# Data model: 007 KernelSU / banking gate

Conceptual entities for validation and artifact tracking (not a database schema).

## KernelSU pin

| Field | Meaning |
|-------|---------|
| `project` | KernelSU-Next (or documented ReSukiSU fallback) |
| `revision` | Exact git tag or commit |
| `kernel_base` | LOS 23.2 sunfish-compatible 4.14 tree identity |
| `boot_build_id` | `ro.lineage.version` / display id of accepting image |
| `status` | `poc` → `pinned` → `withdrawn` |

## SusFS pin (optional until enabled)

| Field | Meaning |
|-------|---------|
| `enabled` | boolean on accepting build |
| `revision` | tag/commit if separate |
| `soak_hours` | observed soak before claim |
| `status` | `off` / `trial` / `claimed` / `reverted` |

## App profile (per package × userId)

| Field | Meaning |
|-------|---------|
| `package` | e.g. `com.yuh` |
| `user_id` | 0 owner, 10 Island, … |
| `root_grant` | MUST be `deny` for banking targets |
| `umount_or_hide` | `verified` / `unverified` / `failed` |
| `evidence_path` | artifact log/screenshot |

## Banking session result

| Field | Meaning |
|-------|---------|
| `app` | Yuh \| Swissquote |
| `profile` | Island / owner |
| `build_id` | ROM build under test |
| `stack` | KSU ± SusFS ± attestation modules (names + pins) |
| `outcome` | `PASS` \| `FAIL` |
| `fail_class` | e.g. KeyMint/`HARDWARE_TYPE_UNAVAILABLE`, UI, network |
| `log_refs` | paths under `/srv/rom/artifacts/007-…` |
| `date` | ISO date |

**Rule**: Feature acceptance requires one **Yuh** and one **Swissquote** row on the same build/stack with
`outcome=PASS` on LAB Island under root-denied + hide-verified stack.

## Attestation experiment run

| Field | Meaning |
|-------|---------|
| `modules_or_toggles` | TrickyStore-class + microG HA notes |
| `baseline_ref` | `002` Yuh log pack |
| `result_ref` | new log pack |
| `delta` | same error class / improved / resolved |

## State transitions (feature)

```text
ksu_poc → profiles_verified → susfs_optional → attestation_trial
        → both_banks_pass (GATE) → 007_accepted
        ↘ either_bank_fail_exhausted → 007_incomplete_or_cancelled
```