AXP-Resurection/specs/009-axp-los23-port/spec.md

# Feature Specification: AXP LOS22 feature port to LOS23

**Feature Branch**: `009-axp-los23-port`

**Created**: 2026-09-16

**Status**: Spec clarified 2026-09-17 (banking deferred; kernel hardening in;
localization compare later) — tasks updated; ready for `/speckit-implement`

**Input**: User description: "009-axp based LOS22 feature port to LOS23 —
take vanilla LineageOS 23 for sunfish and integrate the full AXP.OS (LOS22 /
Android 15 GOLDEN) feature set into LOS23 without product exceptions; only
versions change (newest stable for each system / bundled app that still fits
sunfish / Android 16); use the project's already updated patched Phonesky
(Google Play)."

**Owner clarifications (2026-09-16):** Magisk like GOLDEN (newest Magisk;
AXP-style preinstalled-but-not-fully-activated layout — measure on GOLDEN);
hardening / signing / AVB like GOLDEN (full **AXP resurrection** on LOS23);
WebView exception = keep LOS23 WebView (Aosmium EOL) but leave provider
selection unlocked; Phonesky = project patched build from recent work unless
it lacks GOLDEN-class fixes (then reconsider); microG newest stable integrated
with that Phonesky; signature spoofing and call recording **selectable**
(toggles); KernelSU (`007`) out of ship for now, with optional recycle of
existing functional kernels if useful; otherwise everything equal to
AXP/GOLDEN.

**Owner clarifications (2026-09-17):** Primary ship interest = an **updated
AXP clone on LOS23** (features, options, userspace hardening/security, updated
hardened sunfish kernel). Banking / Island / Swissquote / Yuh **deferred**
(owner future). Localization AXP-vs-LOS compare **later** (FR-018). Prefer AXP
**build sources + docs** on `rom-dev01` as the compile oracle (how Magisk /
product packaging is wired); GOLDEN `adb` for *runtime* behaviour, not the
first place to reverse “how to build”. **Do not** ship NeoLauncher — keep LOS
Launcher3. Prefer **Droidify** over stock F-Droid client (lighter; many repos
by default) unless packaging forces otherwise. **Do not** integrate AXP
**external** market repos or AXP **OTA** servers (EOL / servers down — no
sense). **Do** clone AXP-class **Private DNS** presets (many provider entries).
**Do** keep AXP-class **Internet connectivity** / special INTERNET permission
UX where practical, but **do not** hard-wire `axp.os` branding/endpoints.
**Wanted:** restore classic **Disable app** behaviour on Android 16 (LOS/AOSP
replaced much of this with **Archive**, which the owner dislikes) — research
and re-expose Disable where still feasible on A16. **Later (final ROM):**
system components (microG, Magisk, project Phonesky, other bundled system
apps) MUST remain **sideload-updatable** on a shipping build — owner plans
refreshes every **2–3 months** without a full ROM reflash. Packaging MUST
preserve update paths (same signing identity / PRESIGNED where applicable;
document Magisk update path separately from APK sideload if boot-preroot).


## Context / non-goals

**Product intent (this feature is normative for the AXP resurrection ship):**

- This feature is an **AXP.OS resurrection** on LineageOS 23.2 / Android 16
  `sunfish`: same capability set as AXP on LOS22 / GOLDEN, moved to LOS23.
- Base ROM = LineageOS 23.2 / Android 16 `sunfish` vanilla from `003` (or the
  best known-good vanilla-equivalent flashable baseline already proven on LAB).
- Feature source of truth for *what* to ship = what AXP.OS Pro / GOLDEN
  provides on LOS22 (inventory in `002`, product catalog in
  `docs/axp-pro-parity.md`), **without omitting AXP capabilities as “decide
  later” rows**, including Magisk-class root and AXP-class hardening /
  signing / AVB posture that GOLDEN represents.
- Versions = **newest stable** (or newest tagged pre-release the upstream
  project currently ships) for each system/bundled component, constrained to
  what still works on sunfish / non-GKI 4.14 / LOS 23.2 — not stale laptop
  caches or shallow-clone version lies.
- **Phonesky exception:** ship the project's **already patched / fixed
  Phonesky** from the recent host pipeline (not “whatever newest Play APK
  is today”). If that build is missing fixes that GOLDEN's Phonesky path
  still needs for daily-driver parity, stop and reconsider the Phonesky
  plan before accepting the feature.
- **WebView exception:** do **not** ship Aosmium (EOL). Default WebView =
  LineageOS 23's WebView. The ROM MUST keep Android's multi-provider path so
  the owner can install another WebView later and select it (Developer
  options → WebView implementation) — not locked to a single provider.
- Flash / experiment **LAB only**; GOLDEN remains the read-only oracle
  (`docs/device-roles.md`).

**Relationship to earlier features:**

- `001`–`003` remain shared foundation (host, GOLDEN capture, vanilla build).
- **Two parallel product tracks** (neither deletes the other):
  - **Standby / prior track:** `004`–`008` + `007` KernelSU (+ deferred
    `006`/`010`–`013` as previously planned). Kept intact for later resume;
    live on its own git branch once pushed (see plan notes).
  - **Active Magisk-resurrection track (this feature):** AXP→LOS23 ship with
    Magisk like GOLDEN. Does **not** rewrite or remove `004`–`008`/`007`
    specs; it is a new Speckit directory that may **reuse** proven LAB
    runbooks/results from those features when helpful.
- KernelSU / SusFS from `007` stays **out of this track’s ship** for now.
  Recycle of the two functional `007` kernels is optional (FR-016) — never an
  acceptance gate for Magisk.
- Project-only `FLAG_SECURE` global override may still ship if already
  specified under `008` (not AXP catalog); it is optional relative to AXP
  resurrection acceptance. AXP call-recording unlock **is** required and must
  be selectable.

**Out of scope for this feature (explicit):**

- Flashing or modifying GOLDEN.
- Committing proprietary Google Phonesky APK bytes, private keys, or personal
  identifiers to Git.
- Replacing the LOS 23.2 sunfish kernel/device stack with an unrelated prebuilt
  (Graphene A13, stock A13, etc.).
- Shipping Aosmium / AOSmium as the default or only WebView (EOL).
- Building a custom AXP-style backup/restore ROM feature (personal backup
  remains an external user tool if needed).
- Claiming Yuh hardware-attestation PASS if GOLDEN itself currently FAILs that
  path — banking attestation is deferred with the banking workflow (owner
  future); do not treat Swissquote/Yuh as ship gates here.
- Deleting or rewriting the standby KernelSU / split-roadmap specs
  (`004`–`008`/`007`) — they remain valid on the standby branch/track.
- Shipping KernelSU-Next as this track’s root (out of ship here; Magisk is
  the resurrection root). Optional later reuse of `007` kernels is allowed
  under FR-016 but MUST NOT delay Magisk acceptance.
- Resolving localization/location-hardening policy vs LOS defaults in this
  feature’s acceptance (deferred research FR-018 — compare AXP vs LOS later).
- Integrating AXP **external** F-Droid/market repos or AXP **OTA** update
  servers (EOL; servers down — no sense).
- Shipping NeoLauncher.
- Hard-wiring `axp.os` branding/endpoints into Internet-connectivity /
  network UX (keep the permission/connectivity *behaviour* where practical).

## User Scenarios & Testing *(mandatory)*

### User Story 1 - AXP resurrection daily-driver on LAB (Priority: P1)

As the owner, after flashing one LAB build produced under this feature, the
phone boots and presents an **updated AXP-class clone on LOS23**: Google
compatibility stack, Play, selectable call recording unlock, Magisk root/hide
workflow like GOLDEN, AXP options/settings surface, userspace hardening /
signing posture, bundled usability apps, and an updated hardened sunfish
kernel — except WebView as defined here. Banking/Island validation is
**out of this story’s acceptance** (deferred to owner future / US3).

**Why this priority**: This is the whole reason for the resurrection.

**Independent Test**: Flash one `009` build to LAB; walk the GOLDEN daily
checklist minus banking (microG Self-Check, Play open/install, call-record
toggle off/on, spoofing toggle off/on, Magisk present in AXP-like install
state, bundled apps present, hardening/signing + kernel hardening checks);
compare against `002` inventory categories.

**Acceptance Scenarios**:

1. **Given** LAB on a vanilla `003` baseline (or documented equivalent),
   **When** the `009` image is flashed, **Then** the device boots to home and
   cellular/Wi‑Fi/basic hardware still work as in the vanilla smoke.
2. **Given** that build, **When** I compare shipped capability categories to
   GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, selectable call
   recording unlock, Magisk/DenyList-class path, DNS/hosts privacy helpers if
   present on GOLDEN, F‑Droid/Aurora/launcher/gallery-class bundled apps,
   userspace hardening/signing/AVB class, kernel update + hardening class),
   **Then** no category is left as “decide / later” without an explicit
   obsolescence or **deferred** note (WebView exception FR-015; banking
   deferred FR-006/FR-007; localization hardening compare deferred FR-018).
3. **Given** Git and host artifact policy, **When** inspected, **Then** no
   proprietary Phonesky APK bytes or secrets were committed.

---

### User Story 2 - Google stack: newest microG + project Phonesky (Priority: P1)

As the owner, newest-stable microG + GSF Proxy integrate with the project's
recent patched Phonesky so I can open Play, sign in as needed, and
install/update apps the same way I do on AXP; signature spoofing is
selectable (off = stock-safe default behaviour; on = needed Play/microG
path).

**Why this priority**: Without Play/microG parity, the ROM is not a daily
driver.

**Independent Test**: microG Self-Check; Phonesky launches; install or update
at least one ordinary app; toggle spoofing off/on and confirm expected
behaviour; push notifications smoke for a known test app.

**Acceptance Scenarios**:

1. **Given** the `009` build on LAB, **When** microG Settings Self-Check runs
   with spoofing enabled as required, **Then** checks required for basic
   Google compatibility pass (or each remaining failure is documented as
   attestation/hardware outside packaging).
2. **Given** the project's current patched Phonesky host artifacts, **When**
   the ROM is built and flashed, **Then** `com.android.vending` is present as
   privileged Play and opens on LAB.
3. **Given** selectable signature spoofing, **When** the owner turns it on,
   **Then** Play install/update works with microG without FakeStore; **When**
   turned off, **Then** the device does not expose unrestricted spoofing to
   arbitrary apps.
4. **Given** version policy, **When** microG / GSF versions are recorded,
   **Then** each is the newest stable (or tagged pre-release upstream
   currently ships) verified on this stack; Phonesky version matches the
   project patched artifact (not a blind “newest Play from the internet”).
5. **Given** Play behaviour on LAB, **When** compared to GOLDEN needs, **Then**
   if the project Phonesky lacks a GOLDEN-class fix required for daily use,
   acceptance stops and the Phonesky plan is reconsidered.

---

### User Story 3 - Banking profile workflow parity (Priority: P3 — deferred)

As the owner, **later** I can recreate the GOLDEN banking layout on LAB:
Island + Magisk DenyList-class hiding + Swissquote/Yuh. This is explicitly
**not** required to accept the AXP-on-LOS23 clone for functionalities,
options, hardening, security, or kernel work.

**Why this priority**: Owner (2026-09-17) — banking is a future personal
problem; do not block the updated AXP clone on bank gates.

**Independent Test** *(when owner resumes)*: Install Swissquote and attempt
Yuh; Island; Magisk DenyList; record PASS/FAIL honestly vs GOLDEN.

**Acceptance Scenarios** *(deferred — not ship gates)*:

1. **Given** Island on LAB, **When** the owner follows the GOLDEN banking
   install order, **Then** Swissquote reaches a usable logged-in state in the
   managed profile.
2. **Given** Yuh on the same workflow, **When** tested, **Then** either it
   PASSes or the failure matches the known GOLDEN attestation-class failure
   and is documented — not a silent packaging regression.
3. **Given** Magisk is present on the build, **When** banking apps run with
   DenyList-class configuration, **Then** they do not receive root.

---

### User Story 4 - Magisk like GOLDEN + selectable call recording (Priority: P1)

As the owner, Magisk is present the way AXP/GOLDEN presents it (newest Magisk;
preinstalled but not fully activated until I finish setup — exact UX measured
from GOLDEN), with DenyList-class hiding; call recording unlock is selectable
like other Developer Options toggles.

**Why this priority**: Root and call recording are core AXP daily behaviours.

**Independent Test**: Confirm Magisk package/binary layout vs GOLDEN notes;
complete activation on LAB if required; DenyList a test app; toggle call
recording unlock off (restricted) and on (record allowed).

**Acceptance Scenarios**:

1. **Given** a fresh `009` flash, **When** inspected, **Then** Magisk is
   present in an AXP-like preinstalled / not-fully-activated state consistent
   with GOLDEN measurement, using the newest Magisk stable that works on this
   stack.
2. **Given** Magisk setup completed on LAB, **When** DenyList-class hiding is
   configured for a test package, **Then** that package does not receive root
   (banking packages deferred with US3).
3. **Given** selectable call recording unlock, **When** OFF, **Then** stock
   LOS country/carrier style restrictions apply; **When** ON, **Then** Dialer
   can record on LAB without that block.

---

### User Story 5 - AXP usability, options, hardening + kernel (Priority: P1)

As the owner, the ROM ships the rest of the AXP usability/privacy surface,
AXP-class options/settings behaviour, GOLDEN-class userspace hardening /
signing / AVB posture, and an **updated LOS 23.2 sunfish kernel with
attributable hardening** (AXP / Graphene / Divest class where still valid on
non-GKI 4.14), at newest workable stables, with LOS23 WebView default and an
unlocked provider chooser. Localization/location-hardening delta vs LOS is
**out of scope for now** (FR-018 later).

**Why this priority**: Owner (2026-09-17) — this is the core of “clon
actualizado de AXP”, ahead of banking.

**Independent Test**: Package list vs `002`; open bundled apps; confirm
default WebView is LOS; userspace hardening/signing checks; kernel version /
hardening patch attribution recorded for the accepted build.

**Acceptance Scenarios**:

1. **Given** the `009` build, **When** I list bundled system/user apps in the
   AXP usability set, **Then** each GOLDEN/AXP category is present or
   explicitly marked impossible on Android 16/sunfish with rationale
   (Aosmium absence is the allowed WebView exception; banking tools may ship
   as packages without Gate E validation).
2. **Given** Developer options, **When** I open WebView implementation,
   **Then** LOS23 WebView is available/default and the chooser is not locked
   against future alternate providers.
3. **Given** version policy, **When** bundled apps (except Phonesky per
   FR-004) are recorded, **Then** each is newest stable that still runs on
   the ROM.
4. **Given** GOLDEN/AXP hardening and signing expectations, **When** the
   accepted build is evaluated, **Then** equivalent class of userspace
   protections / signing posture is present or each gap is documented as
   impossible on this stack — not silently dropped.
5. **Given** the LOS 23.2 sunfish kernel tree, **When** the accepted boot
   image is built, **Then** it is an updated lineage/sunfish-compatible
   kernel (not an unrelated prebuilt) with attributable hardening patches
   applied or each skipped hardening item documented.

---

### User Story 6 - Parallel tracks stay honest (Priority: P2)

As the owner, docs make clear that **this** Speckit is the Magisk AXP
resurrection track on LOS23, while the prior KernelSU / split roadmap remains
on standby (other branch / same `004`–`008`/`007` specs untouched).

**Why this priority**: Lets either track resume without rewriting history.

**Independent Test**: `specs/004`–`008`/`007` still exist unchanged in intent;
`009` describes Magisk resurrection; git branches separate standby vs active
work when published.

**Acceptance Scenarios**:

1. **Given** the repo, **When** inspected, **Then** `001`–`008`/`007` spec
   directories remain present (not deleted by `009`).
2. **Given** `009`, **When** read as ship intent for Magisk resurrection,
   **Then** it does not claim to permanently retire the standby track — only
   that KernelSU is out of *this* track’s ship for now.

---

### Edge Cases

- Newer “stable” of a bundled app breaks Android 16 / sunfish: pin last known
  good, document the regression, and retry when a fixed release exists.
- Project Phonesky missing a GOLDEN-class fix: halt acceptance; reconsider
  Phonesky patch/version plan before claiming Play parity.
- Magisk “preinstalled but not fully installed” UX differs across Magisk
  versions: match GOLDEN's *class* of first-boot/setup behaviour; document
  exact measured steps from GOLDEN before freezing LAB instructions.
- GOLDEN Yuh FAIL vs LAB FAIL: distinguish attestation/hardware class from
  packaging/spoofing regressions.
- Vanilla LOS already provides an AXP capability (e.g. WireGuard, encryption):
  keep LOS behaviour; do not duplicate.
- Dirty upgrade from older LAB experimental (incl. KernelSU) images: prefer
  clean flash for acceptance.
- Phonesky host artifacts missing or wrong signature: fail closed — never
  silently fall back to FakeStore.
- Alternate WebView installed by user later: selection must remain possible;
  default remains LOS23 WebView until the user changes it.
- Localization/location hardening: AXP historically more aggressive than LOS
  in places the owner dislikes; **do not decide** AXP-vs-LOS location policy
  in this feature’s acceptance — compare later (FR-018).

## Requirements *(mandatory)*

### Functional Requirements

- **FR-001**: The project MUST produce a flashable LineageOS 23.2 / Android 16
  `sunfish` build that resurrects the AXP.OS on LOS22 / GOLDEN capability set
  (including Magisk-class root, GOLDEN-class userspace hardening / signing /
  AVB posture, and an updated hardened sunfish kernel per FR-017), without
  leaving AXP capabilities as open “decide” omissions except documented
  exceptions/deferrals (WebView FR-015; banking FR-006/FR-007; localization
  compare FR-018).
- **FR-002**: Version selection for system and bundled components (except
  Phonesky per FR-004) MUST prefer the newest stable (or newest tagged
  pre-release upstream currently ships) that still works on sunfish /
  LOS 23.2; GOLDEN versions are a floor reference, not a freeze.
- **FR-003**: The ROM MUST ship newest-stable microG Services Core and GSF
  Proxy integrated with the project Phonesky (no FakeStore as primary Play).
- **FR-004**: The ROM MUST ship the project's recent patched Phonesky as
  privileged `com.android.vending`, with a documented host-side obtain /
  patch / sign / deploy path that never commits APK bytes to Git. If that
  artifact lacks GOLDEN-class fixes required for daily-driver Play behaviour,
  the Phonesky plan MUST be reconsidered before acceptance.
- **FR-005**: The ROM MUST provide **selectable** signature spoofing for the
  microG + Phonesky path (owner-controlled toggle; default safe/off or
  project-documented default). Spoofing MUST remain restricted/controlled —
  not unrestricted platform spoofing for all apps.
- **FR-006**: *(Deferred — owner future)* The ROM SHOULD support the GOLDEN
  managed-profile banking workflow (Island as measured on GOLDEN) including
  Swissquote PASS. This is **not** an acceptance gate for the AXP clone MVP.
- **FR-007**: *(Deferred — owner future)* Banking applications SHOULD run
  without being granted root (Magisk DenyList-class hiding). Magisk MUST still
  provide DenyList-class capability for general use (FR-010); bank-specific
  validation is deferred with FR-006.
- **FR-008**: The ROM MUST include **selectable** AXP-equivalent call
  recording unlock (toggle; OFF = stock LOS restrictions, ON = unlock).
- **FR-009**: The ROM MUST include the AXP usability/privacy bundled surface
  present on GOLDEN / AXP Pro (stores, launcher/gallery-class apps, DNS/hosts
  or equivalent blockers when part of that surface) at newest workable
  stables, subject to FR-015 for WebView.
- **FR-010**: The ROM MUST ship **Magisk** like GOLDEN: newest Magisk stable
  that works on this stack, in an AXP-like preinstalled but not fully
  activated layout (exact first-boot/setup behaviour measured from GOLDEN),
  with DenyList-class hiding available. KernelSU is **out of ship for now**
  (not the resurrection root path).
- **FR-011**: The feature acceptance gate MUST include GOLDEN/AXP-class
  userspace hardening and signing / AVB posture (as applicable on LOS 23.2 /
  sunfish), not only apps and Google compatibility. Gaps MUST be documented
  as impossible on this stack rather than silently omitted.
- **FR-012**: Acceptance flashing MUST use LAB only; GOLDEN MUST remain
  unmodified by this feature's work.
- **FR-013**: Each shipped capability MUST be attributable (what upstream or
  AXP behaviour it reproduces) and reversible (known-good prior LAB image
  retained).
- **FR-014**: This feature MUST live as a **new Speckit** (`009`) in parallel
  with the standby KernelSU / split roadmap (`004`–`008`/`007`). Those older
  specs MUST NOT be deleted or rewritten to match Magisk resurrection.
  Reusable runbooks/results from them MAY be referenced. For *this* track’s
  ship only, Magisk (not KernelSU) is the root path.
- **FR-015**: Default WebView MUST be LineageOS 23's WebView. Aosmium MUST NOT
  be required. The ROM MUST keep WebView provider selection available so a
  future alternate WebView can be installed and chosen.
- **FR-016**: Existing functional KernelSU / related kernels and artifacts
  from `007` SHOULD be retained and MAY be recycled when useful (reference
  boot images, differential debugging, or a later optional non-ship path).
  Such reuse is **optional** (“si se puede, ok”), MUST NOT become an
  acceptance requirement for Magisk resurrection, and MUST NOT imply KernelSU
  is back in the ship path unless a future spec explicitly says so.
- **FR-017**: The ship MUST use an **updated** LineageOS 23.2–compatible
  `sunfish` kernel (current lineage/kernel_google_sunfish or project-tracked
  equivalent — not an unrelated Graphene A13 / stock A13 prebuilt), with
  **attributable kernel hardening** ported from AXP / Graphene / Divest where
  still valid on non-GKI 4.14. Skipped items MUST be documented with rationale.
- **FR-018**: *(Deferred research — look later)* Compare how AXP/GOLDEN
  hardens or constrains **localization / location** (network location,
  backends, permissions, privacy toggles) versus stock LineageOS 23 behaviour.
  Owner historically finds AXP aggressive here; do **not** freeze a
  clone-or-LOS policy in this feature’s acceptance until that comparison
  exists. Default until then: do not silently invent extra location lockdown
  beyond what the rest of the AXP clone already implies; record the open
  question in the capability matrix.
- **FR-019**: On a **final** shipping `009` image, owner MUST be able to
  refresh bundled **system / privileged** packages by **sideload** (or the
  documented Magisk-equivalent path) roughly every **2–3 months**, without
  requiring a full ROM reflash for routine bumps of at least: **microG
  (GmsCore / companions)**, **Magisk**, **project Phonesky**, and other
  project-bundled system apps that the capability inventory treats as
  updatable. Packaging MUST preserve PackageManager update eligibility
  (matching signing identity; **PRESIGNED** where upstream expects
  self-updates; project-key continuity for Phonesky). Magisk MAY use its
  normal manager / boot-image update flow when APK-only sideload is
  insufficient — that path MUST be documented in the recovery/sideload
  runbook. This does **not** restore AXP external repos or OTA (still
  forbidden); updates are owner-driven sideload / recovery packages.

### Key Entities

- **Vanilla baseline**: The LOS 23.2 sunfish build from `003` (or documented
  equivalent) before AXP feature integration.
- **AXP capability set**: Inventory of features/packages/behaviours from
  GOLDEN (`002`) plus AXP Pro catalog rows promoted by this spec
  (resurrection target).
- **Version pin record**: Documented package/component versions chosen for the
  accepted `009` build (newest workable stable each; Phonesky = project
  artifact id/version; kernel rev + hardening patch list).
- **Phonesky host artifact**: Project patched/signed Play APK and permission
  metadata kept outside Git on the build host.
- **Magisk preinstall state**: Measured GOLDEN/AXP layout for Magisk present
  but not fully activated, plus LAB setup steps.
- **Hardened sunfish kernel**: Updated LOS23-compatible kernel build +
  attributed hardening patch set for FR-017.
- **LAB acceptance build**: Flashable image set + hashes + smoke / Magisk /
  userspace+kernel hardening results for this feature (banking evidence
  optional/deferred).

## Success Criteria *(mandatory)*

### Measurable Outcomes

- **SC-001**: One LAB flash of a `009` build boots and completes the vanilla
  hardware smoke within the same session as flash (owner can place a call,
  use Wi‑Fi, and unlock the device).
- **SC-002**: 100% of AXP resurrection capability categories from the agreed
  inventory are either demonstrated on LAB, marked deferred (banking,
  localization compare), or explicitly documented as impossible on Android
  16/sunfish — zero silent omissions (WebView exception allowed only as
  FR-015).
- **SC-003**: With spoofing enabled as required, microG Self-Check required
  items and project Phonesky open/install succeed on LAB for ordinary apps on
  the first accepted build candidate (or within one documented fix iteration).
- **SC-004**: *(Deferred with US3)* Swissquote managed-profile + Magisk
  DenyList-class workflow PASSes on LAB when owner resumes banking; not
  required for AXP-clone MVP acceptance.
- **SC-005**: Every bundled/system app version in the acceptance record
  (except Phonesky) is newer than or equal to GOLDEN's measured version,
  unless a newer release was tried and failed with a written regression note;
  Phonesky matches the recorded project patched artifact.
- **SC-006**: Owner can turn signature spoofing and call recording unlock off
  and on and observe the documented behaviour each time.
- **SC-007**: Magisk is present post-flash in the AXP-like preinstall state and
  can be fully activated on LAB using documented steps measured from GOLDEN.
- **SC-008**: Default WebView is LOS23's; provider selection remains available.
- **SC-009**: Owner can perform the GOLDEN-equivalent daily checklist on LAB
  **excluding deferred banking** without consulting a scatter of conflicting
  feature specs for what “ships”.
- **SC-010**: Accepted build records kernel revision + hardening attribution
  list (applied / skipped+why) satisfying FR-017.
- **SC-011**: Acceptance docs list, for each FR-019 component, the intended
  update channel (sideload APK / recovery zip / Magisk self-update) and confirm
  signing identity is not broken by packaging (PRESIGNED or project key as
  applicable). Full 2–3 month refresh drill MAY wait until a final ROM
  candidate; packaging regressions that block updates MUST be fixed before
  ship.

## Assumptions

- `003` vanilla LOS 23.2 sunfish is (or becomes) available as the integration
  base; LAB stock rescue from `002` remains valid.
- GOLDEN inventory (`002`) plus AXP Pro docs are sufficient to enumerate the
  capability set; live `adb` re-query of GOLDEN is allowed (especially Magisk
  preinstall/activation details).
- “AXP resurrection” / updated clone means Magisk + GOLDEN-class userspace
  hardening/signing/AVB + AXP user/options surface + updated hardened kernel
  on LOS23, with WebView, Phonesky-artifact, banking-deferral, and
  localization-compare exceptions as stated.
- Island / banking validation is owner-future; shipping Island as a bundled
  app is optional and does not imply Gate E.
- FakeStore is never the primary Play path.
- Selectable spoofing and selectable call recording follow the same class of
  Developer Options UX already explored in `005`/`008` runbooks where useful.
- Project `FLAG_SECURE` override is nice-to-have, not an AXP resurrection
  hard gate.
- Personal app/data backup is not a ROM feature gate.
- Builds and long compiles run on `rom-dev01`; laptop holds docs/specs and
  flash tools only.
- Prior KernelSU LAB experiments (including the two functional kernels already
  built) are **out of ship for now** but kept as recyclable assets: reuse if
  helpful, never required for Magisk acceptance.
- Localization hardening AXP-vs-LOS comparison is intentionally postponed
  (FR-018); do not block MVP on it.
- No AXP-style OTA or external repos; periodic system-package refresh is
  **owner sideload** (FR-019), not a network updater in the ROM.
- microG stays PRESIGNED / replace-prebuilt so same-signer updates remain
  possible; Phonesky stays on the project signing key across releases;
  Magisk update docs cover manager + any boot re-patch when needed.