# Feature Specifications

Numbered feature specs for `sunfish-a16-rom`.

## Structure

```text
specs/
└── NNN-short-name/
    ├── spec.md      # Only human-maintained requirements source
    ├── plan.md      # Derived — regenerate after spec changes
    ├── tasks.md     # Derived — regenerate after spec changes
    └── …
```

## Numbering

- Three-digit, sequential: `001-…`, `002-…`
- Short name: lowercase, hyphen-separated
- Create a feature directory only when ready to specify/implement it

## Spec-as-source

1. Edit requirements only in `spec.md`.
2. Run `/speckit-plan` and `/speckit-tasks` to regenerate derived artifacts.
3. Implementation follows the active feature; do not invent decisions missing
   from the constitution or the active `spec.md`.

## Active / next features

| Dir | Intent |
|-----|--------|
| `001-development-environment` | ROM build host env on existing `rom-dev01` (not VM creation) |
| `002-axp-reference-capture` | Document GOLDEN AXP oracle + LAB stock rescue; no NeoBackup/wipe of GOLDEN |
| `003-lineage-23-vanilla-build` | First vanilla LOS 23.2 on **LAB only** → flash → boot → P1 (**done** 2026-09-14) |
| `004-microg-phonesky-integration` | microG + GSF Proxy + patched Phonesky on LAB (packaging done; Self-Check/auth → `005`) |
| `005-restricted-signature-spoofing` | Restricted spoofing + bacon zip — **done enough for LAB**; Location UI follow-up open |
| `007-kernelsu-sunfish` | ReSukiSU + SusFS bring-up — **incomplete** (banks FAIL; see `docs/007-lab-results-20260916.md`) |
| `008-call-rec-flag-secure` | Native DO toggles: call-rec region unlock + global FLAG_SECURE override — **next** |

Handoff snapshot: `docs/session-20260916-handoff.md`.  
Design: `docs/008-009-design.md`.

## Roadmap (non-binding)

Later features are created only when prior work supplies enough information.
Numbers may shift; this list is guidance, not stubs:

| # | Theme |
|---|--------|
| 004 | microG + GSF Proxy + patched Phonesky |
| 005 | Restricted native signature spoofing (bacon shipped; **Location UI gap** follow-up) |
| 006 | **Rootless** banking baseline — **deferred** (absorbed into `007` gate) |
| 007 | ReSukiSU + SusFS — **incomplete** (banking hard-gate FAIL) |
| 008+009 | Delivered together as `008-call-rec-flag-secure` (global DO toggles only) |
| 010 | Remaining AXP Pro usability/privacy features (matrix spans 004–013; NeoBackup is external) |
| 011 | Signing / AVB / OTA + banking regression on signed/relocked ROM |
| 012 | Userspace hardening (promote from `docs/hardening-backlog.md`) |
| 013 | Kernel hardening + EOL firmware limits documentation |

## New feature

```text
/speckit-specify
```