AXP-Resurection/specs/007-kernelsu-sunfish/quickstart.md

Quickstart: 007 KernelSU + Yuh gate (LAB only)

Device: LAB 11231JEC207477 — never GOLDEN 11071JEC203839

Goal

Prove selective root + verified hide, then Yuh and Swissquote PASS in Island. Without both banks passing, do not declare 007 done.

Prerequisites

• Working 005 userspace stack on LAB (microG + Phonesky + spoofing)
• 007 boot image with pinned KernelSU-Next
• Island installed; Aurora available
• Baseline reading: docs/002-golden-inventory.md, docs/002-lab-iodes-baseline.md

1. Flash LAB

Use docs/003-flash-lab.md with the 007 artifact. Confirm:

SERIAL=11231JEC207477
adb -s "$SERIAL" shell getprop ro.lineage.version
# KernelSU manager present; grant root to one debug app only

2. Hide surface

1. Deny root for com.yuh and com.swissquote.android (all relevant users).
2. Enable umount/hide for those UIDs.
3. Verify mounts from a probe — see contracts/ksu-hide-surface.md.

3. SusFS (after step 2 green)

Enable SusFS per pin; confirm boot; re-check hide. Soak before claiming.

4. Attestation experiment

Apply TrickyStore-class (or equivalent) + any microG HA toggles under test. Capture logcat around Yuh open (keystore2, KeyMint, RKP).

5. Banking (Island)

1. Aurora install Yuh/Swissquote → do not open on owner if following AXP order.
2. Clone into Island; first launch in Island.
3. Swissquote: must PASS a usable authenticated session.
4. Yuh: must PASS for feature acceptance (contracts/banking-yuh-gate.md).

Pass criteria

• KSU selective root works
• Banking UIDs: root deny + verified hide
• SusFS claimed only if stable
• Yuh PASS in Island with evidence under /srv/rom/artifacts/007-…
• Swissquote PASS on the same stack
• No Magisk production image

Failure

If either bank remains unusable after reasonable SusFS/attestation iterations: stop, keep artifacts, mark 007 blocked — consider stock phone for banks; do not ship “root without Yuh” as success.

Before any rooted flash, complete T039. Before acceptance complete T040.