AXP-Resurection/specs/009-axp-los23-port/research.md

# Research: `009-axp-los23-port`

## Decision: Product = AXP resurrection on LOS 23.2 (parallel track)

**Decision**: Treat `009` as the normative ship feature **for the Magisk AXP
resurrection track** that ports the AXP.OS / GOLDEN LOS22 capability set onto
LineageOS 23.2 vanilla (`003`), with only the explicit exceptions in the spec
(WebView, Phonesky artifact, optional KSU recycle). Keep the prior KernelSU /
split roadmap (`004`–`008`/`007` + deferred items) on a **standby git branch**
without deleting or rewriting those specs.

**Rationale**: Owner wants Magisk “todo igual” to AXP now, without throwing
away the earlier KSU investment; either track may resume later.

**Alternatives considered**: Hard-supersede/delete the split roadmap —
rejected (owner wants standby). Continue only KSU track — rejected for
current ship preference.

## Decision: Magisk ship root (constitution variance)

**Decision**: Ship **Magisk** like GOLDEN — newest Magisk stable that works on
sunfish / LOS 23.2 — in an AXP-like **preinstalled but not fully activated**
layout. Measure the exact first-boot/setup UX on GOLDEN (`adb` only) before
freezing LAB instructions. DenyList-class hiding for banks.

**Rationale**: FR-010 / owner clarification; true AXP resurrection requires
Magisk/Magia-class root, not KernelSU.

**Alternatives considered**:

- KernelSU-Next (`007`) as ship — rejected for this feature (out of ship for
  now).
- Rootless ship — rejected (banking DenyList workflow is part of GOLDEN).
- Magisk only as temporary A/B diagnostic — insufficient for resurrection
  acceptance.

**Follow-up (non-blocking)**: Amend constitution Root architecture section in
a later docs pass so it no longer contradicts Magisk-as-ship.

## Decision: Optional recycle of `007` kernels (FR-016)

**Decision**: Keep the two functional KernelSU kernels/artifacts. Reuse only
if helpful (boot reference, differential debug, later optional path). Never
gate Magisk acceptance on KSU work.

**Alternatives considered**: Delete `007` artifacts — rejected (sunk cost;
optional value). Force dual-boot Magisk+KSU ship — rejected (complexity).

## Decision: Reuse `004`/`005` Google stack; bump microG; keep project Phonesky

**Decision**:

- microG GmsCore + GSF = **newest stable** (or newest tagged pre-release
  upstream ships) verified on this stack; integrate with Phonesky as in AXP.
- Phonesky = **project patched artifact** from the recent host pipeline
  (`docs/004-phonesky-runbook.md` / `/srv/rom/prebuilts/phonesky/`), not a
  blind newest Play download.
- If LAB shows missing GOLDEN-class Play fixes with that artifact → **halt**
  and reconsider Phonesky (spec edge case), do not silently ship FakeStore.
- Signature spoofing = selectable DO toggle (`allow_signature_fake` class from
  `005`); restricted grants for microG + Phonesky only.

**Alternatives considered**: Newest Play APK every week without project patch
pipeline — rejected (breaks reproducible priv-app signing). FakeStore —
forbidden. Re-implement spoofing from scratch — reuse `005` unless A16 gaps.

## Decision: Selectable call recording = EXTENDROM / `008` model

**Decision**: Ship selectable call-recording unlock using GOLDEN-compatible
`Settings.Secure.extendrom_call_recording` + Dialer gate (EXTENDROM
`F_CALLREC` / `008` research). Default OFF.

**Alternatives considered**: Magisk Dialer RRO — rejected (not selectable /
not native). Blind old XML overlays — rejected for A16.

**Note**: Project `FLAG_SECURE` override remains optional vs AXP acceptance;
may ship if `008` work is cheap to include.

## Decision: WebView = LOS23 default, chooser unlocked

**Decision**: Do not ship Aosmium (EOL). Default = LineageOS 23 WebView.
Preserve Android multi-provider selection (Developer options → WebView
implementation).

**Alternatives considered**: Bundle Vanadium/AOSmium fork — rejected (EOL /
out of scope). Lock single provider — rejected (FR-015).

## Decision: Bundled apps = GOLDEN/AXP categories @ newest stable

**Decision**: Enumerate categories from `002` + AXP Pro catalog (Island,
Aurora, F-Droid/repos as on GOLDEN, launcher/gallery-class, DNS/hosts privacy
helpers if present). Install newest workable stables; pin versions in the
acceptance record. Island remains the managed-profile tool (measured on
GOLDEN).

**Alternatives considered**: LOS defaults only — fails resurrection. Exact
GOLDEN version freeze — rejected (owner wants newest stables except
Phonesky).

## Decision: Hardening / signing / AVB inside `009` (staged)

**Decision**: Acceptance includes GOLDEN-class hardening and signing/AVB
posture **as applicable** on LOS 23.2 / sunfish. Implement in **stages inside
`009`** (functional Magisk+Google+apps first, then hardening/signing gates),
but do not open a separate competing feature number for ship ownership.
Document impossible-on-sunfish gaps rather than silent omit.

**Rationale**: Owner Q2 = full resurrection; still obey constitution
“small attributable reversible changes” via staged known-good LAB images.

**Alternatives considered**: Defer all of `011`–`013` — rejected by owner.
One mega-commit everything — rejected (attribution / bisect).

## Decision: Release keys yes; bootloader lock no (2026-09-29)

**Decision**:

1. **Sign with definitive / project release keys** — required for Gate G
   userspace. Move off AOSP test-keys for ship images/OTAs; keep Phonesky and
   update identity on that key. Keys live only on `rom-dev01`
   (`/srv/rom/secrets/`), never in the laptop Git tree.
2. **Do not pursue bootloader relock** as a ship goal. AXP and LineageOS do
   not lock the bootloader as their normal product path; Magisk preroot and
   recovery sideload assume unlocked. IOdes-style locked bootloader is an
   explicit non-goal for this track.

**Rationale**: Clone AXP/LOS norms; avoid a locked-device model that fights
Magisk EXTENDROM preroot. Signing still matters for update trust and
PRESIGNED / same-identity sideload.

**Alternatives considered**: IOdes-class locked AVB ship — rejected by owner
(2026-09-29). Skip release keys entirely — rejected (Gate G / FR signing).

## Decision: Banking workflow deferred (owner future)

**Decision (2026-09-17)**: Banking / Island / Swissquote / Yuh validation is
**deferred**. Not an MVP acceptance gate. Magisk DenyList-class capability
still ships (general). Owner may resume US3 later.

**Rationale**: Owner wants updated AXP clone (features, options, hardening,
security, kernel) first; banks are a personal future problem.

**Alternatives considered**: Keep Swissquote as hard gate — rejected by owner.

## Decision: Updated hardened LOS23 sunfish kernel (FR-017)

**Decision (refined 2026-09-18):** Ship current LineageOS 23.2–compatible
`sunfish` kernel (`msm-4.14`) with attributable hardening. **Not** an
unrelated Graphene A13 / stock prebuilt as base. Record applied/skipped list
in `docs/009-kernel-hardening-map.md`.

**Source priority (owner):**

1. **AXP** — maximum priority; clone their sunfish kernel hardening first
   (build sources / OTA oracle / GOLDEN). Inherited Divest-era commits that
   already live *inside* the AXP stack are fine as part of that clone; do
   **not** separately mine DivestOS EOL trees.
2. **LOS 23.2** — inventory what the lineage kernel already has; avoid
   duplicate work.
3. **IodéOS** — LOS fork, more hardened/deblobbed; clone sources on
   `rom-dev01` and diff for 4.14-safe ideas worth porting.
4. **GrapheneOS** — optional extras only when they make sense on non-GKI
   4.14 sunfish: prefer portable techniques from modern Pixel kernels /
   docs; historical sunfish A13 patches only if still clearly valuable.
   Do **not** treat GOS A13 sunfish tree as the base.

**Out of hunt:** DivestOS as a separate research target (EOL).

**Rationale**: AXP-first resurrection; GOS/Iodé as additive; honest skips on
4.14.

**Inventory (2026-09-18):** LOS `msm-4.14` @ `28f9290ae067` (`4.14.357-openela`).
AXP `kernel_patches` @ `df3cab2155b3` on host. Graphene/AH sequential probe:
OK=30 / SKIP_ALREADY=4 / FAIL=12. Iodé `v5-staging` manifest has no sunfish
4.14 kernel fork. Stage 1 allowlist + apply script under
`vendor/sunfish-a16/patches/009-kernel-hardening/`. CVE mega deferred.
Ledger: `docs/009-kernel-hardening-map.md`.

## Decision: Location / localization hardening — do not extra-cap (FR-018)

**Decision (2026-09-18):** For this Magisk track, **do not** port AXP-class
aggressive location lockdown (kernel or userspace) beyond stock LOS 23.2
defaults. No “non-hardening location” Settings toggle for MVP — that is
extra product surface; simpler and matches owner GPS frustration to **leave
LOS location behaviour**. FR-018 compare doc may still note what AXP did,
for later curiosity, without shipping those caps.

**Alternatives considered**: (1) Clone AXP location caps — rejected (slow /
frustrating fixes). (2) Owner toggle to disable caps — deferred; only if
LOS defaults prove insufficient and owner asks later.


## Decision: Bundled store client = Droidify; no NeoLauncher

**Decision (2026-09-17):** Ship **Droidify** as the F-Droid-class client
instead of stock F-Droid (lighter; many repos by default). Do **not**
integrate NeoLauncher — keep LOS Launcher3. Aurora remains for Play-sideload
workflow.

## Decision: No AXP external repos / OTA servers

**Decision:** Do not wire AXP market/F-Droid remote repos or AXP OTA update
endpoints. AXP infra is EOL / servers down — no product sense. Periodic
system-package refresh is **owner sideload** (FR-019), not network OTA.

## Decision: Sideloadable system package refreshes (FR-019)

**Decision (2026-09-17):** Final ROM MUST keep **microG**, **Magisk**,
**project Phonesky**, and other bundled system/privileged apps
**updateable without full reflash**, on a ~**2–3 month** cadence the owner
drives. Prefer PackageManager-compatible sideload (same signing identity;
PRESIGNED microG; continuous project key for Phonesky). Magisk: document
manager self-update and/or recovery/boot re-patch when APK sideload alone is
not enough. Deliver a short recovery/sideload runbook before ship; do **not**
reintroduce AXP OTA.

## Decision: Private DNS + Internet connectivity (sans axp.os)

**Decision:** Port AXP-class **Private DNS** provider presets. Keep AXP-class
**Internet connectivity** / special INTERNET permission behaviour where it
still fits LOS 23.2, but strip any hard dependency on `axp.os` branding or
endpoints.

## Decision: Restore Disable app on Android 16

**Decision:** Investigate and re-expose classic **Disable application** UX on
A16/LOS23 where Archive replaced or hid it. Owner prefers Disable over
Archive. Exact Settings/PackageManager patch path TBD from AXP/LOS delta
research — must remain attributable and reversible.

## Decision: AXP build sources as compile oracle

**Decision:** On `rom-dev01`, prefer cloning/checking out AXP **build** +
EXTENDROM (and axpos.org developer building docs already mirrored under
`/srv/rom/references/axp/archive/`) to see how Magisk preroot / product packages
are wired — before treating GOLDEN `adb` as the compile guide. GOLDEN stays the
runtime compatibility oracle.

**Decision**: Do **not** freeze localization/location lockdown policy in this
feature’s acceptance. Later compare how much AXP “capea” location vs stock
LOS (owner historically complains AXP is aggressive). Until then, avoid
inventing extra location lockdown beyond what the clone already implies;
matrix row = deferred.

**Alternatives considered**: Blind-copy all AXP location patches now —
rejected (owner wants a deliberate compare first).


## Decision: Version freshness policy

**Decision**: Before long builds: `git fetch --tags` / refresh upstreams for
microG, Magisk, bundled apps; record tag/commit + version codes; never ship
from shallow or stale laptop caches (AGENTS.md lesson from `007`).

**Alternatives considered**: Trust whatever is already on the host — rejected.