# Implementation Plan: KernelSU-Next on sunfish (LAB)

**Branch**: `007-kernelsu-sunfish` | **Date**: 2026-09-15 | **Spec**: [spec.md](./spec.md)

**Input**: Feature specification from `/specs/007-kernelsu-sunfish/spec.md`

## Summary

Bring **KernelSU-Next** into the LineageOS 23.2 sunfish **4.14** kernel on LAB,
verify per-app / per-user **root denial + mount hide** for banking UIDs, then
layer **SusFS** and a **TrickyStore-class** attestation experiment so that
**Yuh PASS** (Island) becomes achievable. **Yuh PASS is a hard-gate**: without
it, `007` is incomplete/cancelled — root is not justified vs NeoBackup + native
`008`/`009` and a stock banking phone.

`006` rootless-Yuh-pass is **deferred** and does not block start. Swissquote PASS is also mandatory; Revolut/N26 non-blocking. GOLDEN never flashed.

## Technical Context

**Language/Version**: Linux 4.14 kernel (C); KernelSU-Next / SusFS integration;
Android userspace manager APK; bash runbooks on `rom-dev01`  
**Primary Dependencies**: LOS 23.2 sunfish kernel tree; KernelSU-Next (non-GKI
4.14-capable pin); SusFS; TrickyStore-class (or documented equivalent); `005`
userspace stack; Island; `002` Yuh/KeyMint logs  
**Storage**: Host `/srv/rom/` kernel outs, module ZIPs, secrets; artifacts under
`/srv/rom/artifacts/007-…`  
**Testing**: LAB flash only; KSU manager grants; mount/root probes per UID;
Yuh/Swissquote Island sessions; `keystore2`/KeyMint logcat vs `002`  
**Target Platform**: Pixel 4a LAB `11231JEC207477`; Android 16 / LOS 23.2  
**Project Type**: Android ROM kernel + root stack + LAB validation  
**Performance Goals**: Boot + daily stability; SusFS soak ≥24h if claimed  
**Constraints**: LAB only; no Magisk production; no Zygisk/LSPosed default;
banking never gets root; attributable kernel commits; Yuh PASS mandatory  
**Scale/Scope**: One kernel integration POC → pin revision → SusFS →
attestation experiment → banking hard-gate on LAB

## Constitution Check

*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*

| Gate | Status |
|------|--------|
| LAB only; never GOLDEN | pass |
| KernelSU-Next is project root (not Magisk production) | pass |
| Banking apps never receive root; profiles + verified umount | pass |
| SusFS only after KSU + profiles work | pass (phased US1→US3) |
| No Zygisk/LSPosed as initial architecture | pass |
| Small attributable, reversible changes | pass (pinned commits) |
| `006` before `007` in written order | **amended explicitly in constitution 0.2.0** — rootless Yuh gate deferred; owner-approved sequencing; current-ROM snapshot required (T039) |
| Hardening Graphene/AXP full ports | out of scope → `013` |

**Post-design**: Same. Yuh hard-gate is an owner product gate layered on top of
constitution Compatibility MVP (Yuh in Insular) — aligned, stricter on `007`
acceptance.

## Project Structure

### Documentation (this feature)

```text
specs/007-kernelsu-sunfish/
├── plan.md
├── research.md
├── data-model.md
├── quickstart.md
├── contracts/
│   ├── ksu-hide-surface.md
│   └── banking-yuh-gate.md
└── tasks.md                 # via /speckit-tasks (not this command)
```

### Host + tree

```text
# rom-dev01
/srv/rom/src/lineage/kernel/…     # LOS 23.2 sunfish-compatible kernel
/srv/rom/src/lineage/…            # product builds including boot.img
/srv/rom/artifacts/007-kernelsu/  # bacon outs, pins, Yuh log packs
/srv/rom/references/…             # optional mirrors of KSU/SusFS/TrickyStore docs

# Meta repo
docs/002-*-*.md                   # Yuh/KeyMint baselines (read-only input)
docs/reference-sources.md §8–10   # community inspiration, not base
docs/a15-a16-delta.md             # attestation notes as measured
```

**Structure Decision**: Kernel work lives on `rom-dev01` LOS tree; meta-repo
keeps specs, contracts, runbooks, and pin records. No Magisk tree. No megapatch
dumps in Git — pin URLs/commits + small project patches only.

## Complexity Tracking

| Violation / stretch | Why needed | Simpler alternative rejected because |
|---------------------|------------|--------------------------------------|
| Start `007` without closing `006` rootless Yuh | `002` shows Yuh fails with and without Magisk (KeyMint/RKP) | Waiting on rootless Yuh green has no known path |
| SusFS + TrickyStore-class in same feature as KSU | Owner: Yuh PASS mandatory; hide alone insufficient on GOLDEN | KSU-only “done” without Yuh → root not worth keeping |
| Yuh PASS hard-gate on EOL sunfish | Product rationale: else stock phone + `008`/`009` | Soft FAIL documentation wastes a root maintenance burden |

## Phase 0 / Phase 1

See `research.md`, `data-model.md`, `contracts/*`, `quickstart.md`.

## Remediation alignment — 2026-09-15

Constitution 0.2.0 explicitly defers `006`; T039 records our current rootless
LAB state before kernel changes, without requiring PASS. US5 alone owns banking
acceptance: both Yuh and Swissquote must pass on the same stack. US4 owns
attestation investigation/evidence, not a duplicate acceptance gate. Older
iodé/GOLDEN KeyMint logs are correlations, not proof of our ROM's failure cause.
T040 explicitly verifies the no-Zygisk/LSPosed constraint.