# Research: 007 KernelSU-Next on sunfish

## Decision: Defer `006` rootless-Yuh gate; start `007` now

**Decision**: Do not block on a separate `006` “Yuh green without root”. Absorb
banking regression into `007`. A rootless snapshot on the current `005` LAB image is required before root;
its PASS/FAIL outcome is informational and does not block experiments.

**Rationale**: GOLDEN (Magisk) and LAB iodé (no Magisk, locked BL) both show Yuh
KeyMint/`HARDWARE_TYPE_UNAVAILABLE`. Rootless is not a known fix.

**Alternatives**: Force `006` first — rejected. Cancel banking on ROM entirely
before trying KSU stack — premature; try `007` experiment first.

## Decision: Yuh PASS is mandatory to accept `007`

**Decision**: Feature closes only when both Yuh and Swissquote work in Island on LAB under
root-denied + verified hide (+ SusFS/attestation stack as needed). Honest
residual FAIL ⇒ `007` incomplete or cancelled — not “KSU done, Yuh later”.

**Rationale**: Owner (2026-09-15): without Yuh, root adds little vs NeoBackup +
native call recording / FLAG_SECURE; denylist-style legitimacy alone is not
enough reason to carry KSU. Stock handset remains interim fallback, not
acceptance.

**Alternatives**: Soft gate / document FAIL — rejected by owner.

## Decision: Prefer ReSukiSU + TEESimulator for hard-bank PoC (2026-09-15)

**Decision**: Align LAB banking experiments with torukk/abu field results:
ReSukiSU over KernelSU-Next when Revolut-class detection matters; **TEESimulator-RS**
instead of TrickyStore; document Zygisk Next + PIF inject as possible LAB-only
exception if required for the Yuh/Swissquote gate.

**Rationale**: Owner overlap with that project; XDA 2026-08-22; constitution
already names ReSukiSU as evaluable fork.

**Alternatives**: KernelSU-Next-only in-tree first — still useful as build
practice, weaker evidence for hard banks.

## Decision: Profiles + verified umount before SusFS

**Decision**: Order: (1) KSU boots + selective root, (2) banking UIDs denied +
**mount evidence** of hide/`path_umount`, (3) SusFS, (4) attestation modules.

**Rationale**: Constitution: SusFS only after KernelSU and application profiles
work. GUI toggle alone is insufficient.

## Decision: TrickyStore-class → prefer TEESimulator-RS

**Decision**: Attestation experiment track prefers **TEESimulator-RS** (TrickyStore
compatible drop-in) per owner + torukk; select banking packages only.

**Rationale**: Community recommendation over original TrickyStore; same slot in
the stack.

## Decision: Island remains managed-profile vehicle

**Decision**: Keep Island (already on LAB/GOLDEN) for Yuh/Swissquote unless
planning discovers a blocking incompatibility; then document substitute.

**Rationale**: Matches AXP oracle workflow and existing LAB user 10.

## Decision: No Zygisk/LSPosed in initial `007`

**Decision**: Out of default scope. Prefer native ROM features for call-rec /
FLAG_SECURE later (`008`/`009`).

**Rationale**: Constitution.

## Decision: Full Graphene/AXP kernel hardening stays `013`

**Decision**: `007` only patches kernel as required for KSU / SusFS / umount.
Do not import broad hardening series here.

**Rationale**: Constitution progress order; reduces blast radius while chasing Yuh.

## Remediation alignment — 2026-09-15

Constitution 0.2.0 explicitly defers `006`; T039 records our current rootless
LAB state before kernel changes, without requiring PASS. US5 alone owns banking
acceptance: both Yuh and Swissquote must pass on the same stack. US4 owns
attestation investigation/evidence, not a duplicate acceptance gate. Older
iodé/GOLDEN KeyMint logs are correlations, not proof of our ROM's failure cause.
T040 explicitly verifies the no-Zygisk/LSPosed constraint.

## Concrete attestation candidates (not yet selected or validated)

- TrickyStore: https://github.com/5ec1cff/TrickyStore — certificate-chain
  intervention; current releases closed-source. Record auditability limitations.
- TEESimulator: https://github.com/JingMatrix/TEESimulator — open-source
  software KeyMint/key-attestation simulation; candidate alternative, not
  authentic hardware repair. Requires external signing material not bundled.
- TEESimulator-RS: https://github.com/Enginex0/TEESimulator-RS — related
  alternative; independently verify implementation, dependencies and A16 support.
- BootloaderSpoofer: https://modules.lsposed.org/module/es.chiteroman.bootloaderspoofer/
  — LSPosed/Xposed approach, outside FR-009 default; not an approved candidate
  without a separate explicit scope decision.

T022 selects one concrete candidate before deployment: upstream URL, immutable
commit or release with binary hash, license/source availability, dependencies,
key-material provenance/availability and rollback. Do not collect keys from
unknown sources or commit signing secrets. Evaluate candidates separately, not
as a combined stack. No candidate is verified for Yuh on our sunfish yet.
KernelSU/SUSFS and Play Integrity modules are not interchangeable substitutes
for Key Attestation. A simulator does not itself create a trusted signing chain.