AXP-Resurection/specs/009-axp-los23-port/research.md

Research: 009-axp-los23-port

Decision: Product = AXP resurrection on LOS 23.2 (parallel track)

Decision: Treat 009 as the normative ship feature for the Magisk AXP resurrection track that ports the AXP.OS / GOLDEN LOS22 capability set onto LineageOS 23.2 vanilla (003), with only the explicit exceptions in the spec (WebView, Phonesky artifact, optional KSU recycle). Keep the prior KernelSU / split roadmap (004–008/007 + deferred items) on a standby git branch without deleting or rewriting those specs.

Rationale: Owner wants Magisk “todo igual” to AXP now, without throwing away the earlier KSU investment; either track may resume later.

Alternatives considered: Hard-supersede/delete the split roadmap — rejected (owner wants standby). Continue only KSU track — rejected for current ship preference.

Decision: Magisk ship root (constitution variance)

Decision: Ship Magisk like GOLDEN — newest Magisk stable that works on sunfish / LOS 23.2 — in an AXP-like preinstalled but not fully activated layout. Measure the exact first-boot/setup UX on GOLDEN (adb only) before freezing LAB instructions. DenyList-class hiding for banks.

Rationale: FR-010 / owner clarification; true AXP resurrection requires Magisk/Magia-class root, not KernelSU.

Alternatives considered:

• KernelSU-Next (007) as ship — rejected for this feature (out of ship for now).
• Rootless ship — rejected (banking DenyList workflow is part of GOLDEN).
• Magisk only as temporary A/B diagnostic — insufficient for resurrection acceptance.

Follow-up (non-blocking): Amend constitution Root architecture section in a later docs pass so it no longer contradicts Magisk-as-ship.

Decision: Optional recycle of 007 kernels (FR-016)

Decision: Keep the two functional KernelSU kernels/artifacts. Reuse only if helpful (boot reference, differential debug, later optional path). Never gate Magisk acceptance on KSU work.

Alternatives considered: Delete 007 artifacts — rejected (sunk cost; optional value). Force dual-boot Magisk+KSU ship — rejected (complexity).

Decision: Reuse 004/005 Google stack; bump microG; keep project Phonesky

Decision:

• microG GmsCore + GSF = newest stable (or newest tagged pre-release upstream ships) verified on this stack; integrate with Phonesky as in AXP.
• Phonesky = project patched artifact from the recent host pipeline (docs/004-phonesky-runbook.md / /srv/rom/prebuilts/phonesky/), not a blind newest Play download.
• If LAB shows missing GOLDEN-class Play fixes with that artifact → halt and reconsider Phonesky (spec edge case), do not silently ship FakeStore.
• Signature spoofing = selectable DO toggle (allow_signature_fake class from 005); restricted grants for microG + Phonesky only.

Alternatives considered: Newest Play APK every week without project patch pipeline — rejected (breaks reproducible priv-app signing). FakeStore — forbidden. Re-implement spoofing from scratch — reuse 005 unless A16 gaps.

Decision: Selectable call recording = EXTENDROM / 008 model

Decision: Ship selectable call-recording unlock using GOLDEN-compatible Settings.Secure.extendrom_call_recording + Dialer gate (EXTENDROM F_CALLREC / 008 research). Default OFF.

Alternatives considered: Magisk Dialer RRO — rejected (not selectable / not native). Blind old XML overlays — rejected for A16.

Note: Project FLAG_SECURE override remains optional vs AXP acceptance; may ship if 008 work is cheap to include.

Decision: WebView = LOS23 default, chooser unlocked

Decision: Do not ship Aosmium (EOL). Default = LineageOS 23 WebView. Preserve Android multi-provider selection (Developer options → WebView implementation).

Alternatives considered: Bundle Vanadium/AOSmium fork — rejected (EOL / out of scope). Lock single provider — rejected (FR-015).

Decision: Bundled apps = GOLDEN/AXP categories @ newest stable

Decision: Enumerate categories from 002 + AXP Pro catalog (Island, Aurora, F-Droid/repos as on GOLDEN, launcher/gallery-class, DNS/hosts privacy helpers if present). Install newest workable stables; pin versions in the acceptance record. Island remains the managed-profile tool (measured on GOLDEN).

Alternatives considered: LOS defaults only — fails resurrection. Exact GOLDEN version freeze — rejected (owner wants newest stables except Phonesky).

Decision: Hardening / signing / AVB inside 009 (staged)

Decision: Acceptance includes GOLDEN-class hardening and signing/AVB posture as applicable on LOS 23.2 / sunfish. Implement in stages inside 009 (functional Magisk+Google+apps first, then hardening/signing gates), but do not open a separate competing feature number for ship ownership. Document impossible-on-sunfish gaps rather than silent omit.

Rationale: Owner Q2 = full resurrection; still obey constitution “small attributable reversible changes” via staged known-good LAB images.

Alternatives considered: Defer all of 011–013 — rejected by owner. One mega-commit everything — rejected (attribution / bisect).

Decision: Release keys yes; bootloader lock no (2026-09-29)

Decision:

1. Sign with definitive / project release keys — required for Gate G userspace. Move off AOSP test-keys for ship images/OTAs; keep Phonesky and update identity on that key. Keys live only on rom-dev01 (/srv/rom/secrets/), never in the laptop Git tree.
2. Do not pursue bootloader relock as a ship goal. AXP and LineageOS do not lock the bootloader as their normal product path; Magisk preroot and recovery sideload assume unlocked. IOdes-style locked bootloader is an explicit non-goal for this track.

Rationale: Clone AXP/LOS norms; avoid a locked-device model that fights Magisk EXTENDROM preroot. Signing still matters for update trust and PRESIGNED / same-identity sideload.

Alternatives considered: IOdes-class locked AVB ship — rejected by owner (2026-09-29). Skip release keys entirely — rejected (Gate G / FR signing).

Decision: Banking workflow deferred (owner future)

Decision (2026-09-17): Banking / Island / Swissquote / Yuh validation is deferred. Not an MVP acceptance gate. Magisk DenyList-class capability still ships (general). Owner may resume US3 later.

Rationale: Owner wants updated AXP clone (features, options, hardening, security, kernel) first; banks are a personal future problem.

Alternatives considered: Keep Swissquote as hard gate — rejected by owner.

Decision: Updated hardened LOS23 sunfish kernel (FR-017)

Decision (refined 2026-09-18): Ship current LineageOS 23.2–compatible sunfish kernel (msm-4.14) with attributable hardening. Not an unrelated Graphene A13 / stock prebuilt as base. Record applied/skipped list in docs/009-kernel-hardening-map.md.

Source priority (owner):

1. AXP — maximum priority; clone their sunfish kernel hardening first (build sources / OTA oracle / GOLDEN). Inherited Divest-era commits that already live inside the AXP stack are fine as part of that clone; do not separately mine DivestOS EOL trees.
2. LOS 23.2 — inventory what the lineage kernel already has; avoid duplicate work.
3. IodéOS — LOS fork, more hardened/deblobbed; clone sources on rom-dev01 and diff for 4.14-safe ideas worth porting.
4. GrapheneOS — optional extras only when they make sense on non-GKI 4.14 sunfish: prefer portable techniques from modern Pixel kernels / docs; historical sunfish A13 patches only if still clearly valuable. Do not treat GOS A13 sunfish tree as the base.

Out of hunt: DivestOS as a separate research target (EOL).

Rationale: AXP-first resurrection; GOS/Iodé as additive; honest skips on 4.14.

Inventory (2026-09-18): LOS msm-4.14 @ 28f9290ae067 (4.14.357-openela). AXP kernel_patches @ df3cab2155b3 on host. Graphene/AH sequential probe: OK=30 / SKIP_ALREADY=4 / FAIL=12. Iodé v5-staging manifest has no sunfish 4.14 kernel fork. Stage 1 allowlist + apply script under vendor/sunfish-a16/patches/009-kernel-hardening/. CVE mega deferred. Ledger: docs/009-kernel-hardening-map.md.

Decision: Location / localization hardening — do not extra-cap (FR-018)

Decision (2026-09-18): For this Magisk track, do not port AXP-class aggressive location lockdown (kernel or userspace) beyond stock LOS 23.2 defaults. No “non-hardening location” Settings toggle for MVP — that is extra product surface; simpler and matches owner GPS frustration to leave LOS location behaviour. FR-018 compare doc may still note what AXP did, for later curiosity, without shipping those caps.

Alternatives considered: (1) Clone AXP location caps — rejected (slow / frustrating fixes). (2) Owner toggle to disable caps — deferred; only if LOS defaults prove insufficient and owner asks later.

Decision: Bundled store client = Droidify; no NeoLauncher

Decision (2026-09-17): Ship Droidify as the F-Droid-class client instead of stock F-Droid (lighter; many repos by default). Do not integrate NeoLauncher — keep LOS Launcher3. Aurora remains for Play-sideload workflow.

Decision: No AXP external repos / OTA servers

Decision: Do not wire AXP market/F-Droid remote repos or AXP OTA update endpoints. AXP infra is EOL / servers down — no product sense. Periodic system-package refresh is owner sideload (FR-019), not network OTA.

Decision: Sideloadable system package refreshes (FR-019)

Decision (2026-09-17): Final ROM MUST keep microG, Magisk, project Phonesky, and other bundled system/privileged apps updateable without full reflash, on a ~2–3 month cadence the owner drives. Prefer PackageManager-compatible sideload (same signing identity; PRESIGNED microG; continuous project key for Phonesky). Magisk: document manager self-update and/or recovery/boot re-patch when APK sideload alone is not enough. Deliver a short recovery/sideload runbook before ship; do not reintroduce AXP OTA.

Decision: Private DNS + Internet connectivity (sans axp.os)

Decision: Port AXP-class Private DNS provider presets. Keep AXP-class Internet connectivity / special INTERNET permission behaviour where it still fits LOS 23.2, but strip any hard dependency on axp.os branding or endpoints.

Decision: Restore Disable app on Android 16

Decision: Investigate and re-expose classic Disable application UX on A16/LOS23 where Archive replaced or hid it. Owner prefers Disable over Archive. Exact Settings/PackageManager patch path TBD from AXP/LOS delta research — must remain attributable and reversible.

Decision: AXP build sources as compile oracle

Decision: On rom-dev01, prefer cloning/checking out AXP build + EXTENDROM (and axpos.org developer building docs already mirrored under /srv/rom/references/axp/archive/) to see how Magisk preroot / product packages are wired — before treating GOLDEN adb as the compile guide. GOLDEN stays the runtime compatibility oracle.

Decision: Do not freeze localization/location lockdown policy in this feature’s acceptance. Later compare how much AXP “capea” location vs stock LOS (owner historically complains AXP is aggressive). Until then, avoid inventing extra location lockdown beyond what the clone already implies; matrix row = deferred.

Alternatives considered: Blind-copy all AXP location patches now — rejected (owner wants a deliberate compare first).

Decision: Version freshness policy

Decision: Before long builds: git fetch --tags / refresh upstreams for microG, Magisk, bundled apps; record tag/commit + version codes; never ship from shallow or stale laptop caches (AGENTS.md lesson from 007).

Alternatives considered: Trust whatever is already on the host — rejected.