sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
111 lines
5.1 KiB
Markdown
111 lines
5.1 KiB
Markdown
# Implementation Plan: KernelSU-Next on sunfish (LAB)
|
||
|
||
**Branch**: `007-kernelsu-sunfish` | **Date**: 2026-09-15 | **Spec**: [spec.md](./spec.md)
|
||
|
||
**Input**: Feature specification from `/specs/007-kernelsu-sunfish/spec.md`
|
||
|
||
## Summary
|
||
|
||
Bring **KernelSU-Next** into the LineageOS 23.2 sunfish **4.14** kernel on LAB,
|
||
verify per-app / per-user **root denial + mount hide** for banking UIDs, then
|
||
layer **SusFS** and a **TrickyStore-class** attestation experiment so that
|
||
**Yuh PASS** (Island) becomes achievable. **Yuh PASS is a hard-gate**: without
|
||
it, `007` is incomplete/cancelled — root is not justified vs NeoBackup + native
|
||
`008`/`009` and a stock banking phone.
|
||
|
||
`006` rootless-Yuh-pass is **deferred** and does not block start. Swissquote PASS is also mandatory; Revolut/N26 non-blocking. GOLDEN never flashed.
|
||
|
||
## Technical Context
|
||
|
||
**Language/Version**: Linux 4.14 kernel (C); KernelSU-Next / SusFS integration;
|
||
Android userspace manager APK; bash runbooks on `rom-dev01`
|
||
**Primary Dependencies**: LOS 23.2 sunfish kernel tree; KernelSU-Next (non-GKI
|
||
4.14-capable pin); SusFS; TrickyStore-class (or documented equivalent); `005`
|
||
userspace stack; Island; `002` Yuh/KeyMint logs
|
||
**Storage**: Host `/srv/rom/` kernel outs, module ZIPs, secrets; artifacts under
|
||
`/srv/rom/artifacts/007-…`
|
||
**Testing**: LAB flash only; KSU manager grants; mount/root probes per UID;
|
||
Yuh/Swissquote Island sessions; `keystore2`/KeyMint logcat vs `002`
|
||
**Target Platform**: Pixel 4a LAB `11231JEC207477`; Android 16 / LOS 23.2
|
||
**Project Type**: Android ROM kernel + root stack + LAB validation
|
||
**Performance Goals**: Boot + daily stability; SusFS soak ≥24h if claimed
|
||
**Constraints**: LAB only; no Magisk production; no Zygisk/LSPosed default;
|
||
banking never gets root; attributable kernel commits; Yuh PASS mandatory
|
||
**Scale/Scope**: One kernel integration POC → pin revision → SusFS →
|
||
attestation experiment → banking hard-gate on LAB
|
||
|
||
## Constitution Check
|
||
|
||
*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
|
||
|
||
| Gate | Status |
|
||
|------|--------|
|
||
| LAB only; never GOLDEN | pass |
|
||
| KernelSU-Next is project root (not Magisk production) | pass |
|
||
| Banking apps never receive root; profiles + verified umount | pass |
|
||
| SusFS only after KSU + profiles work | pass (phased US1→US3) |
|
||
| No Zygisk/LSPosed as initial architecture | pass |
|
||
| Small attributable, reversible changes | pass (pinned commits) |
|
||
| `006` before `007` in written order | **amended explicitly in constitution 0.2.0** — rootless Yuh gate deferred; owner-approved sequencing; current-ROM snapshot required (T039) |
|
||
| Hardening Graphene/AXP full ports | out of scope → `013` |
|
||
|
||
**Post-design**: Same. Yuh hard-gate is an owner product gate layered on top of
|
||
constitution Compatibility MVP (Yuh in Insular) — aligned, stricter on `007`
|
||
acceptance.
|
||
|
||
## Project Structure
|
||
|
||
### Documentation (this feature)
|
||
|
||
```text
|
||
specs/007-kernelsu-sunfish/
|
||
├── plan.md
|
||
├── research.md
|
||
├── data-model.md
|
||
├── quickstart.md
|
||
├── contracts/
|
||
│ ├── ksu-hide-surface.md
|
||
│ └── banking-yuh-gate.md
|
||
└── tasks.md # via /speckit-tasks (not this command)
|
||
```
|
||
|
||
### Host + tree
|
||
|
||
```text
|
||
# rom-dev01
|
||
/srv/rom/src/lineage/kernel/… # LOS 23.2 sunfish-compatible kernel
|
||
/srv/rom/src/lineage/… # product builds including boot.img
|
||
/srv/rom/artifacts/007-kernelsu/ # bacon outs, pins, Yuh log packs
|
||
/srv/rom/references/… # optional mirrors of KSU/SusFS/TrickyStore docs
|
||
|
||
# Meta repo
|
||
docs/002-*-*.md # Yuh/KeyMint baselines (read-only input)
|
||
docs/reference-sources.md §8–10 # community inspiration, not base
|
||
docs/a15-a16-delta.md # attestation notes as measured
|
||
```
|
||
|
||
**Structure Decision**: Kernel work lives on `rom-dev01` LOS tree; meta-repo
|
||
keeps specs, contracts, runbooks, and pin records. No Magisk tree. No megapatch
|
||
dumps in Git — pin URLs/commits + small project patches only.
|
||
|
||
## Complexity Tracking
|
||
|
||
| Violation / stretch | Why needed | Simpler alternative rejected because |
|
||
|---------------------|------------|--------------------------------------|
|
||
| Start `007` without closing `006` rootless Yuh | `002` shows Yuh fails with and without Magisk (KeyMint/RKP) | Waiting on rootless Yuh green has no known path |
|
||
| SusFS + TrickyStore-class in same feature as KSU | Owner: Yuh PASS mandatory; hide alone insufficient on GOLDEN | KSU-only “done” without Yuh → root not worth keeping |
|
||
| Yuh PASS hard-gate on EOL sunfish | Product rationale: else stock phone + `008`/`009` | Soft FAIL documentation wastes a root maintenance burden |
|
||
|
||
## Phase 0 / Phase 1
|
||
|
||
See `research.md`, `data-model.md`, `contracts/*`, `quickstart.md`.
|
||
|
||
## Remediation alignment — 2026-09-15
|
||
|
||
Constitution 0.2.0 explicitly defers `006`; T039 records our current rootless
|
||
LAB state before kernel changes, without requiring PASS. US5 alone owns banking
|
||
acceptance: both Yuh and Swissquote must pass on the same stack. US4 owns
|
||
attestation investigation/evidence, not a duplicate acceptance gate. Older
|
||
iodé/GOLDEN KeyMint logs are correlations, not proof of our ROM's failure cause.
|
||
T040 explicitly verifies the no-Zygisk/LSPosed constraint.
|