sunfish-admin/AXP-Resurection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
72930e0fd6c575569135907015b3eaaab50e547f
AXP-Resurection/specs/009-axp-los23-port/tasks.md
T
sunfish-admin deaaf42caa 009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2. 
Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.
2026-10-05 10:42:00 +02:00

16 KiB
Raw Blame History

Tasks: AXP LOS22 feature port to LOS23 (resurrection)

Input: Design documents from /specs/009-axp-los23-port/
Prerequisites: plan.md, spec.md, research.md, data-model.md, contracts/, quickstart.md; constitution Magisk-resurrection track; standby KernelSU track (004–008/007) remains untouched

Tests: LAB acceptance only (Gates A–G in contracts/acceptance-gates.md). No unit/contract TDD suite requested — validation tasks are adb/flash checks.

Organization: Setup → Foundational → US1 / US2 / US4 / US5 (MVP) → US6 → Polish. US3 banking is deferred (P3) — skip for MVP. US5 includes kernel update + hardening (FR-017). Localization AXP-vs-LOS (FR-018) = look later, not a ship gate. Full US1 Independent Test needs US2+US4+US5 (not banking).

Format: [ID] [P?] [Story] Description

  • [P]: Can run in parallel (different files, no incomplete deps)
  • [Story]: US1…US6 from spec.md
  • Include exact file paths in descriptions

Path conventions

  • Meta repo: vendor/sunfish-a16/, docs/, specs/009-axp-los23-port/
  • Build host: /srv/rom/src/lineage/, /srv/rom/prebuilts/, /srv/rom/artifacts/009-axp-los23-port/, /srv/rom/secrets/
  • LAB: 11231JEC207477 only — never GOLDEN flash/modify
  • GOLDEN: adb read-only oracle (esp. Magisk preinstall layout)

Phase 1: Setup (Shared Infrastructure)

Purpose: Host dirs, runbook stubs, capability inventory scaffold

  • T001 Create host dirs /srv/rom/prebuilts/{magisk,axp-apps}/, /srv/rom/artifacts/009-axp-los23-port/, /srv/rom/logs/009-build/ on rom-dev01 (android-build writable)
  • T002 [P] Add stub docs/009-magisk-preinstall-runbook.md (GOLDEN measure checklist, activation steps, DenyList banking order, LAB serial)
  • T003 [P] Add stub docs/009-version-pins.md (VersionPinRecord table: component / version_name / version_code / upstream_ref / policy / verified_on)
  • T004 [P] Add stub docs/009-capability-matrix.md mapping docs/002-golden-inventory.md + docs/axp-pro-parity.md rows → required / exception / impossible per data-model.md AxpCapabilitySet
  • T005 [P] Create vendor/sunfish-a16/patches/009-axp-los23-port/README.md (Magisk-resurrection apply order; reuse 005/008; no KernelSU ship; attribute upstreams)

Checkpoint: Dirs + stubs exist; no bacon yet

Phase 2: Foundational (Blocking Prerequisites)

Purpose: Freshness policy, GOLDEN Magisk measurement, product wiring baseline — MUST complete before story packages land on LAB acceptance builds

⚠️ CRITICAL: Blocks user-story packaging/flash acceptance

  • T006 Refresh microG + GSF to newest stable upstream (fetch tags / releases; no stale host cache) into /srv/rom/prebuilts/microg/ + VERSIONS.txt; record pins in docs/009-version-pins.md
  • T007 [P] Confirm project patched Phonesky still present under /srv/rom/prebuilts/phonesky/ + XMLs; record artifact id in docs/009-version-pins.md (policy=project_phonesky); halt note if GOLDEN-class gap suspected
  • T008 [P] Fetch newest Magisk stable that targets this stack into /srv/rom/prebuilts/magisk/ + VERSIONS.txt; record pin in docs/009-version-pins.md
  • T009 Measure GOLDEN Magisk/Magia preinstall layout via adb only (paths, packages, first-boot/setup UX) and write results into docs/009-magisk-preinstall-runbook.md (FR-010 / contracts/ magisk-preinstall.md)
  • T010 Fill docs/009-capability-matrix.md for all GOLDEN/AXP categories (google-stack, spoofing, call-rec, Magisk, bundled apps, DNS/hosts, userspace hardening/signing/AVB, kernel hardening, WebView=exception, banking=deferred, localization=deferred FR-018); zero silent omissions
  • T011 Wire Magisk-resurrection product includes in vendor/sunfish-a16/ (extend gms.mk / add magisk.mk or equivalent; keep Phonesky priv-app path; no FakeStore; no KernelSU product packages) and document include hook in vendor/sunfish-a16/patches/009-axp-los23-port/README.md
  • T012 Confirm 003 vanilla (or documented equivalent) known-good baseline is available for LAB clean-flash acceptance; note rev in docs/009-version-pins.md VanillaBaseline row
  • T013 [P] Confirm optional 007 kernel artifacts remain on host under /srv/rom/artifacts/007-*/ for FR-016 recycle only; list paths in docs/009-magisk-preinstall-runbook.md as non-ship

Checkpoint: Prebuilts fresh, Magisk UX measured, product wire documented — story work can begin

Phase 3: User Story 1 — AXP resurrection daily-driver on LAB (Priority: P1) 🎯 MVP framing

Goal: One flashable 009 composition path and Gate A smoke; full daily-driver Independent Test completes after US2+US4+US5 (banking deferred)

Independent Test: Flash one 009 build to LAB; walk GOLDEN checklist minus banking from docs/009-capability-matrix.md

Implementation for User Story 1

  • T014 [US1] Define staged known-good image policy in docs/009-magisk-preinstall-runbook.md (retain prior LAB image hashes under /srv/rom/artifacts/009-axp-los23-port/<build-id>/ per FR-013)
  • T015 [US1] Add LAB flash/acceptance checklist linking Gates A–G to specs/009-axp-los23-port/quickstart.md and contracts/acceptance-gates.md (artifact subdirs gate-a/…gate-g/)
  • T016 [US1] Produce first Magisk-track bacon on rom-dev01 (detached /srv/rom/artifacts/bin/rom-detach / tmux) with current wired packages; logs under /srv/rom/logs/009-build/; images + SHA-256 under /srv/rom/artifacts/009-axp-los23-port/<build-id>/
  • T017 [US1] Clean-flash LAB 11231JEC207477 only; complete Gate A (boot/home/call/Wi‑Fi/unlock); save getprop + notes under …/<build-id>/gate-a/
  • T018 [US1] After US2+US4+US5 land, re-flash accepted candidate and mark SC-001…SC-003 + SC-005…SC-010 / Gates A–D + F–G in /srv/rom/artifacts/009-axp-los23-port/<build-id>/acceptance.md against docs/009-capability-matrix.md (skip Gate E / SC-004)
  • T019 [US1] Verify Git/meta-repo contains no proprietary Phonesky APK bytes or secrets; document check in /srv/rom/artifacts/009-axp-los23-port/<build-id>/acceptance.md

Checkpoint: Gate A proven; full US1 Independent Test after US2+US4+US5

Phase 4: User Story 2 — Google stack: newest microG + project Phonesky (Priority: P1)

Goal: Newest microG/GSF + project Phonesky + selectable restricted spoofing

Independent Test: microG Self-Check; Phonesky open/install; spoofing OFF/ON per contracts/toggles-surface.md

Implementation for User Story 2

  • T020 [P] [US2] Ensure vendor/sunfish-a16/gms.mk + vendor/sunfish-a16/Android.mk package refreshed microG/GSF + Phonesky without FakeStore; privilege XMLs remain under vendor/sunfish-a16/permissions/ and vendor/sunfish-a16/default-permissions/
  • T021 [P] [US2] Re-apply / verify selectable signature spoofing via vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py on LOS 23.2 tree; document A16 deltas in docs/005-spoofing-runbook.md (or docs/009-magisk-preinstall-runbook.md cross-link)
  • T022 [US2] Build+flash LAB image including Google stack; run Gate B (Self-Check, Phonesky open, ordinary app install/update); evidence under /srv/rom/artifacts/009-axp-los23-port/<build-id>/gate-b/
  • T023 [US2] Verify Secure key allow_signature_fake OFF/ON behaviour per contracts/toggles-surface.md; record in …/<build-id>/gate-c/spoofing.md
  • T024 [US2] Finalize microG/GSF/Phonesky rows in docs/009-version-pins.md; if Phonesky lacks GOLDEN-class daily fix → FAIL closed note in …/<build-id>/gate-b/phonesky-halt.md (do not accept)

Checkpoint: Gate B + spoofing half of Gate C pass (or explicit Phonesky halt)

Phase 5: User Story 3 — Banking (Priority: P3 — deferred)

Goal: Island + Magisk DenyList banking — owner future; not MVP

Independent Test: (when resumed) Swissquote in Island; Yuh honest; no root

Deferred tasks (do not block acceptance)

  • T025 [P] [US3] (Deferred) Stage Island under /srv/rom/prebuilts/axp-apps/ and wire into vendor/sunfish-a16/ if desired as optional package; pin in docs/009-version-pins.md
  • T026 [US3] (Deferred) Document GOLDEN banking order in docs/009-magisk-preinstall-runbook.md
  • T027 [US3] (Deferred) Swissquote Gate E under /srv/rom/artifacts/009-axp-los23-port/<build-id>/gate-e/swissquote/
  • T028 [US3] (Deferred) Yuh classify in …/gate-e/yuh.md
  • T029 [US3] (Deferred) Banks lack root note in …/gate-e/root-check.md

Checkpoint: Skipped for MVP — resume only when owner asks

Phase 6: User Story 4 — Magisk like GOLDEN + selectable call recording (Priority: P1)

Goal: Magisk AXP-like preinstall + DenyList; selectable call-rec unlock

Independent Test: Preinstall state vs GOLDEN notes; activation; DenyList test app; call-rec OFF/ON

Implementation for User Story 4

  • T030 [US4] Implement Magisk AXP-like preinstall packaging from /srv/rom/prebuilts/magisk/ into vendor/sunfish-a16/magisk.mk (or equivalent) matching docs/009-magisk-preinstall-runbook.md measured layout (contracts/magisk-preinstall.md)
  • T031 [P] [US4] Re-apply / verify selectable call-rec unlock via vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py (extendrom_call_recording); keep default OFF; optional FLAG_SECURE not required for AXP acceptance — document in docs/008-call-rec-flag-secure-runbook.md
  • T032 [US4] Build+flash LAB; document pre-activation Magisk state vs GOLDEN under …/<build-id>/magisk/pre-activation.md (Gate D)
  • T033 [US4] Complete Magisk activation on LAB per runbook; configure DenyList-class hide for a test package (not bank gate); save version + screenshots under …/<build-id>/magisk/
  • T034 [US4] Verify extendrom_call_recording OFF = stock restrictions, ON = Dialer can record; evidence under …/<build-id>/gate-c/call-rec.md
  • T035 [US4] Record Magisk version pin (newest workable stable) in docs/009-version-pins.md

Checkpoint: Gates C (call-rec) + D pass

Phase 7: User Story 5 — Usability, options, hardening + kernel (Priority: P1)

Goal: Bundled AXP surface; LOS23 WebView; userspace hardening/signing; updated hardened sunfish kernel (FR-017). Localization compare = later.

Independent Test: Packages vs matrix; WebView LOS; Gate G userspace + kernel attribution (SC-010)

Implementation for User Story 5

  • T036 [P] [US5] Enumerate bundled usability packages from docs/009-capability-matrix.md (Aurora, F-Droid/repos as on GOLDEN, launcher/gallery-class, DNS/hosts helpers if required); stage newest workable APKs under /srv/rom/prebuilts/axp-apps/
  • T037 [US5] Wire bundled apps into vendor/sunfish-a16/ product makefiles; pin all versions in docs/009-version-pins.md
  • T038 [P] [US5] Verify WebView policy: no Aosmium; default LOS23 provider; chooser unlocked — document in …/<build-id>/gate-f/webview.md per contracts/webview-surface.md
  • T039 [US5] Build+flash LAB; confirm bundled categories present or marked impossible/deferred in docs/009-capability-matrix.md; Gate F evidence under …/<build-id>/gate-f/
  • T040 [US5] Define staged userspace hardening/signing/AVB checklist in docs/009-hardening-signing-checklist.md (GOLDEN vs LAB measured 2026-09-29; release keys yes / bootloader lock wont; stages US-S0…S6)
  • T041 [US5] Implement first attributable userspace hardening/signing stage under vendor/sunfish-a16/patches/009-axp-los23-port/ (US-S1 keygen + US-S2 wire); keep known-good prior image (20260929T123401Z-axp-stage1-combo4)
  • T042 [US5] Inventory LOS23 sunfish kernel tree on rom-dev01 (/srv/rom/src/lineage/kernel/google/sunfish or manifest path); record baseline rev in docs/009-version-pins.md
  • T043 [US5] Build attributable kernel hardening patch list (AXP / Graphene / Divest → 4.14-safe) in docs/009-kernel-hardening-map.md (applied vs skip+why)
  • T044 [US5] Apply first kernel hardening stage on LOS23 sunfish kernel; rebuild boot; flash LAB; evidence under …/<build-id>/gate-g/kernel/
  • T045 [US5] Run Gate G userspace+kernel on accepted candidate; gaps in …/<build-id>/gate-g/gaps.md; do not block on FR-018 localization
  • T046 [P] [US5] (Look later — FR-018) Stub only: docs/009-localization-axp-vs-los.md outlining what to compare later (AXP location lockdown vs stock LOS); no policy decision in MVP
  • T046a [P] [US5] (FR-019 — before final ship) Write docs/009-sideload-system-updates.md: how to refresh microG, Magisk, Phonesky, and other system apps every ~2–3 months without full reflash (signing identity / PRESIGNED / Magisk manager+boot path); verify packaging does not break update eligibility

Checkpoint: Gates F + G (userspace + kernel) for claimed stage; FR-018 stub only; FR-019 runbook before final ship

Phase 8: User Story 6 — Parallel tracks stay honest (Priority: P2)

Goal: Docs/branches make Magisk 009 active vs KernelSU standby clear

Independent Test: specs/004–008/007 still present; 009 does not retire standby track

Implementation for User Story 6

  • T047 [P] [US6] Update docs/README.md (and AGENTS.md if needed) to state active Magisk-resurrection track = 009 / this repo; standby KernelSU = sibling sunfish-a16-rom + specs 004–008/007
  • T048 [P] [US6] Add short track note to specs/009-axp-los23-port/spec.md only if needed (do not rewrite standby feature specs)
  • T049 [US6] Remap relevant docs/axp-pro-parity.md rows to 009
  • T050 [US6] Confirm specs/001–008/007 directories still exist; record in /srv/rom/artifacts/009-axp-los23-port/<build-id>/acceptance.md
  • T051 [P] [US6] Document optional FR-016 KSU recycle (non-ship) in docs/009-magisk-preinstall-runbook.md + docs/007-kernelsu-runbook.md cross-link

Checkpoint: Parallel-track honesty readable without rewriting history

Phase 9: Polish & Cross-Cutting Concerns

Purpose: Freshness audit, quickstart validation, handoff

  • T052 [P] Audit all docs/009-version-pins.md rows against freshness policy; fix stale host copies if found
  • T053 [P] Run specs/009-axp-los23-port/quickstart.md on LAB (skip Gate E); fix doc gaps
  • T054 Collect final artifacts under /srv/rom/artifacts/009-axp-los23-port/<build-id>/
  • T055 [P] Add/update docs/009-gate-handoff.md (next: banking later; localization compare FR-018 later; sideload refresh cadence FR-019)
  • T056 Mark specs/009-axp-los23-port/spec.md Status after Gates A–D + F–G

Dependencies & Execution Order

MVP order (owner 2026-09-17)

  1. Setup + Foundational
  2. US2 Google stack
  3. US4 Magisk + call-rec
  4. US5 usability + hardening + kernel
  5. US1 full acceptance (T018) without banking
  6. US6 docs
  7. (Later) US3 banking + FR-018 localization compare

Suggested MVP scope

T001–T024 + T030–T046 (skip T025–T029)

Notes

  • Banking Gate E / T025–T029 = deferred (owner future)
  • Kernel hardening = in-scope (FR-017); localization policy = later (FR-018)
  • LAB only; never flash GOLDEN
  • Long builds detached on rom-dev01
  • Owner handles git commit / push / MR
Reference in new issue View Git Blame Copy Permalink