# GOLDEN inventory (AXP.OS oracle) — redacted

**Device:** GOLDEN sunfish (main phone) — **DO NOT FLASH / wipe / modify**.  
**Serial:** `11071JEC203839`  
**Role:** Live **AXP.OS Pro 22.2 / Android 15** compatibility oracle.  
**Access:** Non-destructive `adb` only (sampled 2026-09-13).  
**Raw artifacts:** `/srv/rom/references/axp/golden/2026-09-13/` on `rom-dev01`  
(includes Magia DenyList screenshots, Yuh logcat; Git = this summary only).

## Identity (measured)

| Field | Value |
|-------|--------|
| Serial | `11071JEC203839` |
| Owner user | `Andres` (user 0) |
| `ro.build.display.id` | `BP1A.250505.005` |
| `ro.build.version.release` | `15` |
| `ro.build.version.security_patch` | `2026-03-03` |
| AXP / Lineage identity | `ro.lineage.version=22.2-2026.003-sunfish-pro` (`releasetype=PRO`) |
| Bootloader | **unlocked** (`flash.locked=0`, `verifiedbootstate=orange`) |
| Magisk | Binary **29.0** (`29000`) at `/system_ext/bin/magisk`; UI app named **Magia** |

## Users / work profile

| User | Name | Notes |
|------|------|-------|
| 0 | Andres | Owner |
| 10 | Island | Profile owner = `com.oasisfeng.island.fdroid` 6.4.2 |

After owner’s 2026-09-13 reclone experiment: `com.yuh` and
`com.swissquote.android` present on **both** user 0 and user 10
(Island reinstall of Yuh `firstInstallTime` user10 ≈ 21:48).

## Essential packages (measured)

| Area | Package / path | Version | Notes |
|------|----------------|---------|--------|
| microG GmsCore | `com.google.android.gms` | **0.3.15.250932** | System base MicrogGmsCore_GH; sig short `73aaa390` |
| Phonesky (AXP) | `/system/priv-app/Phonesky_AXP-OS` | **50.2.12-24** | Sig short `e05f779d` |
| GSF Proxy | `/system_ext/app/GsfProxy_GH` | `v0.1.0` | |
| Island | `com.oasisfeng.island.fdroid` | `6.4.2-d46911c9` | Spec text said “Insular”; measured = **Island** |
| Aurora Store | `com.aurora.store` | `4.8.4` | |
| Yuh | `com.yuh` | `1.45.11` (vc 535) | See attestation section |
| Swissquote | `com.swissquote.android` | `9.9.0` | Owner reports still OK |
| Aosmium (AXP) | `org.axpos.aosmium` | `148.0.7778.178` | Not on DenyList |
| Magisk modules list | `/data/adb/modules` | — | Not readable without root shell — **re-query** if needed |

## Magia DenyList (from UI screenshots 2026-09-13)

Checked packages (package-level; process expand not fully visible in shots):

| App | Package |
|-----|---------|
| BBVA Spain | `com.bbva.bbvacontigo` |
| BOOM | `com.boom.android.mobile2` |
| CieID | `it.ipzs.cieid` |
| Device configuration | `android.autoinstalls.config.google.nexus` |
| DKB | `com.dkbcodefactory.banking` |
| Identifica | `it.sielte.sielteidentify` |
| N26 | `de.number26.android` |
| Scalable Capital | `capital.scalable.droid` |
| Swissquote | `com.swissquote.android` |
| Webank | `com.opentecheng.android.webank` |
| Wise | `com.transferwise.android` |
| Yuh | `com.yuh` |

Visible unchecked (partial): Aegis, Amarok, Amaze, Aosmium.

Owner notes: most DenyList banking apps still pass; **Yuh fails** for ~weeks.
Extra Magia DenyList/host checks + Island uninstall/reclone did **not** fix Yuh.

## Compatibility / attestation (observational)

| Check | Status | Evidence |
|-------|--------|----------|
| Swissquote | **PASS** (owner report) | Still used; on DenyList |
| Other DenyList banks (N26, DKB, …) | **PASS** (owner: “casi todos”) | UI DenyList |
| Yuh | **FAIL** — hardware attestation / “certificate is invalid” | Owner UI + logcat ~21:51–21:52 |
| Play Integrity token path | Client path still runs | `Finsky requestIntegrityToken() finished for com.yuh`; DroidGuard `pia_attest_e1` for `com.yuh` |
| KeyMint / TEE | Errors concurrent with Yuh attempt | `keystore2`: `HARDWARE_TYPE_UNAVAILABLE` (IRPC / `TRUSTED_ENVIRONMENT`); `addRngEntropy` → `DEAD_OBJECT` / KeyMint `-1000` |

Interpretation for later `006`/`007` (not a GOLDEN fix): DenyList alone is
insufficient for Yuh’s hardware-attestation path; KeyMint/TEE remote-provisioning
errors correlate with the failure window. Project production root path remains
**KernelSU-Next (+ SusFS) or ReSukiSU evaluation** — Magisk/Magia is oracle-only.

Call recording: GOLDEN Secure dump shows native EXTENDROM
`extendrom_call_recording=1` (see `008` — port `er.sh` F_CALLREC, not Magisk
RRO). FLAG_SECURE override: not identified as AXP catalog on GOLDEN; project
`009` is native DO.

## Banking layout (oracle)

Historical target order (AXP workflow; Magisk DenyList → Island):

1. Aurora Store → install  
2. Do not open  
3. Magia DenyList (incl. processes) before first process  
4. Clone into Island  
5. First launch in Island  
6. Phonesky/Play in Island as needed  

Observed: Yuh+Swissquote intended in Island; after 2026-09-13 debug, both also
on owner user 0 — clean up is owner’s choice; agents must not uninstall.

## Policy

No flash, wipe, Magisk/Magia changes, or app uninstalls by agents — sample only.