AXP-Resurection/specs/008-call-rec-flag-secure/spec.md

Feature Specification: Call recording unlock + FLAG_SECURE override

Feature Branch: 008-call-rec-flag-secure
Created: 2026-09-16
Status: Draft
Input: Deliver constitution items 008 and 009 together as native ROM features with two Developer Options toggles (global only). Call recording = disable region/country restrictions via AXP GOLDEN / EXTENDROM native extendrom_call_recording DO gate. FLAG_SECURE = optional global allow screenshots/capture of secure windows (native frameworks + DO). Pattern matches 005 DO style. No LSPosed/Zygisk/Magisk runtime. LAB only.

Design: docs/008-009-design.md

Absorbs roadmap

#	Theme	In this feature
008	Unrestricted call recording (region)	Yes
009	FLAG_SECURE override	Yes — global only

User Scenarios & Testing (mandatory)

User Story 1 - Call recording region unlock toggle (Priority: P1)

As a LAB/daily-driver user, I can enable Disable call recording restrictions under Developer Options. When ON, the Dialer no longer blocks recording solely because of country/region rules. When OFF, stock LOS restrictions apply.

Why this priority: Core 008 value; small surface; matches EXTENDROM/AXP intent without porting full AXP recording UX.

Independent Test: Toggle setting; settings get secure extendrom_call_recording; attempt call recording on LAB Dialer with toggle on vs off.

Acceptance Scenarios:

1. Given a build with this feature on LAB, When Developer Options is opened, Then a switch for disabling call-recording region restrictions is visible (with a short legal responsibility summary).
2. Given the switch is OFF (default), When Dialer evaluates recording eligibility, Then stock country/region rules apply.
3. Given the switch is ON, When the user records a call with the system Dialer, Then recording is not refused solely due to region / country policy, and a recording artifact is produced.
4. Given Developer Options is disabled globally, When that happens, Then extendrom_call_recording returns to 0.

---

User Story 2 - Global FLAG_SECURE / screenshot override (Priority: P1)

As a LAB/daily-driver user, I can enable Allow screenshots of secure windows under Developer Options. When ON, screenshots and screen capture work even if apps set FLAG_SECURE. When OFF, Android’s normal secure-window behaviour applies. The override is global (all apps).

Why this priority: Constitution 009 project requirement; same DO pattern as spoofing.

Independent Test: App or screen that sets FLAG_SECURE; capture with toggle OFF (expect fail) and ON (expect success); settings get secure disable_secure_windows.

Acceptance Scenarios:

1. Given a build with this feature on LAB, When Developer Options is opened, Then a switch for secure-window screenshot override is visible.
2. Given the switch is OFF (default), When the user tries to screenshot a FLAG_SECURE window, Then capture is blocked as on stock.
3. Given the switch is ON, When the user screenshots or screen-records that same window, Then capture succeeds.
4. Given Developer Options is disabled globally, When that happens, Then disable_secure_windows returns to 0.

---

User Story 3 - Native, attributable packaging (Priority: P2)

As a maintainer, both behaviours ship in the bacon/ROM tree via vendor/sunfish-a16 patches (idempotent apply), sourced from EXTENDROM / AXP GOLDEN call-rec (and native FLAG_SECURE work), without Magisk modules.

Why this priority: Constitution: native ROM, attributable, reversible.

Independent Test: Patch script dry-run; tree markers; no Magisk zip in artifacts required for the feature to work after flash.

Acceptance Scenarios:

1. Given a clean LOS tree after repo sync, When the apply script runs, Then it is idempotent and records source attribution.
2. Given a flashed LAB image, When Magisk is not installed, Then both toggles still function.

---

Edge Cases

• Dialer path renamed on A16 → re-locate gate; do not assume A11 overlay paths.
• Call recording legal in some jurisdictions only → UI must warn; feature does not claim legality.
• Some capture paths (DRM / hardware buffers) may still block — document if a specific path remains blocked after toggle ON.
• user builds: follow same policy as 005 for whether DO toggles are available (document decision in plan if it differs from userdebug LAB).

Requirements (mandatory)

Functional Requirements

• FR-001: System MUST expose Developer Options switch Disable call recording restrictions backed by Settings.Secure.extendrom_call_recording ∈ {0,1}, default 0.
• FR-002: When that setting is 1, Dialer MUST NOT deny call recording solely due to country/region restriction logic.
• FR-003: When that setting is 0, Dialer MUST use stock restriction behaviour.
• FR-004: System MUST expose Developer Options switch Allow screenshots of secure windows backed by Settings.Secure.disable_secure_windows (DO: allow_flag_secure_override) ∈ {0,1}, default 0.
• FR-005: When that setting is 1, system screenshot and screen-capture paths MUST allow capture of windows that set FLAG_SECURE (global).
• FR-006: When that setting is 0, FLAG_SECURE MUST behave as stock.
• FR-007: Both settings MUST reset to 0 when Developer Options is turned off (same pattern as EXTENDROM / 005).
• FR-008: Implementation MUST NOT require Magisk, LSPosed, or Zygisk at runtime.
• FR-009: Patches MUST be attributable (EXTENDROM/er.sh F_CALLREC for call-rec; native frameworks for FLAG_SECURE) and apply via vendor/sunfish-a16/patches/….
• FR-010: Validation MUST be LAB-only (11231JEC207477).

Key Entities

• SecureSetting: extendrom_call_recording, disable_secure_windows.
• DeveloperOptionsController: preference controllers writing those settings.
• DialerRecordingPolicy: country/region gate gated by call-rec setting.
• SecureCapturePolicy: framework capture/FLAG_SECURE enforcement gated by screenshot setting.

Success Criteria (mandatory)

• SC-001: On LAB, both settings read 0 after fresh boot / DO off.
• SC-002: With call-rec toggle ON, operator completes a recorded call and stores evidence under /srv/rom/artifacts/008-…/call-rec/.
• SC-003: With screenshot toggle ON, operator captures a previously secure window; evidence under /srv/rom/artifacts/008-…/flag-secure/.
• SC-004: Toggles OFF restore stock deny behaviour for the same tests.
• SC-005: Feature works on a Magisk-free LAB image.

Assumptions

• LOS 23.2 Dialer still has an identifiable country/region recording gate (or equivalent CarrierConfig path) that can be overridden.
• “Screenshot” includes the system screenshot gesture and common screen-record entry points; exotic DRM paths may remain blocked (document).
• FLAG_SECURE is global only (not planned: per-app lists).
• 007 remains incomplete; this feature does not depend on KernelSU.

Out of scope

• AXP full call-recording automation UI.
• Per-app FLAG_SECURE lists.
• Relocked AVB / signed release (011).
• Banking PASS (007).