# Data model: `009-axp-los23-port`

## Entities

### VanillaBaseline

| Field | Type | Rules |
|-------|------|--------|
| source | string | `003` LOS 23.2 sunfish (or documented equivalent) |
| manifest_rev | string | recorded repo manifest revision |
| lab_smoke | enum | `pass` required before AXP integrate stages |

### AxpCapabilitySet

| Field | Type | Rules |
|-------|------|--------|
| category | string | e.g. google-stack, magisk, banking, call-rec, bundled-apps, hardening |
| golden_ref | string | pointer into `002` / AXP Pro row |
| status | enum | `required` \| `exception` \| `impossible` |
| notes | string | WebView=exception; others default required |

### VersionPinRecord

| Field | Type | Rules |
|-------|------|--------|
| component | string | microG, GSF, Magisk, Island, Aurora, … |
| version_name | string | human version |
| version_code | int/string | as applicable |
| upstream_ref | string | tag/commit/URL |
| policy | enum | `newest_stable` \| `project_phonesky` \| `los_default` |
| verified_on | date | LAB verification date |

**Phonesky row**: `policy=project_phonesky` — must match host artifact id, not
“newest Play on internet”.

### PhoneskyHostArtifact

| Field | Type | Rules |
|-------|------|--------|
| path | string | under `/srv/rom/prebuilts/phonesky/` (not Git) |
| package | string | `com.android.vending` |
| signature | string | project/patch pipeline identity |
| privapp | bool | must be true |
| golden_fix_gap | bool | if true → halt acceptance / reconsider |

### MagiskPreinstallState

| Field | Type | Rules |
|-------|------|--------|
| magisk_version | string | newest stable verified |
| layout | string | measured GOLDEN/AXP preinstalled-not-fully-activated |
| activated_on_lab | bool | true after owner completes setup |
| denylist | set | banking packages hidden from root |

**Transitions**: `flashed_preinstall` → `activated` → `denylist_configured`
→ `banking_ready`.

### SecureToggle

| Field | Type | Rules |
|-------|------|--------|
| key | string | `allow_signature_fake` or `extendrom_call_recording` |
| value | int | `0` default / `1` on |
| surface | string | Developer Options |

### ManagedProfileBanking

| Field | Type | Rules |
|-------|------|--------|
| tool | string | Island (`com.oasisfeng.island…`) |
| swissquote | enum | `pass` required |
| yuh | enum | `pass` \| `fail_attestation_like_golden` \| `fail_regression` |
| root_to_banks | bool | must be false |

### WebViewPolicy

| Field | Type | Rules |
|-------|------|--------|
| default_provider | string | LOS23 WebView |
| aosmium | bool | must be false (not required/shipped) |
| chooser_unlocked | bool | must be true |

### LabAcceptanceBuild

| Field | Type | Rules |
|-------|------|--------|
| artifact_dir | string | `/srv/rom/artifacts/009-axp-los23-port/…` |
| hashes | map | SHA-256 of flashables |
| version_pins | ref | VersionPinRecord set |
| gates | ref | contracts/acceptance-gates.md checklist |

### OptionalKsuRecycleAsset

| Field | Type | Rules |
|-------|------|--------|
| path | string | existing `007` kernel/artifact |
| used_for | string | optional debug/reference |
| ship | bool | always false unless future spec says otherwise |

## Relationships

- `LabAcceptanceBuild` includes one `VersionPinRecord` set + Magisk state +
  toggle defaults + banking results + WebViewPolicy.
- `PhoneskyHostArtifact` feeds product packaging; never stored in Git.
- `AxpCapabilitySet` drives which bundled packages appear in pins.
- `OptionalKsuRecycleAsset` must not appear as required on acceptance gates.