AXP-Resurection/specs/008-call-rec-flag-secure/spec.md

# Feature Specification: Call recording unlock + FLAG_SECURE override

**Feature Branch**: `008-call-rec-flag-secure`  
**Created**: 2026-09-16  
**Status**: Draft  
**Input**: Deliver constitution items `008` and `009` together as native ROM
features with two Developer Options toggles (global only). Call recording =
disable region/country restrictions via **AXP GOLDEN / EXTENDROM native**
`extendrom_call_recording` DO gate. FLAG_SECURE = optional global allow
screenshots/capture of secure windows (native frameworks + DO). Pattern
matches `005` DO style. No LSPosed/Zygisk/Magisk runtime. LAB only.

**Design**: [`docs/008-009-design.md`](../../docs/008-009-design.md)

## Absorbs roadmap

| # | Theme | In this feature |
|---|--------|-----------------|
| 008 | Unrestricted call recording (region) | Yes |
| 009 | FLAG_SECURE override | Yes — **global only** |

## User Scenarios & Testing *(mandatory)*

### User Story 1 - Call recording region unlock toggle (Priority: P1)

As a LAB/daily-driver user, I can enable **Disable call recording
restrictions** under Developer Options. When ON, the Dialer no longer blocks
recording solely because of country/region rules. When OFF, stock LOS
restrictions apply.

**Why this priority**: Core `008` value; small surface; matches EXTENDROM/AXP
intent without porting full AXP recording UX.

**Independent Test**: Toggle setting; `settings get secure
extendrom_call_recording`; attempt call recording on LAB Dialer with
toggle on vs off.

**Acceptance Scenarios**:

1. **Given** a build with this feature on LAB, **When** Developer Options is
   opened, **Then** a switch for disabling call-recording region restrictions
   is visible (with a short legal responsibility summary).
2. **Given** the switch is OFF (default), **When** Dialer evaluates recording
   eligibility, **Then** stock country/region rules apply.
3. **Given** the switch is ON, **When** the user records a call with the
   system Dialer, **Then** recording is not refused solely due to region /
   country policy, and a recording artifact is produced.
4. **Given** Developer Options is disabled globally, **When** that happens,
   **Then** `extendrom_call_recording` returns to `0`.

---

### User Story 2 - Global FLAG_SECURE / screenshot override (Priority: P1)

As a LAB/daily-driver user, I can enable **Allow screenshots of secure
windows** under Developer Options. When ON, screenshots and screen capture
work even if apps set `FLAG_SECURE`. When OFF, Android’s normal secure-window
behaviour applies. The override is **global** (all apps).

**Why this priority**: Constitution `009` project requirement; same DO pattern
as spoofing.

**Independent Test**: App or screen that sets `FLAG_SECURE`; capture with
toggle OFF (expect fail) and ON (expect success);
`settings get secure disable_secure_windows`.

**Acceptance Scenarios**:

1. **Given** a build with this feature on LAB, **When** Developer Options is
   opened, **Then** a switch for secure-window screenshot override is visible.
2. **Given** the switch is OFF (default), **When** the user tries to screenshot
   a `FLAG_SECURE` window, **Then** capture is blocked as on stock.
3. **Given** the switch is ON, **When** the user screenshots or screen-records
   that same window, **Then** capture succeeds.
4. **Given** Developer Options is disabled globally, **When** that happens,
   **Then** `disable_secure_windows` returns to `0`.

---

### User Story 3 - Native, attributable packaging (Priority: P2)

As a maintainer, both behaviours ship in the bacon/ROM tree via
`vendor/sunfish-a16` patches (idempotent apply), sourced from EXTENDROM /
AXP GOLDEN call-rec (and native FLAG_SECURE work), without Magisk modules.

**Why this priority**: Constitution: native ROM, attributable, reversible.

**Independent Test**: Patch script dry-run; tree markers; no Magisk zip in
artifacts required for the feature to work after flash.

**Acceptance Scenarios**:

1. **Given** a clean LOS tree after `repo sync`, **When** the apply script
   runs, **Then** it is idempotent and records source attribution.
2. **Given** a flashed LAB image, **When** Magisk is not installed, **Then**
   both toggles still function.

---

### Edge Cases

- Dialer path renamed on A16 → re-locate gate; do not assume A11 overlay paths.
- Call recording legal in some jurisdictions only → UI must warn; feature does
  not claim legality.
- Some capture paths (DRM / hardware buffers) may still block — document if a
  specific path remains blocked after toggle ON.
- `user` builds: follow same policy as `005` for whether DO toggles are
  available (document decision in plan if it differs from `userdebug` LAB).

## Requirements *(mandatory)*

### Functional Requirements

- **FR-001**: System MUST expose Developer Options switch **Disable call
  recording restrictions** backed by
  `Settings.Secure.extendrom_call_recording` ∈ {`0`,`1`}, default `0`.
- **FR-002**: When that setting is `1`, Dialer MUST NOT deny call recording
  solely due to country/region restriction logic.
- **FR-003**: When that setting is `0`, Dialer MUST use stock restriction
  behaviour.
- **FR-004**: System MUST expose Developer Options switch **Allow screenshots
  of secure windows** backed by
  `Settings.Secure.disable_secure_windows` (DO: `allow_flag_secure_override`) ∈ {`0`,`1`}, default `0`.
- **FR-005**: When that setting is `1`, system screenshot and screen-capture
  paths MUST allow capture of windows that set `FLAG_SECURE` (global).
- **FR-006**: When that setting is `0`, `FLAG_SECURE` MUST behave as stock.
- **FR-007**: Both settings MUST reset to `0` when Developer Options is turned
  off (same pattern as EXTENDROM / `005`).
- **FR-008**: Implementation MUST NOT require Magisk, LSPosed, or Zygisk at
  runtime.
- **FR-009**: Patches MUST be attributable (EXTENDROM/`er.sh` F_CALLREC for
  call-rec; native frameworks for FLAG_SECURE) and apply via
  `vendor/sunfish-a16/patches/…`.
- **FR-010**: Validation MUST be LAB-only (`11231JEC207477`).

### Key Entities

- **SecureSetting**: `extendrom_call_recording`,
  `disable_secure_windows`.
- **DeveloperOptionsController**: preference controllers writing those
  settings.
- **DialerRecordingPolicy**: country/region gate gated by call-rec setting.
- **SecureCapturePolicy**: framework capture/`FLAG_SECURE` enforcement gated
  by screenshot setting.

## Success Criteria *(mandatory)*

- **SC-001**: On LAB, both settings read `0` after fresh boot / DO off.
- **SC-002**: With call-rec toggle ON, operator completes a recorded call and
  stores evidence under `/srv/rom/artifacts/008-…/call-rec/`.
- **SC-003**: With screenshot toggle ON, operator captures a previously secure
  window; evidence under `/srv/rom/artifacts/008-…/flag-secure/`.
- **SC-004**: Toggles OFF restore stock deny behaviour for the same tests.
- **SC-005**: Feature works on a Magisk-free LAB image.

## Assumptions

- LOS 23.2 Dialer still has an identifiable country/region recording gate (or
  equivalent CarrierConfig path) that can be overridden.
- “Screenshot” includes the system screenshot gesture and common screen-record
  entry points; exotic DRM paths may remain blocked (document).
- FLAG_SECURE is **global only** (not planned: per-app lists).
- `007` remains incomplete; this feature does not depend on KernelSU.

## Out of scope

- AXP full call-recording automation UI.
- Per-app FLAG_SECURE lists.
- Relocked AVB / signed release (`011`).
- Banking PASS (`007`).