# IntelliRAT v0.2

Systemless Magisk controller for automatic, reversible Android 16
network-profile changes. It does not modify `/system`, `/system_ext`, `/vendor`,
RIL, modem firmware or framework.

## Scope

- Backend: Android 16 `cmd phone set-allowed-network-types-for-users`.
- Target: one slot at a time, default slot `0`.
- HIGH: LTE + UMTS/HSPA + GSM families.
- LOW: UMTS/HSPA + GSM families.
- Safety: capture/restore, active-call refusal, result verification and event log.
- No Xposed or Vector. The companion APK source is included under `app/`; the
  module zip includes it only after the AOSP app build produces
  `system/app/IntelliRAT/IntelliRAT.apk`.

The binary masks are derived from the LOS23/A16 `TelephonyManager` constants:
network type bits are `1 << (NETWORK_TYPE - 1)`, with LTE CA normalized to LTE.
They must be treated as target-build data, not a universal Qualcomm constant.

## Install on GOLDEN only

Do not install this in the production ROM or on LAB yet. Build a Magisk module
zip with `scripts/build-intellirat-module.sh`, install it on GOLDEN with a test SIM, and keep the
known-good ROM available. GOLDEN now detects the inserted test SIM as
`LOADED` on `SIMon mobile`.

After Magisk loads the module:

```text
su -g 2000 -G 2000 -c /system/bin/intellirat status 0
su -g 2000 -G 2000 -c /system/bin/intellirat capture 0
su -g 2000 -G 2000 -c /system/bin/intellirat --dry-run high 0
su -g 2000 -G 2000 -c /system/bin/intellirat high 0
su -g 2000 -G 2000 -c /system/bin/intellirat status 0
su -g 2000 -G 2000 -c /system/bin/intellirat low 0
su -g 2000 -G 2000 -c /system/bin/intellirat restore 0
```

`capture` must be run before a transition. `restore` uses the captured user
mask and does not guess a stock mode. `events.log` is stored under
`/data/local/tmp/intellirat/`. The prototype uses the root-owned `shell` group
for this small network-mask state because MagiskSU drops DAC capabilities for
`su` commands; no credentials or private data are stored.

When the companion APK is present, launch **IntelliRAT** from the app drawer.
It shows the current backend result, slot selector, automatic toggle, delay,
foreground-package exceptions, capture/HIGH/LOW/restore buttons and a
persistent status notification with quick actions. The automatic policy uses
lock delay, unlock restoration and a safe call guard.

## Not implemented yet

- traffic protection
- multi-SIM/eSIM UI and subscription discovery
- Quick Settings tile

The current automatic policy is deliberately limited to Keyguard lock state, a
configurable delay and explicit foreground-package exceptions. Wi-Fi, battery,
traffic and multi-SIM rules remain disabled until their real device behavior is
specified and tested with calls, IMS, SMS, data and signal loss.