AXP-Resurection/specs/009-axp-los23-port/spec.md

Feature Specification: AXP LOS22 feature port to LOS23

Feature Branch: 009-axp-los23-port

Created: 2026-09-16

Status: Spec clarified 2026-09-17 (banking deferred; kernel hardening in; localization compare later) — tasks updated; ready for /speckit-implement

Input: User description: "009-axp based LOS22 feature port to LOS23 — take vanilla LineageOS 23 for sunfish and integrate the full AXP.OS (LOS22 / Android 15 GOLDEN) feature set into LOS23 without product exceptions; only versions change (newest stable for each system / bundled app that still fits sunfish / Android 16); use the project's already updated patched Phonesky (Google Play)."

Owner clarifications (2026-09-16): Magisk like GOLDEN (newest Magisk; AXP-style preinstalled-but-not-fully-activated layout — measure on GOLDEN); hardening / signing / AVB like GOLDEN (full AXP resurrection on LOS23); WebView exception = keep LOS23 WebView (Aosmium EOL) but leave provider selection unlocked; Phonesky = project patched build from recent work unless it lacks GOLDEN-class fixes (then reconsider); microG newest stable integrated with that Phonesky; signature spoofing and call recording selectable (toggles); KernelSU (007) out of ship for now, with optional recycle of existing functional kernels if useful; otherwise everything equal to AXP/GOLDEN.

Owner clarifications (2026-09-17): Primary ship interest = an updated AXP clone on LOS23 (features, options, userspace hardening/security, updated hardened sunfish kernel). Banking / Island / Swissquote / Yuh deferred (owner future). Localization AXP-vs-LOS compare later (FR-018). Prefer AXP build sources + docs on rom-dev01 as the compile oracle (how Magisk / product packaging is wired); GOLDEN adb for runtime behaviour, not the first place to reverse “how to build”. Do not ship NeoLauncher — keep LOS Launcher3. Prefer Droidify over stock F-Droid client (lighter; many repos by default) unless packaging forces otherwise. Do not integrate AXP external market repos or AXP OTA servers (EOL / servers down — no sense). Do clone AXP-class Private DNS presets (many provider entries). Do keep AXP-class Internet connectivity / special INTERNET permission UX where practical, but do not hard-wire axp.os branding/endpoints. Wanted: restore classic Disable app behaviour on Android 16 (LOS/AOSP replaced much of this with Archive, which the owner dislikes) — research and re-expose Disable where still feasible on A16. Later (final ROM): system components (microG, Magisk, project Phonesky, other bundled system apps) MUST remain sideload-updatable on a shipping build — owner plans refreshes every 2–3 months without a full ROM reflash. Packaging MUST preserve update paths (same signing identity / PRESIGNED where applicable; document Magisk update path separately from APK sideload if boot-preroot).

Context / non-goals

Product intent (this feature is normative for the AXP resurrection ship):

• This feature is an AXP.OS resurrection on LineageOS 23.2 / Android 16 sunfish: same capability set as AXP on LOS22 / GOLDEN, moved to LOS23.
• Base ROM = LineageOS 23.2 / Android 16 sunfish vanilla from 003 (or the best known-good vanilla-equivalent flashable baseline already proven on LAB).
• Feature source of truth for what to ship = what AXP.OS Pro / GOLDEN provides on LOS22 (inventory in 002, product catalog in docs/axp-pro-parity.md), without omitting AXP capabilities as “decide later” rows, including Magisk-class root and AXP-class hardening / signing / AVB posture that GOLDEN represents.
• Versions = newest stable (or newest tagged pre-release the upstream project currently ships) for each system/bundled component, constrained to what still works on sunfish / non-GKI 4.14 / LOS 23.2 — not stale laptop caches or shallow-clone version lies.
• Phonesky exception: ship the project's already patched / fixed Phonesky from the recent host pipeline (not “whatever newest Play APK is today”). If that build is missing fixes that GOLDEN's Phonesky path still needs for daily-driver parity, stop and reconsider the Phonesky plan before accepting the feature.
• WebView exception: do not ship Aosmium (EOL). Default WebView = LineageOS 23's WebView. The ROM MUST keep Android's multi-provider path so the owner can install another WebView later and select it (Developer options → WebView implementation) — not locked to a single provider.
• Flash / experiment LAB only; GOLDEN remains the read-only oracle (docs/device-roles.md).

Relationship to earlier features:

• 001–003 remain shared foundation (host, GOLDEN capture, vanilla build).
• Two parallel product tracks (neither deletes the other):
  • Standby / prior track: 004–008 + 007 KernelSU (+ deferred 006/010–013 as previously planned). Kept intact for later resume; live on its own git branch once pushed (see plan notes).
  • Active Magisk-resurrection track (this feature): AXP→LOS23 ship with Magisk like GOLDEN. Does not rewrite or remove 004–008/007 specs; it is a new Speckit directory that may reuse proven LAB runbooks/results from those features when helpful.
• KernelSU / SusFS from 007 stays out of this track’s ship for now. Recycle of the two functional 007 kernels is optional (FR-016) — never an acceptance gate for Magisk.
• Project-only FLAG_SECURE global override may still ship if already specified under 008 (not AXP catalog); it is optional relative to AXP resurrection acceptance. AXP call-recording unlock is required and must be selectable.

Out of scope for this feature (explicit):

• Flashing or modifying GOLDEN.
• Committing proprietary Google Phonesky APK bytes, private keys, or personal identifiers to Git.
• Replacing the LOS 23.2 sunfish kernel/device stack with an unrelated prebuilt (Graphene A13, stock A13, etc.).
• Shipping Aosmium / AOSmium as the default or only WebView (EOL).
• Building a custom AXP-style backup/restore ROM feature (personal backup remains an external user tool if needed).
• Claiming Yuh hardware-attestation PASS if GOLDEN itself currently FAILs that path — banking attestation is deferred with the banking workflow (owner future); do not treat Swissquote/Yuh as ship gates here.
• Deleting or rewriting the standby KernelSU / split-roadmap specs (004–008/007) — they remain valid on the standby branch/track.
• Shipping KernelSU-Next as this track’s root (out of ship here; Magisk is the resurrection root). Optional later reuse of 007 kernels is allowed under FR-016 but MUST NOT delay Magisk acceptance.
• Resolving localization/location-hardening policy vs LOS defaults in this feature’s acceptance (deferred research FR-018 — compare AXP vs LOS later).
• Integrating AXP external F-Droid/market repos or AXP OTA update servers (EOL; servers down — no sense).
• Shipping NeoLauncher.
• Hard-wiring axp.os branding/endpoints into Internet-connectivity / network UX (keep the permission/connectivity behaviour where practical).

User Scenarios & Testing (mandatory)

User Story 1 - AXP resurrection daily-driver on LAB (Priority: P1)

As the owner, after flashing one LAB build produced under this feature, the phone boots and presents an updated AXP-class clone on LOS23: Google compatibility stack, Play, selectable call recording unlock, Magisk root/hide workflow like GOLDEN, AXP options/settings surface, userspace hardening / signing posture, bundled usability apps, and an updated hardened sunfish kernel — except WebView as defined here. Banking/Island validation is out of this story’s acceptance (deferred to owner future / US3).

Why this priority: This is the whole reason for the resurrection.

Independent Test: Flash one 009 build to LAB; walk the GOLDEN daily checklist minus banking (microG Self-Check, Play open/install, call-record toggle off/on, spoofing toggle off/on, Magisk present in AXP-like install state, bundled apps present, hardening/signing + kernel hardening checks); compare against 002 inventory categories.

Acceptance Scenarios:

1. Given LAB on a vanilla 003 baseline (or documented equivalent), When the 009 image is flashed, Then the device boots to home and cellular/Wi‑Fi/basic hardware still work as in the vanilla smoke.
2. Given that build, When I compare shipped capability categories to GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, selectable call recording unlock, Magisk/DenyList-class path, DNS/hosts privacy helpers if present on GOLDEN, F‑Droid/Aurora/launcher/gallery-class bundled apps, userspace hardening/signing/AVB class, kernel update + hardening class), Then no category is left as “decide / later” without an explicit obsolescence or deferred note (WebView exception FR-015; banking deferred FR-006/FR-007; localization hardening compare deferred FR-018).
3. Given Git and host artifact policy, When inspected, Then no proprietary Phonesky APK bytes or secrets were committed.

---

User Story 2 - Google stack: newest microG + project Phonesky (Priority: P1)

As the owner, newest-stable microG + GSF Proxy integrate with the project's recent patched Phonesky so I can open Play, sign in as needed, and install/update apps the same way I do on AXP; signature spoofing is selectable (off = stock-safe default behaviour; on = needed Play/microG path).

Why this priority: Without Play/microG parity, the ROM is not a daily driver.

Independent Test: microG Self-Check; Phonesky launches; install or update at least one ordinary app; toggle spoofing off/on and confirm expected behaviour; push notifications smoke for a known test app.

Acceptance Scenarios:

1. Given the 009 build on LAB, When microG Settings Self-Check runs with spoofing enabled as required, Then checks required for basic Google compatibility pass (or each remaining failure is documented as attestation/hardware outside packaging).
2. Given the project's current patched Phonesky host artifacts, When the ROM is built and flashed, Then com.android.vending is present as privileged Play and opens on LAB.
3. Given selectable signature spoofing, When the owner turns it on, Then Play install/update works with microG without FakeStore; When turned off, Then the device does not expose unrestricted spoofing to arbitrary apps.
4. Given version policy, When microG / GSF versions are recorded, Then each is the newest stable (or tagged pre-release upstream currently ships) verified on this stack; Phonesky version matches the project patched artifact (not a blind “newest Play from the internet”).
5. Given Play behaviour on LAB, When compared to GOLDEN needs, Then if the project Phonesky lacks a GOLDEN-class fix required for daily use, acceptance stops and the Phonesky plan is reconsidered.

---

User Story 3 - Banking profile workflow parity (Priority: P3 — deferred)

As the owner, later I can recreate the GOLDEN banking layout on LAB: Island + Magisk DenyList-class hiding + Swissquote/Yuh. This is explicitly not required to accept the AXP-on-LOS23 clone for functionalities, options, hardening, security, or kernel work.

Why this priority: Owner (2026-09-17) — banking is a future personal problem; do not block the updated AXP clone on bank gates.

Independent Test (when owner resumes): Install Swissquote and attempt Yuh; Island; Magisk DenyList; record PASS/FAIL honestly vs GOLDEN.

Acceptance Scenarios (deferred — not ship gates):

1. Given Island on LAB, When the owner follows the GOLDEN banking install order, Then Swissquote reaches a usable logged-in state in the managed profile.
2. Given Yuh on the same workflow, When tested, Then either it PASSes or the failure matches the known GOLDEN attestation-class failure and is documented — not a silent packaging regression.
3. Given Magisk is present on the build, When banking apps run with DenyList-class configuration, Then they do not receive root.

---

User Story 4 - Magisk like GOLDEN + selectable call recording (Priority: P1)

As the owner, Magisk is present the way AXP/GOLDEN presents it (newest Magisk; preinstalled but not fully activated until I finish setup — exact UX measured from GOLDEN), with DenyList-class hiding; call recording unlock is selectable like other Developer Options toggles.

Why this priority: Root and call recording are core AXP daily behaviours.

Independent Test: Confirm Magisk package/binary layout vs GOLDEN notes; complete activation on LAB if required; DenyList a test app; toggle call recording unlock off (restricted) and on (record allowed).

Acceptance Scenarios:

1. Given a fresh 009 flash, When inspected, Then Magisk is present in an AXP-like preinstalled / not-fully-activated state consistent with GOLDEN measurement, using the newest Magisk stable that works on this stack.
2. Given Magisk setup completed on LAB, When DenyList-class hiding is configured for a test package, Then that package does not receive root (banking packages deferred with US3).
3. Given selectable call recording unlock, When OFF, Then stock LOS country/carrier style restrictions apply; When ON, Then Dialer can record on LAB without that block.

---

User Story 5 - AXP usability, options, hardening + kernel (Priority: P1)

As the owner, the ROM ships the rest of the AXP usability/privacy surface, AXP-class options/settings behaviour, GOLDEN-class userspace hardening / signing / AVB posture, and an updated LOS 23.2 sunfish kernel with attributable hardening (AXP / Graphene / Divest class where still valid on non-GKI 4.14), at newest workable stables, with LOS23 WebView default and an unlocked provider chooser. Localization/location-hardening delta vs LOS is out of scope for now (FR-018 later).

Why this priority: Owner (2026-09-17) — this is the core of “clon actualizado de AXP”, ahead of banking.

Independent Test: Package list vs 002; open bundled apps; confirm default WebView is LOS; userspace hardening/signing checks; kernel version / hardening patch attribution recorded for the accepted build.

Acceptance Scenarios:

1. Given the 009 build, When I list bundled system/user apps in the AXP usability set, Then each GOLDEN/AXP category is present or explicitly marked impossible on Android 16/sunfish with rationale (Aosmium absence is the allowed WebView exception; banking tools may ship as packages without Gate E validation).
2. Given Developer options, When I open WebView implementation, Then LOS23 WebView is available/default and the chooser is not locked against future alternate providers.
3. Given version policy, When bundled apps (except Phonesky per FR-004) are recorded, Then each is newest stable that still runs on the ROM.
4. Given GOLDEN/AXP hardening and signing expectations, When the accepted build is evaluated, Then equivalent class of userspace protections / signing posture is present or each gap is documented as impossible on this stack — not silently dropped.
5. Given the LOS 23.2 sunfish kernel tree, When the accepted boot image is built, Then it is an updated lineage/sunfish-compatible kernel (not an unrelated prebuilt) with attributable hardening patches applied or each skipped hardening item documented.

---

User Story 6 - Parallel tracks stay honest (Priority: P2)

As the owner, docs make clear that this Speckit is the Magisk AXP resurrection track on LOS23, while the prior KernelSU / split roadmap remains on standby (other branch / same 004–008/007 specs untouched).

Why this priority: Lets either track resume without rewriting history.

Independent Test: specs/004–008/007 still exist unchanged in intent; 009 describes Magisk resurrection; git branches separate standby vs active work when published.

Acceptance Scenarios:

1. Given the repo, When inspected, Then 001–008/007 spec directories remain present (not deleted by 009).
2. Given 009, When read as ship intent for Magisk resurrection, Then it does not claim to permanently retire the standby track — only that KernelSU is out of this track’s ship for now.

---

Edge Cases

• Newer “stable” of a bundled app breaks Android 16 / sunfish: pin last known good, document the regression, and retry when a fixed release exists.
• Project Phonesky missing a GOLDEN-class fix: halt acceptance; reconsider Phonesky patch/version plan before claiming Play parity.
• Magisk “preinstalled but not fully installed” UX differs across Magisk versions: match GOLDEN's class of first-boot/setup behaviour; document exact measured steps from GOLDEN before freezing LAB instructions.
• GOLDEN Yuh FAIL vs LAB FAIL: distinguish attestation/hardware class from packaging/spoofing regressions.
• Vanilla LOS already provides an AXP capability (e.g. WireGuard, encryption): keep LOS behaviour; do not duplicate.
• Dirty upgrade from older LAB experimental (incl. KernelSU) images: prefer clean flash for acceptance.
• Phonesky host artifacts missing or wrong signature: fail closed — never silently fall back to FakeStore.
• Alternate WebView installed by user later: selection must remain possible; default remains LOS23 WebView until the user changes it.
• Localization/location hardening: AXP historically more aggressive than LOS in places the owner dislikes; do not decide AXP-vs-LOS location policy in this feature’s acceptance — compare later (FR-018).

Requirements (mandatory)

Functional Requirements

• FR-001: The project MUST produce a flashable LineageOS 23.2 / Android 16 sunfish build that resurrects the AXP.OS on LOS22 / GOLDEN capability set (including Magisk-class root, GOLDEN-class userspace hardening / signing / AVB posture, and an updated hardened sunfish kernel per FR-017), without leaving AXP capabilities as open “decide” omissions except documented exceptions/deferrals (WebView FR-015; banking FR-006/FR-007; localization compare FR-018).
• FR-002: Version selection for system and bundled components (except Phonesky per FR-004) MUST prefer the newest stable (or newest tagged pre-release upstream currently ships) that still works on sunfish / LOS 23.2; GOLDEN versions are a floor reference, not a freeze.
• FR-003: The ROM MUST ship newest-stable microG Services Core and GSF Proxy integrated with the project Phonesky (no FakeStore as primary Play).
• FR-004: The ROM MUST ship the project's recent patched Phonesky as privileged com.android.vending, with a documented host-side obtain / patch / sign / deploy path that never commits APK bytes to Git. If that artifact lacks GOLDEN-class fixes required for daily-driver Play behaviour, the Phonesky plan MUST be reconsidered before acceptance.
• FR-005: The ROM MUST provide selectable signature spoofing for the microG + Phonesky path (owner-controlled toggle; default safe/off or project-documented default). Spoofing MUST remain restricted/controlled — not unrestricted platform spoofing for all apps.
• FR-006: (Deferred — owner future) The ROM SHOULD support the GOLDEN managed-profile banking workflow (Island as measured on GOLDEN) including Swissquote PASS. This is not an acceptance gate for the AXP clone MVP.
• FR-007: (Deferred — owner future) Banking applications SHOULD run without being granted root (Magisk DenyList-class hiding). Magisk MUST still provide DenyList-class capability for general use (FR-010); bank-specific validation is deferred with FR-006.
• FR-008: The ROM MUST include selectable AXP-equivalent call recording unlock (toggle; OFF = stock LOS restrictions, ON = unlock).
• FR-009: The ROM MUST include the AXP usability/privacy bundled surface present on GOLDEN / AXP Pro (stores, launcher/gallery-class apps, DNS/hosts or equivalent blockers when part of that surface) at newest workable stables, subject to FR-015 for WebView.
• FR-010: The ROM MUST ship Magisk like GOLDEN: newest Magisk stable that works on this stack, in an AXP-like preinstalled but not fully activated layout (exact first-boot/setup behaviour measured from GOLDEN), with DenyList-class hiding available. KernelSU is out of ship for now (not the resurrection root path).
• FR-011: The feature acceptance gate MUST include GOLDEN/AXP-class userspace hardening and signing / AVB posture (as applicable on LOS 23.2 / sunfish), not only apps and Google compatibility. Gaps MUST be documented as impossible on this stack rather than silently omitted.
• FR-012: Acceptance flashing MUST use LAB only; GOLDEN MUST remain unmodified by this feature's work.
• FR-013: Each shipped capability MUST be attributable (what upstream or AXP behaviour it reproduces) and reversible (known-good prior LAB image retained).
• FR-014: This feature MUST live as a new Speckit (009) in parallel with the standby KernelSU / split roadmap (004–008/007). Those older specs MUST NOT be deleted or rewritten to match Magisk resurrection. Reusable runbooks/results from them MAY be referenced. For this track’s ship only, Magisk (not KernelSU) is the root path.
• FR-015: Default WebView MUST be LineageOS 23's WebView. Aosmium MUST NOT be required. The ROM MUST keep WebView provider selection available so a future alternate WebView can be installed and chosen.
• FR-016: Existing functional KernelSU / related kernels and artifacts from 007 SHOULD be retained and MAY be recycled when useful (reference boot images, differential debugging, or a later optional non-ship path). Such reuse is optional (“si se puede, ok”), MUST NOT become an acceptance requirement for Magisk resurrection, and MUST NOT imply KernelSU is back in the ship path unless a future spec explicitly says so.
• FR-017: The ship MUST use an updated LineageOS 23.2–compatible sunfish kernel (current lineage/kernel_google_sunfish or project-tracked equivalent — not an unrelated Graphene A13 / stock A13 prebuilt), with attributable kernel hardening ported from AXP / Graphene / Divest where still valid on non-GKI 4.14. Skipped items MUST be documented with rationale.
• FR-018: (Deferred research — look later) Compare how AXP/GOLDEN hardens or constrains localization / location (network location, backends, permissions, privacy toggles) versus stock LineageOS 23 behaviour. Owner historically finds AXP aggressive here; do not freeze a clone-or-LOS policy in this feature’s acceptance until that comparison exists. Default until then: do not silently invent extra location lockdown beyond what the rest of the AXP clone already implies; record the open question in the capability matrix.
• FR-019: On a final shipping 009 image, owner MUST be able to refresh bundled system / privileged packages by sideload (or the documented Magisk-equivalent path) roughly every 2–3 months, without requiring a full ROM reflash for routine bumps of at least: microG (GmsCore / companions), Magisk, project Phonesky, and other project-bundled system apps that the capability inventory treats as updatable. Packaging MUST preserve PackageManager update eligibility (matching signing identity; PRESIGNED where upstream expects self-updates; project-key continuity for Phonesky). Magisk MAY use its normal manager / boot-image update flow when APK-only sideload is insufficient — that path MUST be documented in the recovery/sideload runbook. This does not restore AXP external repos or OTA (still forbidden); updates are owner-driven sideload / recovery packages.

Key Entities

• Vanilla baseline: The LOS 23.2 sunfish build from 003 (or documented equivalent) before AXP feature integration.
• AXP capability set: Inventory of features/packages/behaviours from GOLDEN (002) plus AXP Pro catalog rows promoted by this spec (resurrection target).
• Version pin record: Documented package/component versions chosen for the accepted 009 build (newest workable stable each; Phonesky = project artifact id/version; kernel rev + hardening patch list).
• Phonesky host artifact: Project patched/signed Play APK and permission metadata kept outside Git on the build host.
• Magisk preinstall state: Measured GOLDEN/AXP layout for Magisk present but not fully activated, plus LAB setup steps.
• Hardened sunfish kernel: Updated LOS23-compatible kernel build + attributed hardening patch set for FR-017.
• LAB acceptance build: Flashable image set + hashes + smoke / Magisk / userspace+kernel hardening results for this feature (banking evidence optional/deferred).

Success Criteria (mandatory)

Measurable Outcomes

• SC-001: One LAB flash of a 009 build boots and completes the vanilla hardware smoke within the same session as flash (owner can place a call, use Wi‑Fi, and unlock the device).
• SC-002: 100% of AXP resurrection capability categories from the agreed inventory are either demonstrated on LAB, marked deferred (banking, localization compare), or explicitly documented as impossible on Android 16/sunfish — zero silent omissions (WebView exception allowed only as FR-015).
• SC-003: With spoofing enabled as required, microG Self-Check required items and project Phonesky open/install succeed on LAB for ordinary apps on the first accepted build candidate (or within one documented fix iteration).
• SC-004: (Deferred with US3) Swissquote managed-profile + Magisk DenyList-class workflow PASSes on LAB when owner resumes banking; not required for AXP-clone MVP acceptance.
• SC-005: Every bundled/system app version in the acceptance record (except Phonesky) is newer than or equal to GOLDEN's measured version, unless a newer release was tried and failed with a written regression note; Phonesky matches the recorded project patched artifact.
• SC-006: Owner can turn signature spoofing and call recording unlock off and on and observe the documented behaviour each time.
• SC-007: Magisk is present post-flash in the AXP-like preinstall state and can be fully activated on LAB using documented steps measured from GOLDEN.
• SC-008: Default WebView is LOS23's; provider selection remains available.
• SC-009: Owner can perform the GOLDEN-equivalent daily checklist on LAB excluding deferred banking without consulting a scatter of conflicting feature specs for what “ships”.
• SC-010: Accepted build records kernel revision + hardening attribution list (applied / skipped+why) satisfying FR-017.
• SC-011: Acceptance docs list, for each FR-019 component, the intended update channel (sideload APK / recovery zip / Magisk self-update) and confirm signing identity is not broken by packaging (PRESIGNED or project key as applicable). Full 2–3 month refresh drill MAY wait until a final ROM candidate; packaging regressions that block updates MUST be fixed before ship.

Assumptions

• 003 vanilla LOS 23.2 sunfish is (or becomes) available as the integration base; LAB stock rescue from 002 remains valid.
• GOLDEN inventory (002) plus AXP Pro docs are sufficient to enumerate the capability set; live adb re-query of GOLDEN is allowed (especially Magisk preinstall/activation details).
• “AXP resurrection” / updated clone means Magisk + GOLDEN-class userspace hardening/signing/AVB + AXP user/options surface + updated hardened kernel on LOS23, with WebView, Phonesky-artifact, banking-deferral, and localization-compare exceptions as stated.
• Island / banking validation is owner-future; shipping Island as a bundled app is optional and does not imply Gate E.
• FakeStore is never the primary Play path.
• Selectable spoofing and selectable call recording follow the same class of Developer Options UX already explored in 005/008 runbooks where useful.
• Project FLAG_SECURE override is nice-to-have, not an AXP resurrection hard gate.
• Personal app/data backup is not a ROM feature gate.
• Builds and long compiles run on rom-dev01; laptop holds docs/specs and flash tools only.
• Prior KernelSU LAB experiments (including the two functional kernels already built) are out of ship for now but kept as recyclable assets: reuse if helpful, never required for Magisk acceptance.
• Localization hardening AXP-vs-LOS comparison is intentionally postponed (FR-018); do not block MVP on it.
• No AXP-style OTA or external repos; periodic system-package refresh is owner sideload (FR-019), not a network updater in the ROM.
• microG stays PRESIGNED / replace-prebuilt so same-signer updates remain possible; Phonesky stays on the project signing key across releases; Magisk update docs cover manager + any boot re-patch when needed.