0 Fork 0

Files

T

sunfish-adminandCursor 2d145c2878 009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-10-16 21:06:45 +02:00

2.9 KiB

Raw Blame History

009 — Remaining path after Magisk closure

Updated 2026-10-10. Older “post clean-429 / leave test-keys” execution order is obsolete. Resume: 009-handoff-20261008.md. Closure: 009-closure-parity-20261009.md.

Authoritative requirements: specs/009-axp-los23-port/spec.md + constitution. KernelSU stays out of Magisk ship boots (optional recycle only).

Already landed (LAB closure, 2026-10-09)

Layer	Status
Stage1 + combo4 + Clang FORTIFY	Ship
CVE clean-offset + hi batches 1–3	Ship (`CVE-2022-49980` one-liner denylisted; lock-scope companion applied)
Magisk 30.7 EXTENDROM preroot	Ship
`user` + project `release-keys`	Ship
AVB flags 0 (unlocked)	Ship
Deblob waves 1–4 (selective; not AXP `Deblob.sh`)	Ship
`hardened_malloc` (64-bit; SF/camera exclusions)	Ship
Call-rec / FLAG_SECURE DO toggles (`008`)	Ship
Private DNS / connectivity (no axp.os endpoints)	Ship
Swissquote usable in Island	PASS
Bootanimation	Lineage (no AXP asset in PRO payload)

Still open / next

Item	Notes
Upstream LOS 23.2 rebase + first project OTA zip	`009-upstream-rebase-ota.md` — bacon scripts ready; sync automation not
Yuh in Island on LAB	Open — Play A16/sunfish filter + install-source; see `009-yuh-golden-lab-hypothesis.md`
Wallapop / PairIP-class apps	Root cause 2026-10-10: Yama `ptrace_scope=2` (US-S5-1 + `apply_009_yama_ptrace.py`). PairIP's anti-debug ptrace is denied, so it dies with SIGSEGV. GOLDEN kernel has no Yama. Next OTA leaves `CONFIG_SECURITY_YAMA` unset
FR-019 APK sideload cadence	Stub: `009-sideload-system-updates.md`
Release-key custody polish	Keys under `/srv/rom/secrets/`; offline copy confirm
Physical-SIM call gate	Owner before more radio deblob
Leftover high-offset CVE / failed Stage1 probes	Optional, small batches
KernelSU / SusFS parallel retry	Keep `007-*`; bridge `007-parallel-on-009.md` — never mix into Magisk ship bacon
Bootloader lock	Wont (AXP/LOS unlocked norm)

Suggested order (default)

Owner supplies new LOS sunfish build pin → follow 009-upstream-rebase-ota.md.
Rebacon with scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh (+ wave4/malloc wrappers if still required).
LAB sideload smoke: Magisk, Island, Swissquote, radio.
Yuh / Play compatibility experiments (LAB only).
Fill FR-019 sideload commands when packaging is frozen.

Do-not

Reflash full-503 / old kh-cve / FORTIFY-broken zips.
Bulk-apply high-offset CVE without review.
Mix KernelSU into Magisk ship boots.
Run AXP Deblob.sh defaults.
Treat “AXP/Graphene-class” as requiring locked bootloader.

2.9 KiB Raw Blame History Unescape Escape