# 009 AXP LOS23 port — patch / packaging README

**Track**: Magisk AXP resurrection on LOS 23.2 sunfish (`AXP_Resurection`).  
**Not ship**: KernelSU / SusFS (`007` standby / optional recycle only).

## Apply order (host tree under `/srv/rom/src/lineage/`)

1. **Google stack** — `vendor/sunfish-a16/gms.mk` + `Android.mk` (microG, GSF,
   Phonesky). Host APKs: `/srv/rom/prebuilts/{microg,phonesky}/` (never Git).
2. **Signature spoofing** — `vendor/sunfish-a16/patches/005-sigspoof/`
   (`apply_005_sigspoof.py`). Attribute: LOS restricted spoofing + AXP/005.
3. **Call recording unlock** — `vendor/sunfish-a16/patches/008-call-rec-flag-secure/`
   (`extendrom_call_recording`). Attribute: EXTENDROM `F_CALLREC`.
4. **Magisk preroot** — EXTENDROM-class boot/`init_boot` patch using Magisk APK
   from `/srv/rom/prebuilts/magisk/` (see `docs/009-magisk-preinstall-runbook.md`).
   Stub: `vendor/sunfish-a16/magisk.mk`. Attribute: Magisk upstream + sfX
   extendrom Magisk patcher. **Shipped on LAB (2026-10):** Magisk 30.7 preroot
   via host EXTENDROM at `/srv/rom/references/extendrom/` (wired by the ship
   bacon). Do not treat the old “blocked on T011” note as current.
5. **Bundled apps** — `/srv/rom/prebuilts/axp-apps/` + `apps.mk` (Aurora,
   Droidify, Fossify Gallery). Symlink APKs into `vendor/sunfish-a16/prebuilt/`.
6. **Private DNS presets** — `apply_009_private_dns_providers.py` (GOLDEN list).
7. **Internet connectivity check** — `apply_009_connectivity_check.py` (GOLDEN
   list **minus** AXP.OS / `axpos.org`).
8. **Disable for user apps** — `apply_009_disable_user_apps.py` (SPA gate).
9. **Userspace hardening / signing** — staged: see `signing/README.md`,
   `hardening/README.md` (US-S4-1 OpenSSH trim), and
   `docs/009-hardening-signing-checklist.md` (US-S1 keys → US-S2 wire →
   US-S3 AVB → US-S4+ harden). Bootloader lock = wont.
10. **Kernel hardening** — LOS23 `msm-4.14` + map in
   `docs/009-kernel-hardening-map.md` (FR-017). Stage 1:
   `vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh`
   (AXP Graphene/AH allowlist). Priority: AXP → LOS → Iodé → optional
   Graphene; no Divest hunt; no extra location lockdown.
11. **2026-10-16 polish** (ship bacon) — `apply_009_euicc_disabler_guard.py`,
    `apply_009_thermal_cdev_log.py`; wave4
    `apply_009_drop_lab_only_commands.py` must **keep/restore**
    `disable_configstore`. Details: `docs/009-lab-polish-20261016.md`.

## Product includes

Wire Magisk-resurrection product from `vendor/sunfish-a16/` into
`lineage_sunfish` (same pattern as `004`/`005`). Keep Phonesky priv-app path.
**No FakeStore. No KernelSU product packages.**

## Deferred

- Banking Gate E / Island validation (owner future).
- Localization AXP-vs-LOS compare (`docs/009-localization-axp-vs-los.md` stub).

## Host paths (rom-dev01)

| What | Path |
|------|------|
| Magisk APK | `/srv/rom/prebuilts/magisk/Magisk-v30.7.apk` |
| EXTENDROM Magisk patcher | `/srv/rom/references/extendrom/config/magisk/` |
| Kernel source | `/srv/rom/src/lineage/kernel/google/msm-4.14` |
| Product include (gms) | `device/google/sunfish/lineage_sunfish.mk` → `vendor/sunfish-a16/gms.mk` |
| Vanilla baseline | `/srv/rom/artifacts/003-vanilla/20260914-lineage-23.2-sunfish/` |
| Optional KSU boots | `/srv/rom/artifacts/007-kernelsu/` (non-ship) |

**Host wiring (current):** EXTENDROM Magisk patcher lives under
`/srv/rom/references/extendrom/` and is invoked by
`scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh`. Magisk APK pin:
`/srv/rom/prebuilts/magisk/Magisk-v30.7.apk`.