# Research: 004 microG + Phonesky

## Decision: Packaging layout — follow AXP GOLDEN scheme (owner 2026-09-15)

**Decision**: Mirror AXP GOLDEN partition roles. Do not invent a `product`-centric
layout. Measured on GOLDEN (`002`):

| Package | AXP GOLDEN path | Our packaging |
|---------|-----------------|---------------|
| Phonesky | `/system/priv-app/Phonesky_AXP-OS` | **system** + privileged |
| GmsCore | `/system_ext/app/MicrogGmsCore_GH_presigned` | **system_ext** app (not priv-app) |
| GsfProxy | `/system_ext/app/GsfProxy_GH` | **system_ext** app |

Ship via a small `vendor/sunfish-a16` include (partner_gms *pattern*) but
**replace FakeStore** with patched Phonesky. Permission XMLs follow the same
partitions (`system` for Phonesky, `system_ext` for microG).

**Rationale**: Owner — AXP methods exist for a reason; goal is modernize (LOS
23.2 / A16) and later replace Magisk with KSU-Next+SusFS (`007`), not redesign
the compatibility stack. Ad-hoc `LOCAL_PRODUCT_MODULE` + ABI-strip/re-sign of
GmsCore risks different update/SELinux/behaviour vs GOLDEN.

**Alternatives rejected**:
- All on `PRODUCT` — layout drift; hit partition checks awkwardly
- ABI-strip + project re-sign of GmsCore — breaks official microG F-Droid signer
- Stock lineageos4microg + FakeStore — wrong Store model
- Magisk module installers — not for `004` (root is `007`, non-Magisk)

**Partition headroom**: AXP release Phonesky APKs stay **fat** (all ABIs); CI
does not strip x86. If LOS 23.2 sunfish `BOARD_SUPER_PARTITION_ERROR_LIMIT` is
too tight for this package set, raise the error limit modestly (still under
`BOARD_GOOGLE_DYNAMIC_PARTITIONS_SIZE`) rather than breaking microG’s signer.

## Decision: Phonesky binary — patch latest, AXP procedure, project sign

**Decision**: Latest official Play (apkmd) → AXP `patch-playstore` → project JKS
under `/srv/rom/secrets/phonesky-signing/`. XMLs from AXP `etc/`. Do **not** ship
`Phonesky_AXP-OS-signed.apk` as product (wrong trust domain). Keep fat APK unless
a later measured need forces arch filtering (document then).

## Decision: microG — latest official PRESIGNED + F-Droid

**Decision**: Latest official GmsCore **default** APK (`com.google.android.gms-*.apk`
without `-hw`) + GsfProxy, `PRESIGNED`, system_ext like AXP `*_GH_presigned`.
Never re-sign. F-Droid microG repo is the update path. No FakeStore/Companion APK
from microG releases.

**Do not ship `*-hw.apk`**: that Huawei flavor omits
`NetworkLocationService` / `NetworkLocationProviderService` from the manifest, so
microG Location hides Wi‑Fi/cell NLP toggles. GOLDEN ships the default flavor
(`versionName` without `-hw`, e.g. `0.3.15.250932`); LAB previously had
`0.3.16.252432-hw` and only Timeline — corrected 2026-09-16 to
`0.3.16.252432` default for GOLDEN Location UI parity.

## Decision: Signature spoofing in `004`

**Decision**: Use LOS 23.2 restricted spoofing only; gaps → `005`.

## Decision: AXP scheme vs Android 16 / LOS 23.2 (owner 2026-09-15)

**Decision**: Prefer the AXP **A15 / GOLDEN** packaging and behaviour scheme when
LOS 23.2 / Android 16 still supports it. If A16 makes an equivalent path
*easier* (cleaner APIs, existing LOS hooks), use that — still targeting the
same end state (priv Play, updatable official-signer microG, banking path).
If A16 makes the AXP path *harder* or impossible, do **not** silently invent a
divergent stack: document the blocker and redesign the route to the **same**
goals (layout roles, update model, no Magisk-shaped packaging).

**Rationale**: AXP’s choices were intentional; A16 is a port/modernization, not
a license to ignore the oracle. Divergence only when measured necessity.

**Oracle scope (owner 2026-09-16)**: GOLDEN and abu are **Android 15** reference
images — use them for packaging/layout/behaviour (e.g. which GmsCore *flavor*
exposes Location NLP), not as a pin to their older package versions. On LOS 23.2
/ A16 we ship the **newest** fitting official microG (and peers) that preserve
that scheme (default/non-hw GmsCore, not `*-hw`).

**Measured A16 blocker (2026-09-14)**: Putting Phonesky on `system/priv-app`
fails `artifact_path_requirements` (`generic_system.mk`) under LOS 23.2.
**Route to same end state**: keep AXP paths and add them to
`PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST` (same mechanism sunfish already
uses for a few system libs) — do not move Phonesky to `product` just to silence
the check. GmsCore/Gsf on `system_ext` already passed.

**Align-first (owner 2026-09-15)**: Do not invent `privapp-permissions` for
GmsCore while GOLDEN ships it as non-privileged `system_ext` app. Ship only
AXP Phonesky XMLs; repair from Self-Check / build errors if A16 truly requires
more.

## Decision: Signing strategy (FR-010) — locked

| Package | Signer | Update path |
|---------|--------|-------------|
| GmsCore / GsfProxy | Official microG (`PRESIGNED`) | F-Droid microG repo |
| Phonesky | Project JKS `/srv/rom/secrets/phonesky-signing/` | Same-signer patched APKs |