# Feature Specification: AXP LOS22 feature port to LOS23 **Feature Branch**: `009-axp-los23-port` **Created**: 2026-09-16 **Status**: Clarified — ready for `/speckit-plan` **Input**: User description: "009-axp based LOS22 feature port to LOS23 — take vanilla LineageOS 23 for sunfish and integrate the full AXP.OS (LOS22 / Android 15 GOLDEN) feature set into LOS23 without product exceptions; only versions change (newest stable for each system / bundled app that still fits sunfish / Android 16); use the project's already updated patched Phonesky (Google Play)." **Owner clarifications (2026-09-16):** Magisk like GOLDEN (newest Magisk; AXP-style preinstalled-but-not-fully-activated layout — measure on GOLDEN); hardening / signing / AVB like GOLDEN (full **AXP resurrection** on LOS23); WebView exception = keep LOS23 WebView (Aosmium EOL) but leave provider selection unlocked; Phonesky = project patched build from recent work unless it lacks GOLDEN-class fixes (then reconsider); microG newest stable integrated with that Phonesky; signature spoofing and call recording **selectable** (toggles); KernelSU (`007`) out of ship for now, with optional recycle of existing functional kernels if useful; otherwise everything equal to AXP/GOLDEN. ## Context / non-goals **Product intent (this feature is normative for the AXP resurrection ship):** - This feature is an **AXP.OS resurrection** on LineageOS 23.2 / Android 16 `sunfish`: same capability set as AXP on LOS22 / GOLDEN, moved to LOS23. - Base ROM = LineageOS 23.2 / Android 16 `sunfish` vanilla from `003` (or the best known-good vanilla-equivalent flashable baseline already proven on LAB). - Feature source of truth for *what* to ship = what AXP.OS Pro / GOLDEN provides on LOS22 (inventory in `002`, product catalog in `docs/axp-pro-parity.md`), **without omitting AXP capabilities as “decide later” rows**, including Magisk-class root and AXP-class hardening / signing / AVB posture that GOLDEN represents. - Versions = **newest stable** (or newest tagged pre-release the upstream project currently ships) for each system/bundled component, constrained to what still works on sunfish / non-GKI 4.14 / LOS 23.2 — not stale laptop caches or shallow-clone version lies. - **Phonesky exception:** ship the project's **already patched / fixed Phonesky** from the recent host pipeline (not “whatever newest Play APK is today”). If that build is missing fixes that GOLDEN's Phonesky path still needs for daily-driver parity, stop and reconsider the Phonesky plan before accepting the feature. - **WebView exception:** do **not** ship Aosmium (EOL). Default WebView = LineageOS 23's WebView. The ROM MUST keep Android's multi-provider path so the owner can install another WebView later and select it (Developer options → WebView implementation) — not locked to a single provider. - Flash / experiment **LAB only**; GOLDEN remains the read-only oracle (`docs/device-roles.md`). **Relationship to earlier features:** - `001`–`003` remain shared foundation (host, GOLDEN capture, vanilla build). - **Two parallel product tracks** (neither deletes the other): - **Standby / prior track:** `004`–`008` + `007` KernelSU (+ deferred `006`/`010`–`013` as previously planned). Kept intact for later resume; live on its own git branch once pushed (see plan notes). - **Active Magisk-resurrection track (this feature):** AXP→LOS23 ship with Magisk like GOLDEN. Does **not** rewrite or remove `004`–`008`/`007` specs; it is a new Speckit directory that may **reuse** proven LAB runbooks/results from those features when helpful. - KernelSU / SusFS from `007` stays **out of this track’s ship** for now. Recycle of the two functional `007` kernels is optional (FR-016) — never an acceptance gate for Magisk. - Project-only `FLAG_SECURE` global override may still ship if already specified under `008` (not AXP catalog); it is optional relative to AXP resurrection acceptance. AXP call-recording unlock **is** required and must be selectable. **Out of scope for this feature (explicit):** - Flashing or modifying GOLDEN. - Committing proprietary Google Phonesky APK bytes, private keys, or personal identifiers to Git. - Replacing the LOS 23.2 sunfish kernel/device stack with an unrelated prebuilt (Graphene A13, stock A13, etc.). - Shipping Aosmium / AOSmium as the default or only WebView (EOL). - Building a custom AXP-style backup/restore ROM feature (personal backup remains an external user tool if needed). - Claiming Yuh hardware-attestation PASS if GOLDEN itself currently FAILs that path — reproduce GOLDEN's *workflow* and document attestation parity honestly. - Deleting or rewriting the standby KernelSU / split-roadmap specs (`004`–`008`/`007`) — they remain valid on the standby branch/track. - Shipping KernelSU-Next as this track’s root (out of ship here; Magisk is the resurrection root). Optional later reuse of `007` kernels is allowed under FR-016 but MUST NOT delay Magisk acceptance. ## User Scenarios & Testing *(mandatory)* ### User Story 1 - AXP resurrection daily-driver on LAB (Priority: P1) As the owner, after flashing one LAB build produced under this feature, the phone boots and presents the same class of daily-driver capabilities I rely on with AXP on GOLDEN (Google compatibility stack, Play, managed banking profile workflow, selectable call recording unlock, Magisk root/hide workflow like GOLDEN, AXP hardening/signing posture, and AXP bundled usability apps — except WebView as defined here), without a checklist of deferred AXP features. **Why this priority**: This is the whole reason for the resurrection. **Independent Test**: Flash one `009` build to LAB; walk the GOLDEN daily checklist (microG Self-Check, Play open/install, Island profile, call-record toggle off/on, spoofing toggle off/on, Magisk present in AXP-like install state, bundled apps present, hardening/signing checks that GOLDEN implies); compare against `002` inventory categories. **Acceptance Scenarios**: 1. **Given** LAB on a vanilla `003` baseline (or documented equivalent), **When** the `009` image is flashed, **Then** the device boots to home and cellular/Wi‑Fi/basic hardware still work as in the vanilla smoke. 2. **Given** that build, **When** I compare shipped capability categories to GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, managed profile tool, selectable call recording unlock, Magisk/DenyList-class path, DNS/hosts privacy helpers if present on GOLDEN, F‑Droid/Aurora/launcher/ gallery-class bundled apps, hardening/signing/AVB class), **Then** no category is left as “decide / later” without an explicit obsolescence note tied to Android 16 / sunfish impossibility (WebView exception allowed per FR-015). 3. **Given** Git and host artifact policy, **When** inspected, **Then** no proprietary Phonesky APK bytes or secrets were committed. --- ### User Story 2 - Google stack: newest microG + project Phonesky (Priority: P1) As the owner, newest-stable microG + GSF Proxy integrate with the project's recent patched Phonesky so I can open Play, sign in as needed, and install/update apps the same way I do on AXP; signature spoofing is selectable (off = stock-safe default behaviour; on = needed Play/microG path). **Why this priority**: Without Play/microG parity, the ROM is not a daily driver. **Independent Test**: microG Self-Check; Phonesky launches; install or update at least one ordinary app; toggle spoofing off/on and confirm expected behaviour; push notifications smoke for a known test app. **Acceptance Scenarios**: 1. **Given** the `009` build on LAB, **When** microG Settings Self-Check runs with spoofing enabled as required, **Then** checks required for basic Google compatibility pass (or each remaining failure is documented as attestation/hardware outside packaging). 2. **Given** the project's current patched Phonesky host artifacts, **When** the ROM is built and flashed, **Then** `com.android.vending` is present as privileged Play and opens on LAB. 3. **Given** selectable signature spoofing, **When** the owner turns it on, **Then** Play install/update works with microG without FakeStore; **When** turned off, **Then** the device does not expose unrestricted spoofing to arbitrary apps. 4. **Given** version policy, **When** microG / GSF versions are recorded, **Then** each is the newest stable (or tagged pre-release upstream currently ships) verified on this stack; Phonesky version matches the project patched artifact (not a blind “newest Play from the internet”). 5. **Given** Play behaviour on LAB, **When** compared to GOLDEN needs, **Then** if the project Phonesky lacks a GOLDEN-class fix required for daily use, acceptance stops and the Phonesky plan is reconsidered. --- ### User Story 3 - Banking profile workflow parity (Priority: P1) As the owner, I can recreate the GOLDEN banking layout on LAB: install via the same store path I use on AXP, place banks in Island, and keep banking apps free of root via Magisk DenyList-class hiding like GOLDEN. **Why this priority**: Compatibility hard gates; daily-driver without banks fails the resurrection. **Independent Test**: Install Swissquote (hard gate) and attempt Yuh; run inside Island; Magisk DenyList (or AXP-equivalent) applied; record PASS/FAIL honestly vs GOLDEN. **Acceptance Scenarios**: 1. **Given** Island on LAB, **When** I follow the documented GOLDEN banking install order, **Then** Swissquote reaches a usable logged-in state in the managed profile. 2. **Given** Yuh on the same workflow, **When** tested, **Then** either it PASSes or the failure matches the known GOLDEN attestation-class failure and is documented — not a silent packaging regression. 3. **Given** Magisk is present on the build, **When** banking apps run with DenyList-class configuration, **Then** they do not receive root. --- ### User Story 4 - Magisk like GOLDEN + selectable call recording (Priority: P1) As the owner, Magisk is present the way AXP/GOLDEN presents it (newest Magisk; preinstalled but not fully activated until I finish setup — exact UX measured from GOLDEN), with DenyList-class hiding; call recording unlock is selectable like other Developer Options toggles. **Why this priority**: Root and call recording are core AXP daily behaviours. **Independent Test**: Confirm Magisk package/binary layout vs GOLDEN notes; complete activation on LAB if required; DenyList a test app; toggle call recording unlock off (restricted) and on (record allowed). **Acceptance Scenarios**: 1. **Given** a fresh `009` flash, **When** inspected, **Then** Magisk is present in an AXP-like preinstalled / not-fully-activated state consistent with GOLDEN measurement, using the newest Magisk stable that works on this stack. 2. **Given** Magisk setup completed on LAB, **When** DenyList-class hiding is configured for a banking package, **Then** that package does not receive root. 3. **Given** selectable call recording unlock, **When** OFF, **Then** stock LOS country/carrier style restrictions apply; **When** ON, **Then** Dialer can record on LAB without that block. --- ### User Story 5 - AXP usability, privacy, hardening (Priority: P2) As the owner, the ROM ships the rest of the AXP usability/privacy surface and GOLDEN-class hardening/signing/AVB posture at newest workable stables, with LOS23 WebView default and an unlocked provider chooser. **Why this priority**: Completes resurrection beyond Google/banking/root core. **Independent Test**: Package list vs `002`; open bundled apps; confirm default WebView is LOS and another WebView can be selected if installed; hardening/signing checks agreed for GOLDEN-class parity. **Acceptance Scenarios**: 1. **Given** the `009` build, **When** I list bundled system/user apps in the AXP usability set, **Then** each GOLDEN/AXP category is present or explicitly marked impossible on Android 16/sunfish with rationale (Aosmium absence is the allowed WebView exception). 2. **Given** Developer options, **When** I open WebView implementation, **Then** LOS23 WebView is available/default and the chooser is not locked against future alternate providers. 3. **Given** version policy, **When** bundled apps (except Phonesky per FR-004) are recorded, **Then** each is newest stable that still runs on the ROM. 4. **Given** GOLDEN/AXP hardening and signing expectations, **When** the accepted build is evaluated, **Then** equivalent class of protections / signing posture is present or each gap is documented as impossible on this stack — not silently dropped. --- ### User Story 6 - Parallel tracks stay honest (Priority: P2) As the owner, docs make clear that **this** Speckit is the Magisk AXP resurrection track on LOS23, while the prior KernelSU / split roadmap remains on standby (other branch / same `004`–`008`/`007` specs untouched). **Why this priority**: Lets either track resume without rewriting history. **Independent Test**: `specs/004`–`008`/`007` still exist unchanged in intent; `009` describes Magisk resurrection; git branches separate standby vs active work when published. **Acceptance Scenarios**: 1. **Given** the repo, **When** inspected, **Then** `001`–`008`/`007` spec directories remain present (not deleted by `009`). 2. **Given** `009`, **When** read as ship intent for Magisk resurrection, **Then** it does not claim to permanently retire the standby track — only that KernelSU is out of *this* track’s ship for now. --- ### Edge Cases - Newer “stable” of a bundled app breaks Android 16 / sunfish: pin last known good, document the regression, and retry when a fixed release exists. - Project Phonesky missing a GOLDEN-class fix: halt acceptance; reconsider Phonesky patch/version plan before claiming Play parity. - Magisk “preinstalled but not fully installed” UX differs across Magisk versions: match GOLDEN's *class* of first-boot/setup behaviour; document exact measured steps from GOLDEN before freezing LAB instructions. - GOLDEN Yuh FAIL vs LAB FAIL: distinguish attestation/hardware class from packaging/spoofing regressions. - Vanilla LOS already provides an AXP capability (e.g. WireGuard, encryption): keep LOS behaviour; do not duplicate. - Dirty upgrade from older LAB experimental (incl. KernelSU) images: prefer clean flash for acceptance. - Phonesky host artifacts missing or wrong signature: fail closed — never silently fall back to FakeStore. - Alternate WebView installed by user later: selection must remain possible; default remains LOS23 WebView until the user changes it. ## Requirements *(mandatory)* ### Functional Requirements - **FR-001**: The project MUST produce a flashable LineageOS 23.2 / Android 16 `sunfish` build that resurrects the AXP.OS on LOS22 / GOLDEN capability set (including Magisk-class root and GOLDEN-class hardening / signing / AVB posture), without leaving AXP capabilities as open “decide” omissions except the WebView exception in FR-015. - **FR-002**: Version selection for system and bundled components (except Phonesky per FR-004) MUST prefer the newest stable (or newest tagged pre-release upstream currently ships) that still works on sunfish / LOS 23.2; GOLDEN versions are a floor reference, not a freeze. - **FR-003**: The ROM MUST ship newest-stable microG Services Core and GSF Proxy integrated with the project Phonesky (no FakeStore as primary Play). - **FR-004**: The ROM MUST ship the project's recent patched Phonesky as privileged `com.android.vending`, with a documented host-side obtain / patch / sign / deploy path that never commits APK bytes to Git. If that artifact lacks GOLDEN-class fixes required for daily-driver Play behaviour, the Phonesky plan MUST be reconsidered before acceptance. - **FR-005**: The ROM MUST provide **selectable** signature spoofing for the microG + Phonesky path (owner-controlled toggle; default safe/off or project-documented default). Spoofing MUST remain restricted/controlled — not unrestricted platform spoofing for all apps. - **FR-006**: The ROM MUST support the GOLDEN managed-profile banking workflow (Island as measured on GOLDEN) including Swissquote PASS as a hard gate. - **FR-007**: Banking applications MUST run without being granted root (Magisk DenyList-class hiding). - **FR-008**: The ROM MUST include **selectable** AXP-equivalent call recording unlock (toggle; OFF = stock LOS restrictions, ON = unlock). - **FR-009**: The ROM MUST include the AXP usability/privacy bundled surface present on GOLDEN / AXP Pro (stores, launcher/gallery-class apps, DNS/hosts or equivalent blockers when part of that surface) at newest workable stables, subject to FR-015 for WebView. - **FR-010**: The ROM MUST ship **Magisk** like GOLDEN: newest Magisk stable that works on this stack, in an AXP-like preinstalled but not fully activated layout (exact first-boot/setup behaviour measured from GOLDEN), with DenyList-class hiding sufficient for FR-007. KernelSU is **out of ship for now** (not the resurrection root path). - **FR-011**: The feature acceptance gate MUST include GOLDEN/AXP-class hardening and signing / AVB posture (as applicable on LOS 23.2 / sunfish), not only apps and Google compatibility. Gaps MUST be documented as impossible on this stack rather than silently omitted. - **FR-012**: Acceptance flashing MUST use LAB only; GOLDEN MUST remain unmodified by this feature's work. - **FR-013**: Each shipped capability MUST be attributable (what upstream or AXP behaviour it reproduces) and reversible (known-good prior LAB image retained). - **FR-014**: This feature MUST live as a **new Speckit** (`009`) in parallel with the standby KernelSU / split roadmap (`004`–`008`/`007`). Those older specs MUST NOT be deleted or rewritten to match Magisk resurrection. Reusable runbooks/results from them MAY be referenced. For *this* track’s ship only, Magisk (not KernelSU) is the root path. - **FR-015**: Default WebView MUST be LineageOS 23's WebView. Aosmium MUST NOT be required. The ROM MUST keep WebView provider selection available so a future alternate WebView can be installed and chosen. - **FR-016**: Existing functional KernelSU / related kernels and artifacts from `007` SHOULD be retained and MAY be recycled when useful (reference boot images, differential debugging, or a later optional non-ship path). Such reuse is **optional** (“si se puede, ok”), MUST NOT become an acceptance requirement for Magisk resurrection, and MUST NOT imply KernelSU is back in the ship path unless a future spec explicitly says so. ### Key Entities - **Vanilla baseline**: The LOS 23.2 sunfish build from `003` (or documented equivalent) before AXP feature integration. - **AXP capability set**: Inventory of features/packages/behaviours from GOLDEN (`002`) plus AXP Pro catalog rows promoted by this spec (resurrection target). - **Version pin record**: Documented package/component versions chosen for the accepted `009` build (newest workable stable each; Phonesky = project artifact id/version). - **Phonesky host artifact**: Project patched/signed Play APK and permission metadata kept outside Git on the build host. - **Magisk preinstall state**: Measured GOLDEN/AXP layout for Magisk present but not fully activated, plus LAB setup steps. - **LAB acceptance build**: Flashable image set + hashes + smoke/banking / Magisk / hardening results for this feature. ## Success Criteria *(mandatory)* ### Measurable Outcomes - **SC-001**: One LAB flash of a `009` build boots and completes the vanilla hardware smoke within the same session as flash (owner can place a call, use Wi‑Fi, and unlock the device). - **SC-002**: 100% of AXP resurrection capability categories from the agreed inventory are either demonstrated on LAB or explicitly documented as impossible on Android 16/sunfish — zero silent omissions (WebView exception allowed only as FR-015). - **SC-003**: With spoofing enabled as required, microG Self-Check required items and project Phonesky open/install succeed on LAB for ordinary apps on the first accepted build candidate (or within one documented fix iteration). - **SC-004**: Swissquote managed-profile + Magisk DenyList-class workflow PASSes on LAB; Yuh result is recorded and is not worse than GOLDEN for packaging/spoofing reasons. - **SC-005**: Every bundled/system app version in the acceptance record (except Phonesky) is newer than or equal to GOLDEN's measured version, unless a newer release was tried and failed with a written regression note; Phonesky matches the recorded project patched artifact. - **SC-006**: Owner can turn signature spoofing and call recording unlock off and on and observe the documented behaviour each time. - **SC-007**: Magisk is present post-flash in the AXP-like preinstall state and can be fully activated on LAB using documented steps measured from GOLDEN. - **SC-008**: Default WebView is LOS23's; provider selection remains available. - **SC-009**: Owner can perform the GOLDEN-equivalent daily checklist on LAB without consulting a scatter of conflicting feature specs for what “ships”. ## Assumptions - `003` vanilla LOS 23.2 sunfish is (or becomes) available as the integration base; LAB stock rescue from `002` remains valid. - GOLDEN inventory (`002`) plus AXP Pro docs are sufficient to enumerate the capability set; live `adb` re-query of GOLDEN is allowed (especially Magisk preinstall/activation details). - “AXP resurrection” means Magisk + GOLDEN-class hardening/signing/AVB + full AXP user surface on LOS23, with only the stated WebView and Phonesky-artifact exceptions. - Island remains the managed-profile tool because that is what GOLDEN actually runs (AXP docs saying “Insular” are historical naming). - FakeStore is never the primary Play path. - Selectable spoofing and selectable call recording follow the same class of Developer Options UX already explored in `005`/`008` runbooks where useful. - Project `FLAG_SECURE` override is nice-to-have, not an AXP resurrection hard gate. - Personal app/data backup is not a ROM feature gate. - Builds and long compiles run on `rom-dev01`; laptop holds docs/specs and flash tools only. - Prior KernelSU LAB experiments (including the two functional kernels already built) are **out of ship for now** but kept as recyclable assets: reuse if helpful, never required for Magisk acceptance.