# US-S4-1 — drop Lineage product OpenSSH binaries / rsync / procmem

**Track**: AXP Resurection Pro (Magisk), unlocked sunfish.  
**Not**: slim variant; not bootloader lock; not Yama (kernel).

## AXP reference (mandatory)

Oracle: `AXP.OS-22.2-20260324-PRO-sunfish.zip` → `payload.bin` → `product.img`
(+ GOLDEN `ro.lineage.version=22.2-2026.003-sunfish-pro`, Android 15):

| Path | AXP PRO (A15) |
|------|----------------|
| `/bin/sshd`, `ssh`, `scp`, `sftp`, `ssh-keygen`, `start-ssh` | **absent** |
| `/bin/rsync`, `/bin/procmem` | **absent** |
| `/etc/init/init.openssh.rc` | **present** (`mkdir /data/ssh*`) |

### Was this an A16 Lineage add?

**No.** Lineage `vendor/lineage/config/common.mk` has shipped the Openssh
block since 2012; lineage-20 / 21 / 22.2 all still include it. AXP PRO on
A15 therefore **actively omitted** the binaries (same lineage generation
still lists them upstream). Public `AXP.OS/android_vendor_lineage`
`upstream_*` mirrors keep the Lineage Openssh block — use the **PRO zip /
GOLDEN**, not that mirror, as product oracle.

## What we ship

Match AXP PRO product surface by stripping Lineage `common.mk` package
adds (see `apply_009_drop_openssh_packages.py`) — a plain
`PRODUCT_PACKAGES := $(filter-out …)` inherit did **not** drop `sshd` from
ship `20261002T125259Z`:

- Remove packages: `scp`, `sftp`, `ssh`, `sshd`, `sshd_config`, `ssh-keygen`,
  `start-ssh`, `rsync`, `procmem` (debug)
- **Keep** `init.openssh.rc` copy (AXP has it)

Remote shell / file transfer on this track remains **adb** (+ Magisk); the
rc only creates `/data/ssh*` and does not start `sshd` without the binary.

## Verify (LAB after flash)

```text
adb shell ls /product/bin/sshd                    # expect: No such file
adb shell ls /product/bin/rsync                   # expect: No such file
adb shell ls /product/etc/init/init.openssh.rc    # expect: present (AXP)
adb shell pidof magiskd                           # expect: non-empty
```

## US-S4-2 — drop Jelly + Gallery2 (AXP PRO product)

**Oracle**: same PRO zip — `product/app` has **no** Jelly / Gallery2;
`system_ext` ships Fossify + `noDefaultBrowserWebView`. Inventory:
`docs/009-axp-pro-product-apps-20260324.md`.

- `apply_009_drop_jelly_gallery2.py` — remove Lineage `PRODUCT_PACKAGES`
  adds for Jelly / Gallery2
- `NoLineageJelly` uninstallable override module (AXP stub class)
- Keep `FossifyGallery` (already overrides Gallery/Gallery2/Glimpse)

LAB after flash: no `/product/app/Jelly`, no `/product/app/Gallery2`,
FossifyGallery present.

## Out of scope

- `CONFIG_SECURITY_YAMA` (kernel / US-S5 — unset like GOLDEN since 2026-10-10; scope 2 broke PairIP)
- Switching lunch to `user` (US-S6)
- NeoLauncher / Aosmium (wont / exception)