AXP-Resurection/specs/008-call-rec-flag-secure/plan.md

Implementation Plan: Call recording unlock + FLAG_SECURE override

Branch: 008-call-rec-flag-secure | Date: 2026-09-16 | Spec: spec.md

Input: Feature specification from /specs/008-call-rec-flag-secure/spec.md (roadmap 008 + 009, global Developer Options toggles only).

Summary

Ship two native Developer Options switches (same pattern as 005 allow_signature_fake):

1. Disable call recording restrictions → Settings.Secure.extendrom_call_recording (GOLDEN / EXTENDROM ER_ALLOW_ANY_CALL_REC) — when ON, Dialer CallRecorder.canRecordInCurrentCountry() allows recording regardless of call_record_states.xml country flags.
2. Allow screenshots of secure windows → Settings.Secure.allow_flag_secure_override — when ON, system capture paths ignore FLAG_SECURE globally.

References: AXP GOLDEN Secure dump (extendrom_call_recording=1) + EXTENDROM er.sh F_CALLREC / overlays/call-rec / config/call-rec. FLAG_SECURE is project-native (not AXP catalog). Re-validate on LOS 23.2 / A16. No Magisk / LSPosed / Zygisk at runtime. LAB only.

Technical Context

Language/Version: Java (Dialer, Settings, frameworks/base); Secure settings; optional Kotlin if Settings already uses it for DO controllers
Primary Dependencies: LOS 23.2 Dialer (CallRecorder, call_record_states.xml); Settings Developer Options; SystemUI / WM capture surfaces; EXTENDROM call-rec reference on /srv/rom/references/extendrom
Storage: Settings.Secure keys; meta-repo patches under vendor/sunfish-a16/patches/008-…
Testing: LAB flash/adb; settings get/put; call-record file evidence; screenshot of secure window; Magisk-free image
Target Platform: Pixel 4a LAB 11231JEC207477; Android 16 / LOS 23.2
Project Type: Android ROM (Dialer + Settings + frameworks)
Performance Goals: N/A (correctness)
Constraints: LAB only; default OFF; global only (no per-app); attributable patches; no root modules; legal warning on call-rec UI
Scale/Scope: Two DO preferences; one Dialer gate; one (or few) capture / FLAG_SECURE enforcement sites; docs + LAB evidence

Constitution Check

GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.

Gate	Status
LAB only; never GOLDEN	pass
Native call recording; re-validate A16 (no blind AXP XML)	pass (Dialer gate located on LOS 23.2)
FLAG_SECURE: default stock; user global override; no LSPosed	pass (global only)
No Magisk as production stage	pass
Small attributable reversible patches	pass (EXTENDROM F_CALLREC / native FLAG_SECURE)
Do not pull banking / incomplete 007 into this feature	pass

Post-design: unchanged — FLAG_SECURE is global-only (not planned per-app); capture paths that stay DRM-blocked must be documented if found on LAB.

Project Structure

Documentation (this feature)

specs/008-call-rec-flag-secure/
├── plan.md                 # this file
├── research.md             # Phase 0
├── data-model.md           # Phase 1
├── quickstart.md           # Phase 1
├── contracts/
│   ├── call-recording-surface.md
│   └── flag-secure-surface.md
└── tasks.md                # /speckit-tasks (not this command)

Host + tree

# Meta-repo
vendor/sunfish-a16/patches/008-call-rec-flag-secure/   # apply scripts (to add)
docs/008-009-design.md

# rom-dev01
/srv/rom/src/lineage/packages/apps/Dialer/
  java/com/android/incallui/call/CallRecorder.java     # canRecordInCurrentCountry()
  java/com/android/dialer/callrecord/res/xml/call_record_states.xml
/srv/rom/src/lineage/packages/apps/Settings/           # DO controllers + strings
/srv/rom/src/lineage/frameworks/base/                  # Secure settings + FLAG_SECURE
/srv/rom/references/extendrom/overlays/call-rec/
/srv/rom/references/extendrom/config/call-rec/
/srv/rom/artifacts/008-call-rec-flag-secure/           # LAB evidence

Structure Decision: Same as 005 — attributable patches applied on the LOS tree via vendor/sunfish-a16 scripts; meta-repo holds specs/docs/scripts, not megapatches of Dialer/frameworks.

Complexity Tracking

Violation	Why needed	Simpler alternative rejected because
Frameworks / SystemUI patches for FLAG_SECURE	Constitution requires native override	Magisk module forbidden in production
Dialer patch (not overlay-only)	Country gate is Java canRecordInCurrentCountry()	Blind A11 overlay alone does not wire the Secure setting

Phase 0 / Phase 1

See research.md, data-model.md, contracts/*, quickstart.md.