# Contract: Spoofing surface (LAB / user-visible)

## Settings

| Interface | Contract |
|-----------|----------|
| Secure setting | `allow_signature_fake` ∈ {`null`/`0`, `1`} |
| Readback | `adb shell settings get secure allow_signature_fake` |
| UI | Developer Options exposes enable/disable; OFF disables effect of grants |

## Permission

| Interface | Contract |
|-----------|----------|
| Permission name | `android.permission.FAKE_PACKAGE_SIGNATURE` |
| `pm list permissions` | Permission is listed (not “Unknown permission”) |
| Grant | Visible in `dumpsys package <pkg>` for authorized packages when user granted |

## PackageManager behaviour

When **toggle ON** and package **has grant** and **has** `meta-data fake-signature`
(or microG’s equivalent spoof path):

- Callers using legacy signature APIs and signing-certificate APIs MUST observe
  the faked Google identity for that package (sufficient for microG Self-Check
  “correct signature” and Play OAuth registration checks).

When **toggle OFF**:

- Effective spoofing MUST NOT occur (silent deny).

## Allow-list

| Package | Required |
|---------|----------|
| `com.google.android.gms` | yes |
| `com.android.vending` | yes |
| Other packages | denied unless explicitly added later under project policy |

## First-stack package registration

| Package | `pm path` expectation |
|---------|----------------------|
| `com.google.android.gms` | system_ext app path |
| `com.google.android.gsf` | system_ext app path |
| `com.android.vending` | system priv-app Phonesky path |

PRESIGNED APKs in the shipped image MUST verify with APK Signature Scheme v2/v3
(no post-sign strip).

## Location (documentation contract)

Quickstart MUST specify:

1. Open microG → Location  
2. Enable network/Wi-Fi location as required by UI  
3. Set service URL to BeaconDB (or documented successor), not MLS  

No requirement to install UnifiedNlp backend packages.