# Implementation Plan: Call recording unlock + FLAG_SECURE override

**Branch**: `008-call-rec-flag-secure` | **Date**: 2026-09-16 | **Spec**: [spec.md](./spec.md)

**Input**: Feature specification from `/specs/008-call-rec-flag-secure/spec.md`
(roadmap `008` + `009`, global Developer Options toggles only).

## Summary

Ship two native Developer Options switches (same pattern as `005`
`allow_signature_fake`):

1. **Disable call recording restrictions** →
   `Settings.Secure.extendrom_call_recording` (GOLDEN / EXTENDROM
   `ER_ALLOW_ANY_CALL_REC`) — when ON, Dialer
   `CallRecorder.canRecordInCurrentCountry()` allows recording regardless of
   `call_record_states.xml` country flags.
2. **Allow screenshots of secure windows** →
   `Settings.Secure.allow_flag_secure_override` — when ON, system capture
   paths ignore `FLAG_SECURE` globally.

References: AXP GOLDEN Secure dump (`extendrom_call_recording=1`) +
EXTENDROM `er.sh` F_CALLREC / `overlays/call-rec` / `config/call-rec`.
FLAG_SECURE is project-native (not AXP catalog). Re-validate on LOS 23.2 /
A16. No Magisk / LSPosed / Zygisk at runtime. LAB only.

## Technical Context

**Language/Version**: Java (Dialer, Settings, frameworks/base); Secure settings;
optional Kotlin if Settings already uses it for DO controllers  
**Primary Dependencies**: LOS 23.2 Dialer (`CallRecorder`,
`call_record_states.xml`); Settings Developer Options; SystemUI / WM capture
surfaces; EXTENDROM call-rec reference on
`/srv/rom/references/extendrom`  
**Storage**: `Settings.Secure` keys; meta-repo patches under
`vendor/sunfish-a16/patches/008-…`  
**Testing**: LAB flash/`adb`; `settings get/put`; call-record file evidence;
screenshot of secure window; Magisk-free image  
**Target Platform**: Pixel 4a LAB `11231JEC207477`; Android 16 / LOS 23.2  
**Project Type**: Android ROM (Dialer + Settings + frameworks)  
**Performance Goals**: N/A (correctness)  
**Constraints**: LAB only; default OFF; global only (no per-app); attributable
patches; no root modules; legal warning on call-rec UI  
**Scale/Scope**: Two DO preferences; one Dialer gate; one (or few) capture /
`FLAG_SECURE` enforcement sites; docs + LAB evidence

## Constitution Check

*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*

| Gate | Status |
|------|--------|
| LAB only; never GOLDEN | pass |
| Native call recording; re-validate A16 (no blind AXP XML) | pass (Dialer gate located on LOS 23.2) |
| FLAG_SECURE: default stock; user global override; no LSPosed | pass (global only) |
| No Magisk as production stage | pass |
| Small attributable reversible patches | pass (EXTENDROM F_CALLREC / native FLAG_SECURE) |
| Do not pull banking / incomplete `007` into this feature | pass |

**Post-design**: unchanged — FLAG_SECURE is global-only (not planned per-app);
capture paths that stay DRM-blocked must be documented if found on LAB.

## Project Structure

### Documentation (this feature)

```text
specs/008-call-rec-flag-secure/
├── plan.md                 # this file
├── research.md             # Phase 0
├── data-model.md           # Phase 1
├── quickstart.md           # Phase 1
├── contracts/
│   ├── call-recording-surface.md
│   └── flag-secure-surface.md
└── tasks.md                # /speckit-tasks (not this command)
```

### Host + tree

```text
# Meta-repo
vendor/sunfish-a16/patches/008-call-rec-flag-secure/   # apply scripts (to add)
docs/008-009-design.md

# rom-dev01
/srv/rom/src/lineage/packages/apps/Dialer/
  java/com/android/incallui/call/CallRecorder.java     # canRecordInCurrentCountry()
  java/com/android/dialer/callrecord/res/xml/call_record_states.xml
/srv/rom/src/lineage/packages/apps/Settings/           # DO controllers + strings
/srv/rom/src/lineage/frameworks/base/                  # Secure settings + FLAG_SECURE
/srv/rom/references/extendrom/overlays/call-rec/
/srv/rom/references/extendrom/config/call-rec/
/srv/rom/artifacts/008-call-rec-flag-secure/           # LAB evidence
```

**Structure Decision**: Same as `005` — attributable patches applied on the
LOS tree via `vendor/sunfish-a16` scripts; meta-repo holds specs/docs/scripts,
not megapatches of Dialer/frameworks.

## Complexity Tracking

| Violation | Why needed | Simpler alternative rejected because |
|-----------|------------|--------------------------------------|
| Frameworks / SystemUI patches for FLAG_SECURE | Constitution requires native override | Magisk module forbidden in production |
| Dialer patch (not overlay-only) | Country gate is Java `canRecordInCurrentCountry()` | Blind A11 overlay alone does not wire the Secure setting |

## Phase 0 / Phase 1

See `research.md`, `data-model.md`, `contracts/*`, `quickstart.md`.