sunfish-adminandCursor
3f941e8451
Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path, and adds deblob appliers plus tests; docs capture Swissquote fix and parity. Co-authored-by: Cursor <cursoragent@cursor.com>
100 lines
3.9 KiB
Markdown
100 lines
3.9 KiB
Markdown
# Closure parity — AXP (GOLDEN) vs AXPR (LAB) — 2026-10-09
|
||
|
||
Status after **wave 3** boot on LAB slot `_a`. Swissquote 9.11.0 in Island
|
||
**PASS** (owner confirmed). Root cause for the prior `-69` / `onPrivilegedAccess`
|
||
was **Lineage tools on system** (`bash`, `htop`, `nano`, `unrar`,
|
||
`system/addon.d/50-lineage.sh`), removed in wave 3 — not Magisk PIF/cmdline.
|
||
|
||
GOLDEN was not on USB for this pass; oracle uses
|
||
`/srv/rom/references/axp/golden/2026-09-13/` plus prior live diffs.
|
||
|
||
## Ship candidate (closure baseline)
|
||
|
||
| Item | Value |
|
||
|------|--------|
|
||
| Dir | `20261009T145241Z-axp-stage1-combo4-cve-hi-releasekeys` |
|
||
| Zip | `AXP-Resurection-Pro-23.2-20261009-sunfish.zip` |
|
||
| SHA256 | `7cd20e4d218bc04f0b4a31838a5bb9040db36148a2b38d90342b3bc9f224a5fd` |
|
||
| `boot.img` | Same dir (Magisk preroot, AVB flags 0) |
|
||
| deblob | wave1 euicc + wave2 carrier/rcs + wave3 lineage tools |
|
||
| Do not re-sideload | Owner booted this zip once |
|
||
|
||
## Identity / Gate G (LAB measured)
|
||
|
||
| Check | LAB | GOLDEN ref | Notes |
|
||
|-------|-----|------------|-------|
|
||
| `ro.build.type` | `user` | `user` | OK |
|
||
| `ro.build.tags` | `release-keys` | `release-keys` | OK |
|
||
| `ro.debuggable` | `0` | `0` | OK |
|
||
| SPL system | `2026-09-01` | `2026-03-03` | LOS23 newer |
|
||
| SPL vendor | `2023-09-05` | `2023-08-05` | deliberate AXPR guard |
|
||
| SELinux | Enforcing | Enforcing | OK |
|
||
| Boot state | orange / unlocked | same | OK |
|
||
| Phonesky | `/system/priv-app/Phonesky` | AXP path variant | function OK |
|
||
| microG | `/system_ext/app/GmsCore` | often `/data` update on GOLDEN | version may differ |
|
||
|
||
## System surface (commands)
|
||
|
||
**Removed in wave 3 (was LAB-only, absent on GOLDEN):** `bash`, `htop`,
|
||
`nano`, `unrar`, `addon.d/50-lineage.sh`.
|
||
|
||
**Still LAB-only vs GOLDEN (deferred wave 4):** Qualcomm `diag_*`, `test_diag`,
|
||
`imsrcsd`, `disable_configstore`, AOSP debug bins (`bpftool`, `alloctop`,
|
||
`pbtombstone`, `apexd-lsof.sh`). Not required for Swissquote PASS.
|
||
|
||
**Kept like GOLDEN:** `curl` (`/system/bin`), `vim` (`/system_ext`).
|
||
|
||
## Recovery / boot
|
||
|
||
Sunfish: **recovery-as-boot** only (`boot_a` / `boot_b`). No `fastboot flash
|
||
recovery`. Scratch install: flash `boot.img` to both slots → recovery → factory
|
||
reset → sideload full zip → reboot system.
|
||
|
||
## Repo vs next bacon
|
||
|
||
- `apply_009_drop_lab_only_commands.py` exists but is **commented out** in the
|
||
ship script (wave 4 deferred).
|
||
- Optional later: `scripts/009-bacon-hardened-malloc.sh` (012) — separate bacon;
|
||
not in the booted wave 3 image.
|
||
- Host keys: `/srv/rom/secrets/android-certs` (2026-10-09); `~/.android-certs`
|
||
symlinks there. Backup `~/backups/android-certs-secrets-20261009T1517Z.tar.gz`.
|
||
|
||
## Physical-SIM call gate
|
||
|
||
Before any wave beyond carrier/rcs deblob: owner places a **mobile-network**
|
||
voice call on LAB (SIM in slot, not Wi‑Fi calling only). Note result and time
|
||
in `docs/009-handoff-20261008.md`.
|
||
|
||
## GOLDEN parity capture
|
||
|
||
When GOLDEN `11071JEC203839` is on USB (read-only oracle):
|
||
|
||
```bash
|
||
adb -s 11071JEC203839 shell pm list packages -f | sort > /tmp/golden-packages.txt
|
||
adb -s 11231JEC207477 shell pm list packages -f | sort > /tmp/lab-packages.txt
|
||
diff -u /tmp/golden-packages.txt /tmp/lab-packages.txt
|
||
adb -s 11071JEC203839 shell cat /proc/cmdline > /tmp/golden-cmdline.txt
|
||
adb -s 11231JEC207477 shell cat /proc/cmdline > /tmp/lab-cmdline.txt
|
||
```
|
||
|
||
Offline fallback: `/srv/rom/references/axp/golden/2026-09-13/` (not a live
|
||
cmdline). Refresh this doc when a live GOLDEN dump exists.
|
||
|
||
## Follow-on bacons (not the booted closure zip)
|
||
|
||
| Script | Purpose |
|
||
|--------|---------|
|
||
| `scripts/009-bacon-wave4-deblob.sh` | wave 4 lab-only command drops |
|
||
| `scripts/009-bacon-hardened-malloc.sh` | 012 hardened_malloc (2 GiB regions) |
|
||
|
||
Launch on `rom-dev01` via `rom-detach`; never two ninjas on one `out/`.
|
||
|
||
## Scratch reinstall
|
||
|
||
Owner-driven virgin `/data` with the **same** closure zip: flash `boot.img` to
|
||
both slots → recovery factory reset → sideload → reboot system from menu.
|
||
|
||
## Open (non-blocking)
|
||
|
||
- LOS 23 nightly rebase; regen plan/tasks.
|