keep AXP path; `PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST` (`004`) — do **not** move to `product` only to silence the check |
| GmsCore / Gsf on `system_ext` app | GOLDEN layout | Builds clean (no artifact hit) | Keep |
| Priv-app XML for GmsCore | GOLDEN: not priv-app | Inventing `privapp-permissions-microg` diverges | Removed; add only if Self-Check proves need |
| Super partition headroom | AXP fuller image fits their budgets | Vanilla LOS ERROR_LIMIT too tight for fat microG+Play | Modest `BOARD_SUPER_PARTITION_ERROR_LIMIT` bump — not ABI-strip of official microG |
| Play targetSdk / apktool | Older Play on GOLDEN (50.x) | Latest Play ~52.x needs apktool 2.12 + `ANDROIDSDK=35+`, zipalign-before-sign | Documented in `004` runbook |
| PRESIGNED prebuilt APKs | AXP ships Play/microG with intact v2/v3 | `BUILD_PREBUILT` uncompresses JNI / realigns → strips APK Sig v2/v3; PM skips Phonesky (`pm path` empty) | `LOCAL_REPLACE_PREBUILT_APK_INSTALLED` for GmsCore/Gsf/Phonesky (`004`, measured 2026-09-15) |
| Phonesky privapp allowlist | AXP XML for older Play | Play 52.x on A16 requests `HIDE_STATUS_BAR_NOTIFICATION` + `READ_SYSTEM_GRAMMATICAL_GENDER`; missing → boot abort on userdebug | Extend `privapp-permissions-com.android.vending.xml` |
| Signature spoofing | EXTENDROM: `allow_signature_fake` + `FAKE_PACKAGE_SIGNATURE` + Settings toggle; grants on gms+vending; A15 STABLE | LOS 23.2 **already** has LuK1337 allow-list spoof (`ComputerEngine` `23c0a5c`): userdebug + microG signer + Google fake-sig + `signingInfo`. Missing vs AXP: no `FAKE_PACKAGE` perm/UI; **rejects project-signed Phonesky** | Feature **`005`**: extend signer allow-list for our Phonesky JKS; port EXTENDROM toggle + `FAKE_PACKAGE_SIGNATURE`; see `docs/005-spoofing-runbook.md` |

---

## 2. Partition / packaging (porter mindset)

- AOSP has been tightening **system vs system_ext vs product** for years; A16
  builds (especially with `generic_system.mk`) make “drop OEM APKs on system”
  a **build-time** problem, not only a policy preference.
- **Privapp-permissions must live on the same partition as the priv-app**
  (AOSP rule since product partition work). Moving Phonesky later ⇒ move XMLs
  with it.
- `system_ext` remains the natural home for ROM Google-compat substitutes
  (AXP: microG, F-Droid, Aurora base) — still valid on A16.
- Prefer **allow-list exception** or **system_ext/product** over rewriting the
  whole AXP layout when GSI rules bite.

---

## 3. Compatibility stack (microG / Play / spoofing)

| Topic | Note for A16 |
|-------|----------------|
| microG | Use **current** upstream; do not pin GOLDEN 0.3.15. Keep official signer for F-Droid. |
| Phonesky | Still patch via AXP `patch-playstore`; newer Play = newer apktool/SDK framework. |
| Signature spoofing | **Done in `005`:** extend LuK1337 allow-list for project Phonesky JKS; port EXTENDROM toggle + `FAKE_PACKAGE_SIGNATURE`. LAB US6 green 2026-09-15. |
| Phonesky FGS / exact-alarm | A16 `systemExempted` needs manifest `USE_EXACT_ALARM` (or SCHEDULE / VPN), not only privapp XML. Fixed in Phonesky rebuild; vendor prebuilt updated. |
| FakeStore | Still forbidden next to real Phonesky. |

---

## 4. Attestation / KeyMint / banking (`006`/`007`)

- GOLDEN already shows **KeyMint / RKP / TEE** stress with Yuh on **A15**.
- A16 does not remove that class of problem; RKP and attestation surfaces
  continue to evolve — treat GrapheneOS/AOSP docs as *what* to measure, LOS+LAB
  as *where* to measure.
- Magisk DenyList on GOLDEN ≠ our root plan. Production root = **KSU-Next +
  SusFS** (`007`). Do not port Magisk-shaped packaging into `004`.

---

## 5. GrapheneOS on Android 16 (reference, not base)

- GOS ported features to A16; publicly noted **harder** device-support work
  because AOSP dropped much Pixel board/userspace publishing with 16.
- For **sunfish** we stay on **LOS 23.2 device trees**, not GOS device bringup.
- Use modern GOS as reference for **hardening / privacy behaviour** patches
  (`013`, hardening backlog) — classify each patch: direct / port / obsolete /
  A16-incompatible (same discipline as `reference-sources.md`).
- Never treat historical GOS **A13 sunfish** kernel as A16 base.

---

## 6. Call recording / FLAG_SECURE / UX (`008`+)

- AXP overlays and older XML toggles often **break or no-op** across major
  releases. On A16: re-find Dialer/Telecom/framework hooks in LOS 23.2 first;
  then decide AXP vs EXTENDROM vs iodé vs native LOS.
- Screenshot / sensitive-content APIs continue to tighten — verify before
  porting FLAG_SECURE bypasses.

---

## 7. Checklist before applying an AXP or GOS change on A16

1. What problem does it solve on GOLDEN / in GOS docs?  
2. Does LOS 23.2 already provide an equivalent?  
3. Partition + artifact-path impact?  
4. Same-signer / update path impact (microG, Phonesky)?  
5. Kernel 4.14 / sunfish EOL constraints?  
6. If blocked: document blocker; redesign route; **same end state**.

---

## 8. Open follow-ups (fill as we hit them)

- [x] Exact LOS 23.2 spoofing surface for `005` — stock LuK1337 path + our
      `SUNFISH_A16_005_SIGSPOOF` extension (2026-09-15); runbook
      `docs/005-spoofing-runbook.md`
- [ ] Whether A16 needs any microG permission XML AXP ships outside privapp
- [ ] RKP/KeyMint behaviour on LAB after `004` (compare to `002` Yuh logs)
- [ ] Call-recording hook locations on LOS 23.2 Dialer
- [ ] Which GOS A16 hardening patches are realistic on sunfish 4.14

## 9. EXTENDROM A15 → A16 mapping (`005`)

| EXTENDROM A15 patch | LOS 23.2 action |
|---------------------|-----------------|
| `02`/`06` ComputerEngine FAKE + gate | **Adapt** existing LuK1337 `generateFakeSignature`; add toggle + permission + Phonesky signer |
| `01`/`12` api current + lint | Applied |
| `07` AndroidManifest permission | Applied |
| `03` PermissionMapping | Applied (`.kt` path) |
| `04` Activity requestPermissions | Applied (A16 short-circuit path context) |
| `05` Settings.Secure.ALLOW_SIGNATURE_FAKE | Applied |
| `08`–`11` Settings Developer Options | Applied (controllers + XML + strings) |
| Overlay strings | Inlined into frameworks/Settings `strings.xml` |

Source checkout: `/srv/rom/references/extendrom` @ `f129253c07e735a373441254457cf75efac11d04`.

Update this file when a delta is **measured** (build error, Self-Check, adb),
not from blog speculation alone.