AXP-Resurection/specs/009-axp-los23-port/quickstart.md

Quickstart: 009 AXP resurrection (LAB validation)

Device: LAB only 11231JEC207477
Never: flash / wipe / Magisk-change GOLDEN
Evidence: /srv/rom/artifacts/009-axp-los23-port/<build-id>/
Contracts: packages, toggles, magisk, webview, gates

Prerequisites

• 003 vanilla (or documented equivalent) known-good on LAB at least once
• Host artifacts: newest microG/GSF, project Phonesky, Magisk prebuilts, bundled app set — under /srv/rom/prebuilts/ (not Git)
• GOLDEN Magisk preinstall notes measured (adb only) and copied into the build’s magisk runbook snippet
• Prefer clean flash for acceptance (dirty upgrade from KSU LAB images is best-effort only)

1. Flash + Gate A

1. Flash 009 images from artifact dir; record SHA-256.
2. Boot → unlock → place call → Wi‑Fi.
3. Save getprop + brief notes under …/gate-a/.

2. Google stack + toggles (Gates B/C)

1. Enable Developer Options.
2. Turn Allow signature spoofing ON; grant microG + Phonesky as required (005 runbook class).
3. microG Self-Check → screenshot.
4. Open Phonesky → install/update one ordinary app.
5. Confirm Secure keys:

adb -s 11231JEC207477 shell settings get secure allow_signature_fake
adb -s 11231JEC207477 shell settings get secure extendrom_call_recording

6. Call-rec: ON → record a call → OFF → note stock policy.
7. Record version pins (microG, GSF, Phonesky artifact id).

3. Magisk (Gate D)

1. Document pre-activation state vs GOLDEN notes.
2. Complete Magisk activation per runbook.
3. Configure DenyList-class hide for a banking package before first open.
4. Save Magisk version + screenshots under …/magisk/.

4. Banking (Gate E) — deferred

Skip for MVP. Owner future. Magisk DenyList can still be smoke-tested with a non-bank test package under Gate D.

5. Usability + WebView (Gate F)

1. Confirm bundled categories vs pin record.
2. adb shell cmd webviewupdate current → LOS default; chooser still listed.

6. Hardening / signing + kernel (Gate G)

1. Userspace: follow docs/009-hardening-signing-checklist.md (release keys; unlocked AVB; no bootloader lock).
2. Kernel: docs/009-gate-g-kernel-attribution.md (Stage1+combo4+FORTIFY).
3. Record kernel rev + hardening patches applied/skipped (FR-017).
4. Any missing GOLDEN-class item → written impossible/gap note (no silent skip).
5. Do not block on localization AXP-vs-LOS compare (FR-018 later).

Pass criteria

All boxes in acceptance-gates.md for the claimed stage except Gate E (deferred). Full clone acceptance for current owner priority = Gates A–D + F–G.

Notes

• Optional 007 kernels: may flash for debug only; do not claim ship.
• Call-recording legality is the user’s responsibility.
• If project Phonesky misbehaves vs GOLDEN needs → stop and reconsider; do not accept Gate B.
• Localization hardening compare is explicitly postponed.