AXP-Resurection/specs/009-axp-los23-port/spec.md

# Feature Specification: AXP LOS22 feature port to LOS23

**Feature Branch**: `009-axp-los23-port`

**Created**: 2026-09-16

**Status**: Clarified — ready for `/speckit-plan`

**Input**: User description: "009-axp based LOS22 feature port to LOS23 —
take vanilla LineageOS 23 for sunfish and integrate the full AXP.OS (LOS22 /
Android 15 GOLDEN) feature set into LOS23 without product exceptions; only
versions change (newest stable for each system / bundled app that still fits
sunfish / Android 16); use the project's already updated patched Phonesky
(Google Play)."

**Owner clarifications (2026-09-16):** Magisk like GOLDEN (newest Magisk;
AXP-style preinstalled-but-not-fully-activated layout — measure on GOLDEN);
hardening / signing / AVB like GOLDEN (full **AXP resurrection** on LOS23);
WebView exception = keep LOS23 WebView (Aosmium EOL) but leave provider
selection unlocked; Phonesky = project patched build from recent work unless
it lacks GOLDEN-class fixes (then reconsider); microG newest stable integrated
with that Phonesky; signature spoofing and call recording **selectable**
(toggles); KernelSU (`007`) out of ship for now, with optional recycle of
existing functional kernels if useful; otherwise everything equal to
AXP/GOLDEN.

## Context / non-goals

**Product intent (this feature is normative for the AXP resurrection ship):**

- This feature is an **AXP.OS resurrection** on LineageOS 23.2 / Android 16
  `sunfish`: same capability set as AXP on LOS22 / GOLDEN, moved to LOS23.
- Base ROM = LineageOS 23.2 / Android 16 `sunfish` vanilla from `003` (or the
  best known-good vanilla-equivalent flashable baseline already proven on LAB).
- Feature source of truth for *what* to ship = what AXP.OS Pro / GOLDEN
  provides on LOS22 (inventory in `002`, product catalog in
  `docs/axp-pro-parity.md`), **without omitting AXP capabilities as “decide
  later” rows**, including Magisk-class root and AXP-class hardening /
  signing / AVB posture that GOLDEN represents.
- Versions = **newest stable** (or newest tagged pre-release the upstream
  project currently ships) for each system/bundled component, constrained to
  what still works on sunfish / non-GKI 4.14 / LOS 23.2 — not stale laptop
  caches or shallow-clone version lies.
- **Phonesky exception:** ship the project's **already patched / fixed
  Phonesky** from the recent host pipeline (not “whatever newest Play APK
  is today”). If that build is missing fixes that GOLDEN's Phonesky path
  still needs for daily-driver parity, stop and reconsider the Phonesky
  plan before accepting the feature.
- **WebView exception:** do **not** ship Aosmium (EOL). Default WebView =
  LineageOS 23's WebView. The ROM MUST keep Android's multi-provider path so
  the owner can install another WebView later and select it (Developer
  options → WebView implementation) — not locked to a single provider.
- Flash / experiment **LAB only**; GOLDEN remains the read-only oracle
  (`docs/device-roles.md`).

**Relationship to earlier features:**

- `001`–`003` remain shared foundation (host, GOLDEN capture, vanilla build).
- **Two parallel product tracks** (neither deletes the other):
  - **Standby / prior track:** `004`–`008` + `007` KernelSU (+ deferred
    `006`/`010`–`013` as previously planned). Kept intact for later resume;
    live on its own git branch once pushed (see plan notes).
  - **Active Magisk-resurrection track (this feature):** AXP→LOS23 ship with
    Magisk like GOLDEN. Does **not** rewrite or remove `004`–`008`/`007`
    specs; it is a new Speckit directory that may **reuse** proven LAB
    runbooks/results from those features when helpful.
- KernelSU / SusFS from `007` stays **out of this track’s ship** for now.
  Recycle of the two functional `007` kernels is optional (FR-016) — never an
  acceptance gate for Magisk.
- Project-only `FLAG_SECURE` global override may still ship if already
  specified under `008` (not AXP catalog); it is optional relative to AXP
  resurrection acceptance. AXP call-recording unlock **is** required and must
  be selectable.

**Out of scope for this feature (explicit):**

- Flashing or modifying GOLDEN.
- Committing proprietary Google Phonesky APK bytes, private keys, or personal
  identifiers to Git.
- Replacing the LOS 23.2 sunfish kernel/device stack with an unrelated prebuilt
  (Graphene A13, stock A13, etc.).
- Shipping Aosmium / AOSmium as the default or only WebView (EOL).
- Building a custom AXP-style backup/restore ROM feature (personal backup
  remains an external user tool if needed).
- Claiming Yuh hardware-attestation PASS if GOLDEN itself currently FAILs that
  path — reproduce GOLDEN's *workflow* and document attestation parity honestly.
- Deleting or rewriting the standby KernelSU / split-roadmap specs
  (`004`–`008`/`007`) — they remain valid on the standby branch/track.
- Shipping KernelSU-Next as this track’s root (out of ship here; Magisk is
  the resurrection root). Optional later reuse of `007` kernels is allowed
  under FR-016 but MUST NOT delay Magisk acceptance.

## User Scenarios & Testing *(mandatory)*

### User Story 1 - AXP resurrection daily-driver on LAB (Priority: P1)

As the owner, after flashing one LAB build produced under this feature, the
phone boots and presents the same class of daily-driver capabilities I rely on
with AXP on GOLDEN (Google compatibility stack, Play, managed banking profile
workflow, selectable call recording unlock, Magisk root/hide workflow like
GOLDEN, AXP hardening/signing posture, and AXP bundled usability apps —
except WebView as defined here), without a checklist of deferred AXP features.

**Why this priority**: This is the whole reason for the resurrection.

**Independent Test**: Flash one `009` build to LAB; walk the GOLDEN daily
checklist (microG Self-Check, Play open/install, Island profile, call-record
toggle off/on, spoofing toggle off/on, Magisk present in AXP-like install
state, bundled apps present, hardening/signing checks that GOLDEN implies);
compare against `002` inventory categories.

**Acceptance Scenarios**:

1. **Given** LAB on a vanilla `003` baseline (or documented equivalent),
   **When** the `009` image is flashed, **Then** the device boots to home and
   cellular/Wi‑Fi/basic hardware still work as in the vanilla smoke.
2. **Given** that build, **When** I compare shipped capability categories to
   GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, managed profile
   tool, selectable call recording unlock, Magisk/DenyList-class path,
   DNS/hosts privacy helpers if present on GOLDEN, F‑Droid/Aurora/launcher/
   gallery-class bundled apps, hardening/signing/AVB class), **Then** no
   category is left as “decide / later” without an explicit obsolescence note
   tied to Android 16 / sunfish impossibility (WebView exception allowed per
   FR-015).
3. **Given** Git and host artifact policy, **When** inspected, **Then** no
   proprietary Phonesky APK bytes or secrets were committed.

---

### User Story 2 - Google stack: newest microG + project Phonesky (Priority: P1)

As the owner, newest-stable microG + GSF Proxy integrate with the project's
recent patched Phonesky so I can open Play, sign in as needed, and
install/update apps the same way I do on AXP; signature spoofing is
selectable (off = stock-safe default behaviour; on = needed Play/microG
path).

**Why this priority**: Without Play/microG parity, the ROM is not a daily
driver.

**Independent Test**: microG Self-Check; Phonesky launches; install or update
at least one ordinary app; toggle spoofing off/on and confirm expected
behaviour; push notifications smoke for a known test app.

**Acceptance Scenarios**:

1. **Given** the `009` build on LAB, **When** microG Settings Self-Check runs
   with spoofing enabled as required, **Then** checks required for basic
   Google compatibility pass (or each remaining failure is documented as
   attestation/hardware outside packaging).
2. **Given** the project's current patched Phonesky host artifacts, **When**
   the ROM is built and flashed, **Then** `com.android.vending` is present as
   privileged Play and opens on LAB.
3. **Given** selectable signature spoofing, **When** the owner turns it on,
   **Then** Play install/update works with microG without FakeStore; **When**
   turned off, **Then** the device does not expose unrestricted spoofing to
   arbitrary apps.
4. **Given** version policy, **When** microG / GSF versions are recorded,
   **Then** each is the newest stable (or tagged pre-release upstream
   currently ships) verified on this stack; Phonesky version matches the
   project patched artifact (not a blind “newest Play from the internet”).
5. **Given** Play behaviour on LAB, **When** compared to GOLDEN needs, **Then**
   if the project Phonesky lacks a GOLDEN-class fix required for daily use,
   acceptance stops and the Phonesky plan is reconsidered.

---

### User Story 3 - Banking profile workflow parity (Priority: P1)

As the owner, I can recreate the GOLDEN banking layout on LAB: install via the
same store path I use on AXP, place banks in Island, and keep banking apps
free of root via Magisk DenyList-class hiding like GOLDEN.

**Why this priority**: Compatibility hard gates; daily-driver without banks
fails the resurrection.

**Independent Test**: Install Swissquote (hard gate) and attempt Yuh; run
inside Island; Magisk DenyList (or AXP-equivalent) applied; record PASS/FAIL
honestly vs GOLDEN.

**Acceptance Scenarios**:

1. **Given** Island on LAB, **When** I follow the documented GOLDEN banking
   install order, **Then** Swissquote reaches a usable logged-in state in the
   managed profile.
2. **Given** Yuh on the same workflow, **When** tested, **Then** either it
   PASSes or the failure matches the known GOLDEN attestation-class failure
   and is documented — not a silent packaging regression.
3. **Given** Magisk is present on the build, **When** banking apps run with
   DenyList-class configuration, **Then** they do not receive root.

---

### User Story 4 - Magisk like GOLDEN + selectable call recording (Priority: P1)

As the owner, Magisk is present the way AXP/GOLDEN presents it (newest Magisk;
preinstalled but not fully activated until I finish setup — exact UX measured
from GOLDEN), with DenyList-class hiding; call recording unlock is selectable
like other Developer Options toggles.

**Why this priority**: Root and call recording are core AXP daily behaviours.

**Independent Test**: Confirm Magisk package/binary layout vs GOLDEN notes;
complete activation on LAB if required; DenyList a test app; toggle call
recording unlock off (restricted) and on (record allowed).

**Acceptance Scenarios**:

1. **Given** a fresh `009` flash, **When** inspected, **Then** Magisk is
   present in an AXP-like preinstalled / not-fully-activated state consistent
   with GOLDEN measurement, using the newest Magisk stable that works on this
   stack.
2. **Given** Magisk setup completed on LAB, **When** DenyList-class hiding is
   configured for a banking package, **Then** that package does not receive
   root.
3. **Given** selectable call recording unlock, **When** OFF, **Then** stock
   LOS country/carrier style restrictions apply; **When** ON, **Then** Dialer
   can record on LAB without that block.

---

### User Story 5 - AXP usability, privacy, hardening (Priority: P2)

As the owner, the ROM ships the rest of the AXP usability/privacy surface and
GOLDEN-class hardening/signing/AVB posture at newest workable stables, with
LOS23 WebView default and an unlocked provider chooser.

**Why this priority**: Completes resurrection beyond Google/banking/root core.

**Independent Test**: Package list vs `002`; open bundled apps; confirm
default WebView is LOS and another WebView can be selected if installed;
hardening/signing checks agreed for GOLDEN-class parity.

**Acceptance Scenarios**:

1. **Given** the `009` build, **When** I list bundled system/user apps in the
   AXP usability set, **Then** each GOLDEN/AXP category is present or
   explicitly marked impossible on Android 16/sunfish with rationale
   (Aosmium absence is the allowed WebView exception).
2. **Given** Developer options, **When** I open WebView implementation,
   **Then** LOS23 WebView is available/default and the chooser is not locked
   against future alternate providers.
3. **Given** version policy, **When** bundled apps (except Phonesky per
   FR-004) are recorded, **Then** each is newest stable that still runs on
   the ROM.
4. **Given** GOLDEN/AXP hardening and signing expectations, **When** the
   accepted build is evaluated, **Then** equivalent class of protections /
   signing posture is present or each gap is documented as impossible on
   this stack — not silently dropped.

---

### User Story 6 - Parallel tracks stay honest (Priority: P2)

As the owner, docs make clear that **this** Speckit is the Magisk AXP
resurrection track on LOS23, while the prior KernelSU / split roadmap remains
on standby (other branch / same `004`–`008`/`007` specs untouched).

**Why this priority**: Lets either track resume without rewriting history.

**Independent Test**: `specs/004`–`008`/`007` still exist unchanged in intent;
`009` describes Magisk resurrection; git branches separate standby vs active
work when published.

**Acceptance Scenarios**:

1. **Given** the repo, **When** inspected, **Then** `001`–`008`/`007` spec
   directories remain present (not deleted by `009`).
2. **Given** `009`, **When** read as ship intent for Magisk resurrection,
   **Then** it does not claim to permanently retire the standby track — only
   that KernelSU is out of *this* track’s ship for now.

---

### Edge Cases

- Newer “stable” of a bundled app breaks Android 16 / sunfish: pin last known
  good, document the regression, and retry when a fixed release exists.
- Project Phonesky missing a GOLDEN-class fix: halt acceptance; reconsider
  Phonesky patch/version plan before claiming Play parity.
- Magisk “preinstalled but not fully installed” UX differs across Magisk
  versions: match GOLDEN's *class* of first-boot/setup behaviour; document
  exact measured steps from GOLDEN before freezing LAB instructions.
- GOLDEN Yuh FAIL vs LAB FAIL: distinguish attestation/hardware class from
  packaging/spoofing regressions.
- Vanilla LOS already provides an AXP capability (e.g. WireGuard, encryption):
  keep LOS behaviour; do not duplicate.
- Dirty upgrade from older LAB experimental (incl. KernelSU) images: prefer
  clean flash for acceptance.
- Phonesky host artifacts missing or wrong signature: fail closed — never
  silently fall back to FakeStore.
- Alternate WebView installed by user later: selection must remain possible;
  default remains LOS23 WebView until the user changes it.

## Requirements *(mandatory)*

### Functional Requirements

- **FR-001**: The project MUST produce a flashable LineageOS 23.2 / Android 16
  `sunfish` build that resurrects the AXP.OS on LOS22 / GOLDEN capability set
  (including Magisk-class root and GOLDEN-class hardening / signing / AVB
  posture), without leaving AXP capabilities as open “decide” omissions
  except the WebView exception in FR-015.
- **FR-002**: Version selection for system and bundled components (except
  Phonesky per FR-004) MUST prefer the newest stable (or newest tagged
  pre-release upstream currently ships) that still works on sunfish /
  LOS 23.2; GOLDEN versions are a floor reference, not a freeze.
- **FR-003**: The ROM MUST ship newest-stable microG Services Core and GSF
  Proxy integrated with the project Phonesky (no FakeStore as primary Play).
- **FR-004**: The ROM MUST ship the project's recent patched Phonesky as
  privileged `com.android.vending`, with a documented host-side obtain /
  patch / sign / deploy path that never commits APK bytes to Git. If that
  artifact lacks GOLDEN-class fixes required for daily-driver Play behaviour,
  the Phonesky plan MUST be reconsidered before acceptance.
- **FR-005**: The ROM MUST provide **selectable** signature spoofing for the
  microG + Phonesky path (owner-controlled toggle; default safe/off or
  project-documented default). Spoofing MUST remain restricted/controlled —
  not unrestricted platform spoofing for all apps.
- **FR-006**: The ROM MUST support the GOLDEN managed-profile banking workflow
  (Island as measured on GOLDEN) including Swissquote PASS as a hard gate.
- **FR-007**: Banking applications MUST run without being granted root
  (Magisk DenyList-class hiding).
- **FR-008**: The ROM MUST include **selectable** AXP-equivalent call
  recording unlock (toggle; OFF = stock LOS restrictions, ON = unlock).
- **FR-009**: The ROM MUST include the AXP usability/privacy bundled surface
  present on GOLDEN / AXP Pro (stores, launcher/gallery-class apps, DNS/hosts
  or equivalent blockers when part of that surface) at newest workable
  stables, subject to FR-015 for WebView.
- **FR-010**: The ROM MUST ship **Magisk** like GOLDEN: newest Magisk stable
  that works on this stack, in an AXP-like preinstalled but not fully
  activated layout (exact first-boot/setup behaviour measured from GOLDEN),
  with DenyList-class hiding sufficient for FR-007. KernelSU is **out of
  ship for now** (not the resurrection root path).
- **FR-011**: The feature acceptance gate MUST include GOLDEN/AXP-class
  hardening and signing / AVB posture (as applicable on LOS 23.2 / sunfish),
  not only apps and Google compatibility. Gaps MUST be documented as
  impossible on this stack rather than silently omitted.
- **FR-012**: Acceptance flashing MUST use LAB only; GOLDEN MUST remain
  unmodified by this feature's work.
- **FR-013**: Each shipped capability MUST be attributable (what upstream or
  AXP behaviour it reproduces) and reversible (known-good prior LAB image
  retained).
- **FR-014**: This feature MUST live as a **new Speckit** (`009`) in parallel
  with the standby KernelSU / split roadmap (`004`–`008`/`007`). Those older
  specs MUST NOT be deleted or rewritten to match Magisk resurrection.
  Reusable runbooks/results from them MAY be referenced. For *this* track’s
  ship only, Magisk (not KernelSU) is the root path.
- **FR-015**: Default WebView MUST be LineageOS 23's WebView. Aosmium MUST NOT
  be required. The ROM MUST keep WebView provider selection available so a
  future alternate WebView can be installed and chosen.
- **FR-016**: Existing functional KernelSU / related kernels and artifacts
  from `007` SHOULD be retained and MAY be recycled when useful (reference
  boot images, differential debugging, or a later optional non-ship path).
  Such reuse is **optional** (“si se puede, ok”), MUST NOT become an
  acceptance requirement for Magisk resurrection, and MUST NOT imply KernelSU
  is back in the ship path unless a future spec explicitly says so.

### Key Entities

- **Vanilla baseline**: The LOS 23.2 sunfish build from `003` (or documented
  equivalent) before AXP feature integration.
- **AXP capability set**: Inventory of features/packages/behaviours from
  GOLDEN (`002`) plus AXP Pro catalog rows promoted by this spec
  (resurrection target).
- **Version pin record**: Documented package/component versions chosen for the
  accepted `009` build (newest workable stable each; Phonesky = project
  artifact id/version).
- **Phonesky host artifact**: Project patched/signed Play APK and permission
  metadata kept outside Git on the build host.
- **Magisk preinstall state**: Measured GOLDEN/AXP layout for Magisk present
  but not fully activated, plus LAB setup steps.
- **LAB acceptance build**: Flashable image set + hashes + smoke/banking /
  Magisk / hardening results for this feature.

## Success Criteria *(mandatory)*

### Measurable Outcomes

- **SC-001**: One LAB flash of a `009` build boots and completes the vanilla
  hardware smoke within the same session as flash (owner can place a call,
  use Wi‑Fi, and unlock the device).
- **SC-002**: 100% of AXP resurrection capability categories from the agreed
  inventory are either demonstrated on LAB or explicitly documented as
  impossible on Android 16/sunfish — zero silent omissions (WebView exception
  allowed only as FR-015).
- **SC-003**: With spoofing enabled as required, microG Self-Check required
  items and project Phonesky open/install succeed on LAB for ordinary apps on
  the first accepted build candidate (or within one documented fix iteration).
- **SC-004**: Swissquote managed-profile + Magisk DenyList-class workflow
  PASSes on LAB; Yuh result is recorded and is not worse than GOLDEN for
  packaging/spoofing reasons.
- **SC-005**: Every bundled/system app version in the acceptance record
  (except Phonesky) is newer than or equal to GOLDEN's measured version,
  unless a newer release was tried and failed with a written regression note;
  Phonesky matches the recorded project patched artifact.
- **SC-006**: Owner can turn signature spoofing and call recording unlock off
  and on and observe the documented behaviour each time.
- **SC-007**: Magisk is present post-flash in the AXP-like preinstall state and
  can be fully activated on LAB using documented steps measured from GOLDEN.
- **SC-008**: Default WebView is LOS23's; provider selection remains available.
- **SC-009**: Owner can perform the GOLDEN-equivalent daily checklist on LAB
  without consulting a scatter of conflicting feature specs for what “ships”.

## Assumptions

- `003` vanilla LOS 23.2 sunfish is (or becomes) available as the integration
  base; LAB stock rescue from `002` remains valid.
- GOLDEN inventory (`002`) plus AXP Pro docs are sufficient to enumerate the
  capability set; live `adb` re-query of GOLDEN is allowed (especially Magisk
  preinstall/activation details).
- “AXP resurrection” means Magisk + GOLDEN-class hardening/signing/AVB + full
  AXP user surface on LOS23, with only the stated WebView and Phonesky-artifact
  exceptions.
- Island remains the managed-profile tool because that is what GOLDEN
  actually runs (AXP docs saying “Insular” are historical naming).
- FakeStore is never the primary Play path.
- Selectable spoofing and selectable call recording follow the same class of
  Developer Options UX already explored in `005`/`008` runbooks where useful.
- Project `FLAG_SECURE` override is nice-to-have, not an AXP resurrection
  hard gate.
- Personal app/data backup is not a ROM feature gate.
- Builds and long compiles run on `rom-dev01`; laptop holds docs/specs and
  flash tools only.
- Prior KernelSU LAB experiments (including the two functional kernels already
  built) are **out of ship for now** but kept as recyclable assets: reuse if
  helpful, never required for Magisk acceptance.