sunfish-admin
deaaf42caa
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
2.6 KiB
Research: 008-call-rec-flag-secure
Decision: Call-rec = AXP GOLDEN / EXTENDROM native model
Decision: Port EXTENDROM F_CALLREC (same behaviour as AXP GOLDEN), not
Magisk Dialer RRO.
GOLDEN evidence: LAB dump already has
extendrom_call_recording=1 in
.local-artifacts/002-golden/20260915-spoofing-phonesky/settings/secure-*.txt.
Mechanism (/srv/rom/references/extendrom/er.sh):
- Overlay Dialer
config.xml:call_recording_enabled=true,call_recording_audio_source=4. - Settings DO: category + legal info + switch
extendrom_call_recording. - Controllers:
ER_CallRecPreferenceController/ER_CallRecInfo→Settings.Secure.ER_ALLOW_ANY_CALL_REC. Settings.java:ER_ALLOW_ANY_CALL_REC = "extendrom_call_recording".- Dialer
CallRecorder.canRecordInCurrentCountry(): if Secure int == 1, returntruebefore country XML map.
Secure key (product): extendrom_call_recording (GOLDEN-compatible).
Do not invent allow_call_recording_any_region for call-rec.
Alternatives rejected:
- Magisk static RRO of
call_record_states.xml— always-on, not native ROM, no DO parity with GOLDEN. - Blind A11 overlay-only without Dialer Java gate — may no-op on A16.
Decision: FLAG_SECURE = AOSP disable_secure_windows + DO
Decision: Do not invent a second frameworks hook. LOS 23.2 / A16 already
has Settings.Secure.DISABLE_SECURE_WINDOWS wired through
WindowManagerService → WindowState.isSecureLocked(). Ship a Developer
Options switch (preference key allow_flag_secure_override) that writes
disable_secure_windows.
Constraint (stock AOSP): WMS applied the setting only on debuggable builds
(ro.debuggable). Project decision (2026-09-18): remove that gate in
updateDisableSecureWindows() (apply_wms_disable_secure_debuggable_gate.py)
so ship images keep ro.debuggable=0 while the DO toggle works. No other
secondary gate found in WindowState.isSecureLocked / Task.isSecure.
LAB userdebug with ro.debuggable=0 was the motivating case.
Alternatives rejected: Magisk services.jar dex patchers as shipping
mechanism.
Decision: Packaging = vendor/sunfish-a16 apply like 005
Idempotent script under patches/008-call-rec-flag-secure/, EXTENDROM/er.sh
attribution for call-rec.
Decision: Combined feature directory
One Spec Kit feature absorbs roadmap 008 + 009.
Decision: No Magisk artifacts in the repo
Owner-supplied Magisk zips were temporary agent aids only; removed from the working tree. Implementation references EXTENDROM + GOLDEN dumps + A16 source inventory.