sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
109 lines
4.8 KiB
Markdown
109 lines
4.8 KiB
Markdown
# GOLDEN inventory (AXP.OS oracle) — redacted
|
||
|
||
**Device:** GOLDEN sunfish (main phone) — **DO NOT FLASH / wipe / modify**.
|
||
**Serial:** `11071JEC203839`
|
||
**Role:** Live **AXP.OS Pro 22.2 / Android 15** compatibility oracle.
|
||
**Access:** Non-destructive `adb` only (sampled 2026-09-13).
|
||
**Raw artifacts:** `/srv/rom/references/axp/golden/2026-09-13/` on `rom-dev01`
|
||
(includes Magia DenyList screenshots, Yuh logcat; Git = this summary only).
|
||
|
||
## Identity (measured)
|
||
|
||
| Field | Value |
|
||
|-------|--------|
|
||
| Serial | `11071JEC203839` |
|
||
| Owner user | `Andres` (user 0) |
|
||
| `ro.build.display.id` | `BP1A.250505.005` |
|
||
| `ro.build.version.release` | `15` |
|
||
| `ro.build.version.security_patch` | `2026-03-03` |
|
||
| AXP / Lineage identity | `ro.lineage.version=22.2-2026.003-sunfish-pro` (`releasetype=PRO`) |
|
||
| Bootloader | **unlocked** (`flash.locked=0`, `verifiedbootstate=orange`) |
|
||
| Magisk | Binary **29.0** (`29000`) at `/system_ext/bin/magisk`; UI app named **Magia** |
|
||
|
||
## Users / work profile
|
||
|
||
| User | Name | Notes |
|
||
|------|------|-------|
|
||
| 0 | Andres | Owner |
|
||
| 10 | Island | Profile owner = `com.oasisfeng.island.fdroid` 6.4.2 |
|
||
|
||
After owner’s 2026-09-13 reclone experiment: `com.yuh` and
|
||
`com.swissquote.android` present on **both** user 0 and user 10
|
||
(Island reinstall of Yuh `firstInstallTime` user10 ≈ 21:48).
|
||
|
||
## Essential packages (measured)
|
||
|
||
| Area | Package / path | Version | Notes |
|
||
|------|----------------|---------|--------|
|
||
| microG GmsCore | `com.google.android.gms` | **0.3.15.250932** | System base MicrogGmsCore_GH; sig short `73aaa390` |
|
||
| Phonesky (AXP) | `/system/priv-app/Phonesky_AXP-OS` | **50.2.12-24** | Sig short `e05f779d` |
|
||
| GSF Proxy | `/system_ext/app/GsfProxy_GH` | `v0.1.0` | |
|
||
| Island | `com.oasisfeng.island.fdroid` | `6.4.2-d46911c9` | Spec text said “Insular”; measured = **Island** |
|
||
| Aurora Store | `com.aurora.store` | `4.8.4` | |
|
||
| Yuh | `com.yuh` | `1.45.11` (vc 535) | See attestation section |
|
||
| Swissquote | `com.swissquote.android` | `9.9.0` | Owner reports still OK |
|
||
| Aosmium (AXP) | `org.axpos.aosmium` | `148.0.7778.178` | Not on DenyList |
|
||
| Magisk modules list | `/data/adb/modules` | — | Not readable without root shell — **re-query** if needed |
|
||
|
||
## Magia DenyList (from UI screenshots 2026-09-13)
|
||
|
||
Checked packages (package-level; process expand not fully visible in shots):
|
||
|
||
| App | Package |
|
||
|-----|---------|
|
||
| BBVA Spain | `com.bbva.bbvacontigo` |
|
||
| BOOM | `com.boom.android.mobile2` |
|
||
| CieID | `it.ipzs.cieid` |
|
||
| Device configuration | `android.autoinstalls.config.google.nexus` |
|
||
| DKB | `com.dkbcodefactory.banking` |
|
||
| Identifica | `it.sielte.sielteidentify` |
|
||
| N26 | `de.number26.android` |
|
||
| Scalable Capital | `capital.scalable.droid` |
|
||
| Swissquote | `com.swissquote.android` |
|
||
| Webank | `com.opentecheng.android.webank` |
|
||
| Wise | `com.transferwise.android` |
|
||
| Yuh | `com.yuh` |
|
||
|
||
Visible unchecked (partial): Aegis, Amarok, Amaze, Aosmium.
|
||
|
||
Owner notes: most DenyList banking apps still pass; **Yuh fails** for ~weeks.
|
||
Extra Magia DenyList/host checks + Island uninstall/reclone did **not** fix Yuh.
|
||
|
||
## Compatibility / attestation (observational)
|
||
|
||
| Check | Status | Evidence |
|
||
|-------|--------|----------|
|
||
| Swissquote | **PASS** (owner report) | Still used; on DenyList |
|
||
| Other DenyList banks (N26, DKB, …) | **PASS** (owner: “casi todos”) | UI DenyList |
|
||
| Yuh | **FAIL** — hardware attestation / “certificate is invalid” | Owner UI + logcat ~21:51–21:52 |
|
||
| Play Integrity token path | Client path still runs | `Finsky requestIntegrityToken() finished for com.yuh`; DroidGuard `pia_attest_e1` for `com.yuh` |
|
||
| KeyMint / TEE | Errors concurrent with Yuh attempt | `keystore2`: `HARDWARE_TYPE_UNAVAILABLE` (IRPC / `TRUSTED_ENVIRONMENT`); `addRngEntropy` → `DEAD_OBJECT` / KeyMint `-1000` |
|
||
|
||
Interpretation for later `006`/`007` (not a GOLDEN fix): DenyList alone is
|
||
insufficient for Yuh’s hardware-attestation path; KeyMint/TEE remote-provisioning
|
||
errors correlate with the failure window. Project production root path remains
|
||
**KernelSU-Next (+ SusFS) or ReSukiSU evaluation** — Magisk/Magia is oracle-only.
|
||
|
||
Call recording: GOLDEN Secure dump shows native EXTENDROM
|
||
`extendrom_call_recording=1` (see `008` — port `er.sh` F_CALLREC, not Magisk
|
||
RRO). FLAG_SECURE override: not identified as AXP catalog on GOLDEN; project
|
||
`009` is native DO.
|
||
|
||
## Banking layout (oracle)
|
||
|
||
Historical target order (AXP workflow; Magisk DenyList → Island):
|
||
|
||
1. Aurora Store → install
|
||
2. Do not open
|
||
3. Magia DenyList (incl. processes) before first process
|
||
4. Clone into Island
|
||
5. First launch in Island
|
||
6. Phonesky/Play in Island as needed
|
||
|
||
Observed: Yuh+Swissquote intended in Island; after 2026-09-13 debug, both also
|
||
on owner user 0 — clean up is owner’s choice; agents must not uninstall.
|
||
|
||
## Policy
|
||
|
||
No flash, wipe, Magisk/Magia changes, or app uninstalls by agents — sample only.
|