AXP-Resurection/specs/007-kernelsu-sunfish/contracts/banking-yuh-gate.md

Contract: Yuh hard-gate (banking)

Feature: 007-kernelsu-sunfish
Device: LAB 11231JEC207477 only

Hard-gate

App	Profile	Required outcome to accept 007
Yuh (com.yuh)	Island (work user)	PASS — usable authenticated session
Swissquote	Island	PASS — usable authenticated session; does not waive Yuh
N26 / Revolut	any	Non-blocking

Preconditions for a valid Yuh PASS attempt

1. Build includes KernelSU-Next pin under test.
2. Yuh UID(s) have root deny + verified mount hide (ksu-hide-surface.md).
3. Install path prefers Aurora → do not open → Island clone → first launch in Island (AXP-like); document deviations.
4. Attestation/SusFS experiments in use are listed with revisions.

FAIL handling

• Capture keystore2 / KeyMint / RKP / Yuh UI error (compare 002).
• Iterate SusFS/attestation pins; do not mark feature done.
• Exhausted options → 007 incomplete or cancelled; prefer stock phone for banks rather than shipping root without Yuh.

PASS evidence package

• Build id + date
• Profile user id
• Stack pins (KSU, SusFS, modules)
• Short log excerpt showing absence of prior HARDWARE_TYPE_UNAVAILABLE class or explicit note if a different success path applies
• Stored under /srv/rom/artifacts/007-kernelsu/…

US5 exclusively owns acceptance. Both banks must pass on the same build/stack; failure of either keeps the feature incomplete or triggers withdrawal of root.