AXP-Resurection/specs/002-axp-reference-capture/spec.md

Feature Specification: AXP.OS GOLDEN reference capture

Feature Branch: 002-axp-reference-capture

Created: 2026-08-09

Status: P1 complete (gate to 003); archive rsync may still finish in background

Input: Document and sample the GOLDEN daily-driver AXP.OS sunfish as a live compatibility oracle; label GOLDEN vs LAB; prepare LAB stock factory rescue. Experimental flashing stays on LAB only (docs/device-roles.md).

Context / non-goals

• There are two sunfish devices: GOLDEN (AXP.OS 22.2 / Android 15 daily driver — do not experiment/flash) and LAB (flash/reflash freely).
• Exact GOLDEN build fingerprint/patch is measured here (getprop). GOLDEN is AXP 22.2/A15 — not the last GrapheneOS sunfish release (that was A13, historical reference only).
• Broader offline AXP sunfish archive (website, selected git, images) is documented in docs/axp-sunfish-preservation.md for execution on rom-dev01 — not a full Disroot org clone; does not replace live GOLDEN adb.
• Capture essential versions/config up front; GOLDEN remains available for later live adb re-queries — do not require an exhaustive one-shot dump of everything before 003.
• NeoBackup / wipe / migrate GOLDEN are not project requirements.
• Do not invent package versions/UIDs in the constitution; this feature records what GOLDEN actually runs.
• Do not commit credentials, tokens, or personal identifiers to Git.
• Observe devices; do not assume bootloader unlock state until measured (both GOLDEN and LAB).
• Product intent vs AXP Pro lives in non-normative docs/axp-pro-parity.md.

User Scenarios & Testing (mandatory)

User Story 1 - Device roles + LAB stock rescue (Priority: P1)

As the developer, GOLDEN and LAB are clearly identified, and LAB has a written Google factory-image emergency rescue so experiments cannot permanently brick the lab phone.

Why this priority: Prevents flashing the wrong phone; keeps LAB recoverable.

Independent Test: Serials/labels documented; factory image procedure for LAB reviewed; GOLDEN marked do-not-flash.

Acceptance Scenarios:

1. Given two sunfish devices, When I record serials (or equivalent IDs) and physical/doc labels, Then GOLDEN vs LAB cannot be confused.
2. Given GOLDEN and LAB, When I inspect bootloader/fastboot/getprop on each, Then lock state and build identity are recorded without prior assumptions.
3. Given official Google sunfish factory images, When I document image set, hashes, and flash steps for LAB, Then LAB emergency stock rescue exists before 003 experiments.
4. Given project docs, When reviewed, Then they state GOLDEN must not receive experimental project flashes.

---

User Story 2 - Essential GOLDEN inventory (Priority: P1)

As the developer, I have enough structured inventory of GOLDEN AXP to start 004–006, knowing I can re-probe GOLDEN later for missing details.

Why this priority: Defines the live oracle without blocking on perfection.

Independent Test: Essential checklist complete or explicitly deferred with “re-query GOLDEN later” notes — no silent unknowns for hard-gates.

Acceptance Scenarios:

1. Given GOLDEN AXP, When I collect getprop / fingerprints, Then exact ROM/build identifiers are stored.
2. Given microG, When inventoried at essential level, Then recorded: version, signing cert; Self-Check; Device Registration; Cloud Messaging; relevant permissions.
3. Given Phonesky / com.android.vending, When inventoried, Then recorded: version; APK path; cert; permissions; spoofing state; useful dumpsys package / priv-app XML notes.
4. Given Insular, When inventoried, Then recorded: profile IDs; profile owner; dumpsys device_policy excerpt; owner vs work UIDs/packages; Yuh/Swissquote locations.
5. Given Magisk/root, When inventoried, Then recorded: Magisk version; modules; DenyList including processes.
6. Given GSF Proxy and related packages, When inventoried, Then versions/paths/signatures are recorded.
7. Given banking interest, When measurable, Then record observational Play Integrity (or equivalent) state plus Yuh/Swissquote pass/fail on GOLDEN — comparative baseline only, not a Strong Integrity promise for our ROM.
8. Given Daily-driver MVP features we will replace natively, When capturing modules/settings, Then document current call-recording and FLAG_SECURE bypass behaviour/source on GOLDEN (AXP vs module; global/per-app).

---

User Story 3 - Golden banking flow on GOLDEN (Priority: P1)

As the developer, the known-good banking install order is written from GOLDEN so 006 can reproduce it on LAB (with KernelSU substituting DenyList later).

Why this priority: Order is load-bearing.

Independent Test: Step list matches GOLDEN procedure.

Acceptance Scenarios:

1. Given GOLDEN, When I document the banking app install flow, Then it explicitly includes:

   1. Aurora Store → install
   2. Do not open
   3. Magisk DenyList before first process (include processes)
   4. Clone into Insular
   5. First launch inside Insular
   6. Phonesky/Play in Insular
   7. Play update inside work profile if required
   8. Verify login/biometrics/push/reboot as applicable

2. Given that flow, When stored in the redacted summary, Then it omits passwords, OTPs, and personal identifiers.

---

User Story 4 - Safe artifact handling (Priority: P2)

As the developer, sensitive captures stay off Git; redacted summaries are committed to sunfish-a16-rom.

Acceptance Scenarios:

1. Given raw pulls/APKs, When stored, Then they live under e.g. /srv/rom/references/axp/ on rom-dev01, not in Git.
2. Given in-repo summary, When reviewed, Then it has versions/hashes/ workflow steps without personal secrets.

---

Edge Cases

• GOLDEN encrypt/PIN: document without storing the PIN.
• Missing detail later: re-attach GOLDEN and adb — do not invent.
• LAB brick: use LAB stock factory rescue; do not wipe GOLDEN to “recover”.
• Optional personal NeoBackup of GOLDEN is outside project gates.

Requirements (mandatory)

Functional Requirements

• FR-001: Label and record GOLDEN vs LAB identities; measure bootloader/ fastboot state on both.
• FR-002: Document LAB Google factory-image emergency rescue (hashes + steps).
• FR-003: Capture essential GOLDEN inventory (microG, GSF, Phonesky, Insular, Magisk/DenyList processes, Yuh/Swissquote, call-recording + FLAG_SECURE sources, observational Play Integrity if measurable).
• FR-004: Document GOLDEN banking flow (Aurora → NO OPEN → DenyList → Insular → Play update).
• FR-005: Store raw artifacts off-Git; commit only redacted docs.
• FR-006: Gate: no experimental flash on LAB until LAB rescue docs exist and GOLDEN is explicitly marked do-not-flash; no NeoBackup/wipe of GOLDEN required.
• FR-007: Cross-link useful facts into docs/axp-pro-parity.md / docs/device-roles.md without inventing unseen features.

Key Entities

• GOLDEN: live AXP oracle (not wiped for bring-up).
• LAB: experimental flash target + stock rescue docs.
• Reference bundle: host-local capture directory.
• Redacted summary: in-repo documentation.

Success Criteria (mandatory)

Measurable Outcomes

• SC-001: GOLDEN vs LAB clearly identified; agents/docs forbid flashing GOLDEN.
• SC-002: LAB stock factory rescue written and reviewed before 003.
• SC-003: Essential GOLDEN inventory + banking flow complete enough for 006 hard-gates; gaps marked “re-query GOLDEN” not invented.
• SC-004: Yuh/Swissquote verified working on GOLDEN and documented.
• SC-005: Git has no proprietary APK dumps or personal credential material.
• SC-006: Bootloader states in docs match measured GOLDEN and LAB reality.