# Implementation Plan: Restricted native signature spoofing

**Branch**: `005-restricted-signature-spoofing` | **Date**: 2026-09-15 | **Spec**: [spec.md](./spec.md)

**Input**: Feature specification from `/specs/005-restricted-signature-spoofing/spec.md`

## Summary

Deliver the **first working Google-compat stack on LAB**: finish `004` packaging
gates (PRESIGNED replace + Play FGS privapp), add **AXP/EXTENDROM-style
restricted signature spoofing** (Developer Options `allow_signature_fake` +
`FAKE_PACKAGE_SIGNATURE` + allow-list for microG + Phonesky), validate Play auth
/ Self-Check, and document **modern** microG location (BeaconDB). Do **not**
pull `006` banking or `007` root into this phase.

Primary technical approach: attribute patches from
[EXTENDROM_SIGNATURE_SPOOFING](https://github.com/sfX-android/android_vendor_extendrom/wiki/EXTENDROM_SIGNATURE_SPOOFING)
(A15 proven on GOLDEN) and port to **Android 16 / LOS 23.2**, ensuring both
legacy `PackageInfo.signatures` and modern `signingInfo` are spoofed.

## Technical Context

**Language/Version**: Android frameworks Java/Kotlin patches; Settings overlays;
`Android.mk` / product makefiles; bash runbooks on `rom-dev01`  
**Primary Dependencies**: LOS 23.2 tree; EXTENDROM/AXP sigspoof patches (A15 →
A16 port); microG 0.3.x; project-signed Phonesky; GOLDEN 2026-09-15 capture  
**Storage**: Host `/srv/rom/` prebuilts + secrets; meta-repo `vendor/sunfish-a16/`  
**Testing**: LAB flash only; `settings`/`pm`/`dumpsys`; microG Self-Check;
Play login logcat; optional BeaconDB location smoke  
**Target Platform**: Pixel 4a LAB `11231JEC207477`; Android 16 / LOS 23.2  
**Project Type**: Android ROM frameworks + Settings + packaging overlay  
**Performance Goals**: N/A (correctness / compatibility)  
**Constraints**: LAB only; no GOLDEN modify; no Magisk/KSU; restricted allow-list;
attributable patches; no proprietary APKs in Git  
**Scale/Scope**: frameworks/base (+ services) spoofing; Settings Developer
Options; privapp/default/sysconfig XML updates; one bacon + LAB flash; docs

## Constitution Check

*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*

| Gate | Status |
|------|--------|
| LAB only; never GOLDEN | pass |
| Spoofing native, restricted, auditable; no LSPosed | pass (FR-003/006) |
| Prefer package/signer allow-list over open fake-signature | pass |
| Works without optional root | pass (FR-006, US5) |
| Prefer AXP/EXTENDROM behaviour; A16 port if needed | pass |
| No proprietary APKs in Git | pass |
| Small attributable changes | pass (patch series from EXTENDROM/AXP) |
| Do not invent `006`/`007` into this feature | pass (spec Out of Scope) |

**Post-design**: unchanged — design stays spoofing + first-stack ship gates.

## Project Structure

### Documentation (this feature)

```text
specs/005-restricted-signature-spoofing/
├── plan.md
├── research.md
├── data-model.md
├── quickstart.md
├── contracts/
│   └── spoofing-surface.md
└── tasks.md                 # via /speckit-tasks (not this command)
```

### Host + tree

```text
# Meta repo
vendor/sunfish-a16/          # packaging (REPLACE, privapp XML, gms.mk)
docs/a15-a16-delta.md
docs/004-*.md                # packaging/selfcheck (update for BeaconDB)
.local-artifacts/002-golden/20260915-spoofing-phonesky/   # oracle

# rom-dev01
/srv/rom/src/lineage/frameworks/base/    # spoofing patches
/srv/rom/src/lineage/packages/apps/Settings/  # Developer Options toggle
/srv/rom/references/… or vendor/extendrom/   # patch source (checkout as needed)
/srv/rom/artifacts/005-…/                # validation zip + evidence
```

**Structure Decision**: Continue `vendor/sunfish-a16` packaging overlay; apply
spoofing as attributable patch series under the LOS tree on `rom-dev01` (not a
megapatch in Git). Meta-repo holds vendor stubs, docs, and specs only.

## Complexity Tracking

| Violation | Why needed | Simpler alternative rejected because |
|-----------|------------|--------------------------------------|
| Frameworks patches | LOS 23.2 has no FAKE_PACKAGE | Magisk/LSPosed forbidden by constitution |

## Phase 0 / Phase 1

See `research.md`, `data-model.md`, `contracts/spoofing-surface.md`, `quickstart.md`.