AXP-Resurection/vendor/sunfish-a16/patches/009-axp-los23-port

009 AXP LOS23 port — patch / packaging README

Track: Magisk AXP resurrection on LOS 23.2 sunfish (AXP_Resurection).
Not ship: KernelSU / SusFS (007 standby / optional recycle only).

Apply order (host tree under /srv/rom/src/lineage/)

1. Google stack — vendor/sunfish-a16/gms.mk + Android.mk (microG, GSF, Phonesky). Host APKs: /srv/rom/prebuilts/{microg,phonesky}/ (never Git).
2. Signature spoofing — vendor/sunfish-a16/patches/005-sigspoof/ (apply_005_sigspoof.py). Attribute: LOS restricted spoofing + AXP/005.
3. Call recording unlock — vendor/sunfish-a16/patches/008-call-rec-flag-secure/ (extendrom_call_recording). Attribute: EXTENDROM F_CALLREC.
4. Magisk preroot — EXTENDROM-class boot/init_boot patch using Magisk APK from /srv/rom/prebuilts/magisk/ (see docs/009-magisk-preinstall-runbook.md). Stub: vendor/sunfish-a16/magisk.mk. Attribute: Magisk upstream + sfX extendrom Magisk patcher. Host tree currently has no vendor/extendrom — must vendor minimal patcher or checkout extendrom before first Magisk bacon.
5. Bundled apps — /srv/rom/prebuilts/axp-apps/ + apps.mk (Aurora, Droidify, Fossify Gallery). Symlink APKs into vendor/sunfish-a16/prebuilt/.
6. Private DNS presets — apply_009_private_dns_providers.py (GOLDEN list).
7. Internet connectivity check — apply_009_connectivity_check.py (GOLDEN list minus AXP.OS / axpos.org).
8. Disable for user apps — apply_009_disable_user_apps.py (SPA gate).
9. Userspace hardening / signing — staged: see signing/README.md, hardening/README.md (US-S4-1 OpenSSH trim), and docs/009-hardening-signing-checklist.md (US-S1 keys → US-S2 wire → US-S3 AVB → US-S4+ harden). Bootloader lock = wont.
10. Kernel hardening — LOS23 msm-4.14 + map in docs/009-kernel-hardening-map.md (FR-017). Stage 1: vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh (AXP Graphene/AH allowlist). Priority: AXP → LOS → Iodé → optional Graphene; no Divest hunt; no extra location lockdown.

Product includes

Wire Magisk-resurrection product from vendor/sunfish-a16/ into lineage_sunfish (same pattern as 004/005). Keep Phonesky priv-app path. No FakeStore. No KernelSU product packages.

Deferred

• Banking Gate E / Island validation (owner future).
• Localization AXP-vs-LOS compare (docs/009-localization-axp-vs-los.md stub).

Host paths (rom-dev01)

What	Path
Magisk APK	/srv/rom/prebuilts/magisk/Magisk-v30.7.apk
EXTENDROM Magisk patcher	/srv/rom/references/extendrom/config/magisk/
Kernel source	/srv/rom/src/lineage/kernel/google/msm-4.14
Product include (gms)	device/google/sunfish/lineage_sunfish.mk → vendor/sunfish-a16/gms.mk
Vanilla baseline	/srv/rom/artifacts/003-vanilla/20260914-lineage-23.2-sunfish/
Optional KSU boots	/srv/rom/artifacts/007-kernelsu/ (non-ship)

Gap: vendor/extendrom is not checked out in the lineage tree yet. Magisk bacon blocked on T011 (symlink/checkout + PREROOT or slim wire).