# Contract: Magisk preinstall (AXP / GOLDEN class)

**Ship root**: Magisk (newest stable that works on this stack)  
**Not ship**: KernelSU / SusFS (`007` optional recycle only)

## Behavioural contract

1. After a clean `009` flash, Magisk is **present** in an AXP-like
   **preinstalled but not fully activated** state (exact files/UI measured
   from GOLDEN — document in LAB runbook).
2. Owner can complete activation on LAB using documented steps.
3. DenyList-class configuration can hide root from banking packages before
   first process start (GOLDEN workflow).
4. Magisk version in the version-pin record is newest workable stable, not an
   accidental stale host copy.

## Banking interaction

Aurora install → do not open → DenyList (incl. processes) → Island clone →
first launch in Island. Banks MUST NOT receive root.

## Out of contract

- Shipping Magia branding specifically ( Magisk upstream UI OK if behaviour
  matches).
- Requiring KernelSU coexistence on the same ship image.

## Verification

```bash
# After flash (pre-activation): document paths/props matching GOLDEN notes
adb shell ls -l /system_ext/bin/magisk 2>/dev/null || true
adb shell pm list packages | grep -iE 'magisk|magia'

# After activation: Magisk app reports version; DenyList configurable
```

Evidence under `/srv/rom/artifacts/009-axp-los23-port/magisk/`.