AXP-Resurection/specs/008-call-rec-flag-secure/quickstart.md

Quickstart: 008 call-rec + FLAG_SECURE (LAB)

Device: LAB only 11231JEC207477
Build: bacon/image with 008-call-rec-flag-secure applied
Evidence root: /srv/rom/artifacts/008-call-rec-flag-secure/

Prerequisites

• Magisk not required (must work without it).
• Developer Options enabled.
• Contracts: call-recording-surface.md, flag-secure-surface.md.

1. Defaults

adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
adb -s 11231JEC207477 shell settings get secure disable_secure_windows
# expect 0 or null

2. Call recording (region unlock)

1. Open Developer Options → enable Disable call recording restrictions.
2. Confirm:

adb shell settings get secure extendrom_call_recording
# expect 1

3. Place or receive a call with Dialer → start recording → stop → confirm file (Downloads / Dialer recordings — note path).
4. Disable the switch (or turn off Developer Options) → confirm setting 0 and that a restricted country would hide/deny record (or document LAB country ISO + XML flag).

Store notes + path under …/call-rec/.

3. FLAG_SECURE override

1. Enable Allow screenshots of secure windows in Developer Options.
2. Confirm:

adb shell settings get secure disable_secure_windows
# expect 1

3. Open an app/window that sets FLAG_SECURE (e.g. password manager, banking login, or a tiny test APK).
4. With toggle OFF: system screenshot should fail / blank.
5. With toggle ON: screenshot or screen record should succeed.
6. Toggle OFF again → secure behaviour restored.

Store images/notes under …/flag-secure/.

4. Pass criteria

• Both settings default OFF after fresh boot / DO off
• Call-rec ON → recording works; OFF → stock policy
• FLAG_SECURE ON → capture works; OFF → blocked
• No Magisk installed for the successful run

Notes

• User is responsible for call-recording legality.
• DRM-protected surfaces may still resist capture; note exceptions.
• user build retest before release claims (011).