# Quickstart: 007 KernelSU + Yuh gate (LAB only)

**Device**: LAB `11231JEC207477` — never GOLDEN `11071JEC203839`

## Goal

Prove selective root + verified hide, then **Yuh and Swissquote PASS** in Island. Without both banks
passing, do not declare `007` done.

## Prerequisites

- Working `005` userspace stack on LAB (microG + Phonesky + spoofing)
- `007` boot image with pinned KernelSU-Next
- Island installed; Aurora available
- Baseline reading: `docs/002-golden-inventory.md`, `docs/002-lab-iodes-baseline.md`

## 1. Flash LAB

Use `docs/003-flash-lab.md` with the `007` artifact. Confirm:

```bash
SERIAL=11231JEC207477
adb -s "$SERIAL" shell getprop ro.lineage.version
# KernelSU manager present; grant root to one debug app only
```

## 2. Hide surface

1. Deny root for `com.yuh` and `com.swissquote.android` (all relevant users).
2. Enable umount/hide for those UIDs.
3. **Verify mounts** from a probe — see `contracts/ksu-hide-surface.md`.

## 3. SusFS (after step 2 green)

Enable SusFS per pin; confirm boot; re-check hide. Soak before claiming.

## 4. Attestation experiment

Apply TrickyStore-class (or equivalent) + any microG HA toggles under test.
Capture logcat around Yuh open (`keystore2`, KeyMint, RKP).

## 5. Banking (Island)

1. Aurora install Yuh/Swissquote → do not open on owner if following AXP order.
2. Clone into Island; first launch in Island.
3. Swissquote: must PASS a usable authenticated session.
4. Yuh: **must PASS** for feature acceptance (`contracts/banking-yuh-gate.md`).

## Pass criteria

- [ ] KSU selective root works  
- [ ] Banking UIDs: root deny + verified hide  
- [ ] SusFS claimed only if stable  
- [ ] **Yuh PASS** in Island with evidence under `/srv/rom/artifacts/007-…`  
- [ ] Swissquote PASS on the same stack  
- [ ] No Magisk production image  

## Failure

If either bank remains unusable after reasonable SusFS/attestation
iterations: stop, keep artifacts, mark `007` blocked — consider stock phone for
banks; do not ship “root without Yuh” as success.

Before any rooted flash, complete T039. Before acceptance complete T040.