sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
5.0 KiB
Research: 007 KernelSU-Next on sunfish
Decision: Defer 006 rootless-Yuh gate; start 007 now
Decision: Do not block on a separate 006 “Yuh green without root”. Absorb
banking regression into 007. A rootless snapshot on the current 005 LAB image is required before root;
its PASS/FAIL outcome is informational and does not block experiments.
Rationale: GOLDEN (Magisk) and LAB iodé (no Magisk, locked BL) both show Yuh
KeyMint/HARDWARE_TYPE_UNAVAILABLE. Rootless is not a known fix.
Alternatives: Force 006 first — rejected. Cancel banking on ROM entirely
before trying KSU stack — premature; try 007 experiment first.
Decision: Yuh PASS is mandatory to accept 007
Decision: Feature closes only when both Yuh and Swissquote work in Island on LAB under
root-denied + verified hide (+ SusFS/attestation stack as needed). Honest
residual FAIL ⇒ 007 incomplete or cancelled — not “KSU done, Yuh later”.
Rationale: Owner (2026-09-15): without Yuh, root adds little vs NeoBackup + native call recording / FLAG_SECURE; denylist-style legitimacy alone is not enough reason to carry KSU. Stock handset remains interim fallback, not acceptance.
Alternatives: Soft gate / document FAIL — rejected by owner.
Decision: Prefer ReSukiSU + TEESimulator for hard-bank PoC (2026-09-15)
Decision: Align LAB banking experiments with torukk/abu field results: ReSukiSU over KernelSU-Next when Revolut-class detection matters; TEESimulator-RS instead of TrickyStore; document Zygisk Next + PIF inject as possible LAB-only exception if required for the Yuh/Swissquote gate.
Rationale: Owner overlap with that project; XDA 2026-08-22; constitution already names ReSukiSU as evaluable fork.
Alternatives: KernelSU-Next-only in-tree first — still useful as build practice, weaker evidence for hard banks.
Decision: Profiles + verified umount before SusFS
Decision: Order: (1) KSU boots + selective root, (2) banking UIDs denied +
mount evidence of hide/path_umount, (3) SusFS, (4) attestation modules.
Rationale: Constitution: SusFS only after KernelSU and application profiles work. GUI toggle alone is insufficient.
Decision: TrickyStore-class → prefer TEESimulator-RS
Decision: Attestation experiment track prefers TEESimulator-RS (TrickyStore compatible drop-in) per owner + torukk; select banking packages only.
Rationale: Community recommendation over original TrickyStore; same slot in the stack.
Decision: Island remains managed-profile vehicle
Decision: Keep Island (already on LAB/GOLDEN) for Yuh/Swissquote unless planning discovers a blocking incompatibility; then document substitute.
Rationale: Matches AXP oracle workflow and existing LAB user 10.
Decision: No Zygisk/LSPosed in initial 007
Decision: Out of default scope. Prefer native ROM features for call-rec /
FLAG_SECURE later (008/009).
Rationale: Constitution.
Decision: Full Graphene/AXP kernel hardening stays 013
Decision: 007 only patches kernel as required for KSU / SusFS / umount.
Do not import broad hardening series here.
Rationale: Constitution progress order; reduces blast radius while chasing Yuh.
Remediation alignment — 2026-09-15
Constitution 0.2.0 explicitly defers 006; T039 records our current rootless
LAB state before kernel changes, without requiring PASS. US5 alone owns banking
acceptance: both Yuh and Swissquote must pass on the same stack. US4 owns
attestation investigation/evidence, not a duplicate acceptance gate. Older
iodé/GOLDEN KeyMint logs are correlations, not proof of our ROM's failure cause.
T040 explicitly verifies the no-Zygisk/LSPosed constraint.
Concrete attestation candidates (not yet selected or validated)
- TrickyStore: https://github.com/5ec1cff/TrickyStore — certificate-chain intervention; current releases closed-source. Record auditability limitations.
- TEESimulator: https://github.com/JingMatrix/TEESimulator — open-source software KeyMint/key-attestation simulation; candidate alternative, not authentic hardware repair. Requires external signing material not bundled.
- TEESimulator-RS: https://github.com/Enginex0/TEESimulator-RS — related alternative; independently verify implementation, dependencies and A16 support.
- BootloaderSpoofer: https://modules.lsposed.org/module/es.chiteroman.bootloaderspoofer/ — LSPosed/Xposed approach, outside FR-009 default; not an approved candidate without a separate explicit scope decision.
T022 selects one concrete candidate before deployment: upstream URL, immutable commit or release with binary hash, license/source availability, dependencies, key-material provenance/availability and rollback. Do not collect keys from unknown sources or commit signing secrets. Evaluate candidates separately, not as a combined stack. No candidate is verified for Yuh on our sunfish yet. KernelSU/SUSFS and Play Integrity modules are not interchangeable substitutes for Key Attestation. A simulator does not itself create a trusted signing chain.