AXP-Resurection/docs/008-009-design.md

Design: native call-recording unlock + FLAG_SECURE override (008/009)

Date: 2026-09-16
Status: Landed via Magisk 009 ship pack (2026-10). Spec: specs/008-call-rec-flag-secure/
LAB only: 11231JEC207477.

Scope note: “No Magisk/LSPosed/Zygisk” applies to these two native toggles (they are ROM Settings/framework). It does not mean the ROM ships without Magisk — Magisk preroot is a separate 009 requirement.

Problem

1. Lineage Dialer can refuse call recording based on country / carrier rules even when the user wants to record.
2. Apps set FLAG_SECURE so screenshots / screen capture fail; we want an optional global override (project-specific; not AXP Pro catalog).

Goals (MVP)

Two Developer Options switches (same UX pattern as 005 allow_signature_fake):

Toggle (plain language)	Secure setting	Default	Effect when ON
Disable call recording restrictions	extendrom_call_recording (GOLDEN / EXTENDROM)	0	Country/region limits ignored; Dialer may record
Allow screenshots of secure windows	disable_secure_windows (AOSP; DO pref allow_flag_secure_override)	0	Global: ignore FLAG_SECURE for screenshots / screen capture (debuggable builds)

• Global only — product requirement; no per-app lists (not planned).
• OFF = stock Android / LOS behaviour.
• No root modules required at runtime.

Non-goals

• Full AXP call-recording policy UI (auto-record rules, etc.).
• Per-app FLAG_SECURE lists (out of scope permanently for this project).
• Banking / KernelSU (007 incomplete).
• Shipping Magisk zips.

Approaches considered

Call recording

Approach	Pros	Cons
A. EXTENDROM / AXP GOLDEN native F_CALLREC (chosen)	Same Secure key as GOLDEN (extendrom_call_recording=1 observed); DO + Dialer gate; attributable	Re-validate paths on LOS 23.2 / A16
B. Magisk Dialer RRO (call_record_states.xml)	Tiny	Not native; no GOLDEN parity; rejected
C. Blind-copy A11 overlays only	Fast	May no-op without Dialer Java gate

Choice: A. Primary sources: /srv/rom/references/extendrom/er.sh (F_CALLREC), overlays/call-rec, config/call-rec/…/CallRecPreferenceController.java. Secure string: Settings.Secure.ER_ALLOW_ANY_CALL_REC = "extendrom_call_recording".

Also enable Dialer call_recording_enabled / audio source as needed for sunfish (EXTENDROM sets call_recording_enabled=true, call_recording_audio_source=4), after verifying LOS 23.2 Dialer still uses those resources.

FLAG_SECURE

Approach	Pros	Cons
A. DO → AOSP DISABLE_SECURE_WINDOWS (chosen)	Already in WMS on A16; tiny surface	Debuggable-only gate in stock WMS
B. Magisk services.jar patcher	Works on user	Not native ROM
C. Duplicate frameworks hooks under another Secure key	—	Redundant with AOSP

Choice: A. Wire Settings DO to disable_secure_windows.

Design

Settings / UI

• Category under Developer Options (new or shared “Privacy overrides” / EXTENDROM-style categories).
• Two SwitchPreferences + short legal/risk summaries (call recording: user responsible for local law — EXTENDROM wording as reference).
• Controllers mirror 005 / EXTENDROM DeveloperOptionsPreferenceController: write Settings.Secure 0/1; reset to 0 when Developer Options master is disabled.

Call recording path

1. Inventory LOS 23.2 Dialer: where country/carrier recording is blocked (isCountryAllowed or successor).
2. When extendrom_call_recording=1, treat as allowed (GOLDEN).
3. Ensure recording feature is compiled/enabled for Dialer on sunfish (config.xml / product overlay as required).
4. LAB: enable toggle → place/receive call → record → file exists; disable → region block behaviour restored (or stock deny if in restricted region).

FLAG_SECURE path

1. Confirmed A16: WindowManagerService + WindowState.isSecureLocked() already honour Settings.Secure.DISABLE_SECURE_WINDOWS.
2. DO switch writes that key (UI title: Allow screenshots of secure windows).
3. LAB userdebug: OFF blocked / ON capturable; document DRM exceptions.

Packaging

• Patches under vendor/sunfish-a16/patches/008-… (idempotent apply script like 005-sigspoof), attributed to EXTENDROM/er.sh F_CALLREC (call-rec) and native frameworks work (FLAG_SECURE).
• No Magisk in the bacon zip; no Magisk zips in the meta-repo.

Validation

• LAB serial only; document settings get/put and screenshots/logs under /srv/rom/artifacts/008-….
• Does not reopen 007 banking gates.

Relationship to roadmap numbers

Roadmap #	Theme	This feature
008	Call recording	Included
009	FLAG_SECURE	Included (global only)

Single Spec Kit directory: specs/008-call-rec-flag-secure/.