# Tasks: KernelSU-Next on sunfish (LAB) + Yuh/Swissquote gate

**Input**: Design docs from `/specs/007-kernelsu-sunfish/`  
**Prerequisites**: `005` stack on LAB; `002` Yuh/KeyMint baselines; constitution
KernelSU-Next (not Magisk production)

**Organization**: Priority = **Swissquote + Yuh** on LAB. KSU/SusFS/TrickyStore
exist to serve that gate. If the gate cannot be met after the experiment track,
**cancel root** and pivot to native `008`/`009` (+ optional stock phone) — do
not ship “root without Yuh” as success.

**Out of scope**: GOLDEN flash; Magisk production; Revolut/N26 hard-gates;
full Graphene/AXP kernel hardening (`013`).

## Format: `[ID] [P?] [Story] Description`

- **[P]**: Can run in parallel (different files, no incomplete deps)
- **[Story]**: US1…US5 from `spec.md`

## Path conventions

- Meta: `docs/`, `specs/007-kernelsu-sunfish/`
- Host: `/srv/rom/src/lineage/` (kernel + boot), `/srv/rom/artifacts/007-kernelsu/`,
  `/srv/rom/logs/007-build/`

---

## Phase 1: Setup

**Purpose**: Artifact dirs, baseline index, pin stubs

- [x] T001 Create `/srv/rom/artifacts/007-kernelsu/` and
      `/srv/rom/logs/007-build/` on `rom-dev01` (android-build writable)
- [x] T002 [P] Add `docs/007-kernelsu-runbook.md` stub (LAB-only; pin table;
      Yuh hard-gate; cancel-root criteria) in meta repo
- [x] T003 [P] Index `002` Yuh evidence paths in
      `docs/007-kernelsu-runbook.md` (GOLDEN + LAB iodé KeyMint refs from
      `docs/002-golden-inventory.md` / `docs/002-lab-iodes-baseline.md`)
- [x] T004 [P] Confirm LAB still on `005` userspace
      (`pm path` gms/gsf/vending; spoof toggle) — note build id in
      `/srv/rom/artifacts/007-kernelsu/preflight.txt`

- [x] T039 Before T009/T011, capture a rootless snapshot of the current LAB ROM:
      both bank versions/outcomes, build type, microG/Phonesky versions and
      attestation probe/logs under `pre-root/`. FAIL is allowed; record actual
      results rather than inferring them from iodé/GOLDEN. Document Island as
      the current managed-profile vehicle in `docs/007-kernelsu-runbook.md`.
      *(2026-09-15: banks not installed → N/A; see pre-root/OUTCOMES.txt)*

---

## Phase 2: Foundational (blocks all stories)

**Purpose**: Choose 4.14-capable KernelSU-Next revision; locate LOS kernel tree;
no banking claims yet

**⚠️ CRITICAL**: No SusFS/attestation/Yuh PASS claims until KSU boots on LAB

- [x] T005 Inventory LOS 23.2 sunfish kernel path on
      `/srv/rom/src/lineage/` (defconfig, branch); record in
      `docs/007-kernelsu-runbook.md`
      *(`kernel/google/msm-4.14` @ `28f9290ae067…`; sunfish_defconfig)*
- [x] T006 Select KernelSU-Next revision compatible with non-GKI 4.14; document
      candidates + choice in `docs/007-kernelsu-runbook.md` (ReSukiSU only as
      explicit fallback)
      *(`legacy` branch; manual hooks preferred over kprobes)*
- [x] T007 Mirror/checkout chosen KernelSU-Next sources under
      `/srv/rom/references/kernelsu-next/` (or documented path); record commit
      *(@ `a54e4fa46c6c…`)*
- [x] T008 Draft integration notes (what files touch kernel vs boot.img) in
      `docs/007-kernelsu-runbook.md` — attributable commits only, no megapatch

**Checkpoint**: Ready to integrate and build boot (US1)

---

## Phase 3: User Story 1 — Bootable rooted LAB image (P1) 🎯 MVP slice

**Goal**: LAB boots with KernelSU-Next; selective root works  
**Independent test**: Manager present; one approved app gets root; unapproved
does not; telephony/Wi‑Fi OK

- [ ] T009 [US1] Integrate KernelSU-Next into sunfish kernel tree under
      `/srv/rom/src/lineage/`; build boot/kernel; log
      `/srv/rom/logs/007-build/ksu-poc.log`
- [ ] T010 [US1] Stage boot/images + SHA256 to
      `/srv/rom/artifacts/007-kernelsu/<date>-ksu-poc/`
- [ ] T011 [US1] Flash LAB only (`11231JEC207477`); confirm boot +
      `ro.lineage.version`; install/open KSU manager
- [ ] T012 [US1] Grant root to one debug app; deny a second; capture evidence
      under `/srv/rom/artifacts/007-kernelsu/<date>-ksu-poc/root-grant/`
- [ ] T013 [US1] Pin exact KernelSU-Next revision in
      `docs/007-kernelsu-runbook.md` + artifact `PIN.txt`

**Checkpoint**: US1 green before profiles/SusFS

---

## Phase 4: User Story 2 — Banking never root; mounts hidden (P1)

**Goal**: Yuh/Swissquote UIDs denied + **verified** umount/hide  
**Independent test**: `contracts/ksu-hide-surface.md` — not toggle-only

- [ ] T014 [US2] Configure KSU profiles: deny root for `com.yuh` and
      `com.swissquote.android` on user 0 and Island user; document steps in
      `docs/007-kernelsu-runbook.md`
- [ ] T015 [US2] Enable umount/hide for those UIDs; verify `path_umount` (or
      equivalent) works on this 4.14 build — note pass/fail in
      `/srv/rom/artifacts/007-kernelsu/<date>-hide/umount.txt`
- [ ] T016 [US2] From banking or probe UID, capture mount/root visibility
      before/after hide →
      `/srv/rom/artifacts/007-kernelsu/<date>-hide/mounts/`
- [ ] T017 [US2] Mark `contracts/ksu-hide-surface.md` checklist rows against
      real evidence (update runbook if contract gaps)

**Checkpoint**: Hide verified before SusFS

---

## Phase 5: User Story 3 — SusFS after profiles (P2)

**Goal**: SusFS on LAB; measurable hide; no reboot loop  
**Independent test**: Boot + one path hidden; soak before claim

**Note (2026-09-16):** T018 **build** completed early (API bridge) *before* US2
hide verification — process exception. Boot artifact
`boot-resukisu-susfs-20260916T004038Z.img` is **trial only**. Prefer LAB on
`boot-resukisu-our-20260915T183729Z` until US2 green; then re-attempt T019.
abu/torukk boots are reference-only — see `docs/session-20260916-handoff.md`.

- [x] T018 [US3] Integrate SusFS into the pinned kernel path; build; log
      (host detach SusFS boot 20260916T004038Z; sha `455a77a6…`)
- [ ] T019 [US3] Flash LAB; confirm boot + KSU still works; record SusFS pin in
      `docs/007-kernelsu-runbook.md`
- [ ] T020 [US3] Re-verify banking UID hide with SusFS on → artifact
      `/srv/rom/artifacts/007-kernelsu/<date>-susfs/`
- [ ] T021 [US3] Soak ≥24h or document revert if unstable (SC-005); update
      SusFS status `trial`/`claimed`/`reverted` in runbook

**Checkpoint**: SusFS stable or withdrawn before attestation claims that depend
on it

---

## Phase 6: User Story 4 — Attestation / KeyMint experiment (P1)

**Goal**: TrickyStore-class (or equiv.) vs `002` Yuh KeyMint failure  
**Independent test**: New log pack; progress toward Yuh PASS

- [ ] T022 [US4] Choose attestation experiment stack (TrickyStore-class or
      documented equivalent + microG HA toggles); record source URL, immutable commit or release and binary SHA256, dependencies, key-material requirements, auditability and rollback in
      `docs/007-kernelsu-runbook.md` **before T023**
- [ ] T023 [US4] Apply stack on LAB; capture `keystore2`/KeyMint/RKP logcat on
      Yuh open → `/srv/rom/artifacts/007-kernelsu/<date>-attest/`
- [ ] T024 [US4] Diff against `002` failure class; write short delta note in
      artifact `DELTA.md` (same / improved / resolved)
- [ ] T025 [US4] Iterate one candidate at a time based on measured probe/banking outcomes; do not use a log string alone as the failure criterion; keep each attempt under dated artifact dirs — do
      not mark feature done on FAIL

**Checkpoint**: Diagnostic evidence ready for US5; persistent log messages
alone do not determine acceptance. Exhausted unsuccessful bank attempts lead
to Phase 9 or an incomplete feature.

---

## Phase 7: User Story 5 — Banking regression / hard-gate (P1)

**Goal**: **Yuh and Swissquote PASS** in Island  
**Independent test**: `contracts/banking-yuh-gate.md` + `quickstart.md`

- [ ] T026 [US5] Install path: Aurora → (prefer no owner open) → Island clone
      for Yuh + Swissquote; note UIDs in
      `/srv/rom/artifacts/007-kernelsu/<date>-banking/layout.txt`
- [ ] T027 [US5] Swissquote Island session → **PASS required** + evidence under
      `…/<date>-banking/swissquote/`
- [ ] T028 [US5] Yuh Island session → **PASS required**; evidence under
      `…/<date>-banking/yuh/` (build id, stack pins, log excerpt)
- [ ] T040 Before T029 acceptance, verify FR-009: installed packages, root
      module inventory, relevant processes/mounts and build configuration show
      no Zygisk/LSPosed integration. Store evidence; a package-name check alone
      is insufficient. Any proposed exception requires a spec decision first.

- [ ] T029 [US5] If both banks PASS: fill `data-model.md` banking row + tick
      `specs/007-kernelsu-sunfish/quickstart.md` pass criteria
- [ ] T030 [US5] If either bank FAILS after T022–T025 exhausted: do **not** accept
      `007`; proceed to Phase 9 cancel-root tasks

**Checkpoint**: Feature accepted only with both banks PASS

---

## Phase 8: Polish (only if both banks PASS)

- [ ] T031 [P] Update `docs/axp-pro-parity.md` root / DenyList / Yuh / Swissquote
      rows to reflect KSU-Next + LAB results
- [ ] T032 [P] Update `docs/a15-a16-delta.md` attestation/`007` measured notes
- [ ] T033 Handoff note in `docs/007-kernelsu-runbook.md`: next may be `008`
      call recording / `009` FLAG_SECURE; full hardening still `012`–`013`
- [ ] T034 Mark deferred `006` as superseded-by-`007` (or thin stub) in
      `specs/` / roadmap note — no fake rootless Yuh success

---

## Phase 9: Cancel-root pivot (only if either banking hard-gate fails)

**Purpose**: Owner priority — without Yuh/Swissquote success, discard project
root and keep native requirements instead

- [ ] T035 Write `/srv/rom/artifacts/007-kernelsu/CANCEL-ROOT.md` (attempts,
      last pins, KeyMint residual, recommendation: stock phone for banks)
- [ ] T036 Update `docs/007-kernelsu-runbook.md` + `docs/axp-pro-parity.md`:
      root path **withdrawn**; Magisk/KSU not production
- [ ] T037 [P] Stub or specify next focus: `008` call recording + `009`
      FLAG_SECURE (native, no LSPosed) — Spec Kit when owner starts them
- [ ] T038 Leave LAB on last known-good **non-root** (`005`) image or document
      re-flash steps in runbook

---

## Dependencies

```text
Setup T001–T004 + T039
    → Foundational T005–T008
        → US1 T009–T013 (KSU boot)
            → US2 T014–T017 (hide)
                → US3 T018–T021 (SusFS)
                    → US4 T022–T025 (attest)
                        → US5 T026–T030 + T040 (both-bank gate)
                            ↘ PASS → Polish T031–T034
                            ↘ FAIL → Cancel-root T035–T038
```

- US3 may be skipped only if US4/US5 PASS without SusFS (document why)
- US4/US5 are the product priority; US1–US2 are enablers

## Parallel opportunities

- T002, T003, T004 after T001  
- T031, T032 after both banks PASS  
- T037 anytime during cancel-root phase  

## MVP

**Minimum useful slice**: T001–T013 (KSU boots on LAB).  
**Product MVP**: T027 Swissquote PASS and T028 Yuh PASS on the same stack.
Either unresolved failure → Phase 9 or remain incomplete, never “007 done”.

## Suggested next command after tasks

`/speckit-analyze` (optional) → `/speckit-implement` starting at T001 on
`rom-dev01` (kernel work is host-side; LAB flash when boot ready).