AXP-Resurection/specs/007-kernelsu-sunfish/plan.md

Implementation Plan: KernelSU-Next on sunfish (LAB)

Branch: 007-kernelsu-sunfish | Date: 2026-09-15 | Spec: spec.md

Input: Feature specification from /specs/007-kernelsu-sunfish/spec.md

Summary

Bring KernelSU-Next into the LineageOS 23.2 sunfish 4.14 kernel on LAB, verify per-app / per-user root denial + mount hide for banking UIDs, then layer SusFS and a TrickyStore-class attestation experiment so that Yuh PASS (Island) becomes achievable. Yuh PASS is a hard-gate: without it, 007 is incomplete/cancelled — root is not justified vs NeoBackup + native 008/009 and a stock banking phone.

006 rootless-Yuh-pass is deferred and does not block start. Swissquote PASS is also mandatory; Revolut/N26 non-blocking. GOLDEN never flashed.

Technical Context

Language/Version: Linux 4.14 kernel (C); KernelSU-Next / SusFS integration; Android userspace manager APK; bash runbooks on rom-dev01
Primary Dependencies: LOS 23.2 sunfish kernel tree; KernelSU-Next (non-GKI 4.14-capable pin); SusFS; TrickyStore-class (or documented equivalent); 005 userspace stack; Island; 002 Yuh/KeyMint logs
Storage: Host /srv/rom/ kernel outs, module ZIPs, secrets; artifacts under /srv/rom/artifacts/007-…
Testing: LAB flash only; KSU manager grants; mount/root probes per UID; Yuh/Swissquote Island sessions; keystore2/KeyMint logcat vs 002
Target Platform: Pixel 4a LAB 11231JEC207477; Android 16 / LOS 23.2
Project Type: Android ROM kernel + root stack + LAB validation
Performance Goals: Boot + daily stability; SusFS soak ≥24h if claimed
Constraints: LAB only; no Magisk production; no Zygisk/LSPosed default; banking never gets root; attributable kernel commits; Yuh PASS mandatory
Scale/Scope: One kernel integration POC → pin revision → SusFS → attestation experiment → banking hard-gate on LAB

Constitution Check

GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.

Gate	Status
LAB only; never GOLDEN	pass
KernelSU-Next is project root (not Magisk production)	pass
Banking apps never receive root; profiles + verified umount	pass
SusFS only after KSU + profiles work	pass (phased US1→US3)
No Zygisk/LSPosed as initial architecture	pass
Small attributable, reversible changes	pass (pinned commits)
006 before 007 in written order	amended explicitly in constitution 0.2.0 — rootless Yuh gate deferred; owner-approved sequencing; current-ROM snapshot required (T039)
Hardening Graphene/AXP full ports	out of scope → 013

Post-design: Same. Yuh hard-gate is an owner product gate layered on top of constitution Compatibility MVP (Yuh in Insular) — aligned, stricter on 007 acceptance.

Project Structure

Documentation (this feature)

specs/007-kernelsu-sunfish/
├── plan.md
├── research.md
├── data-model.md
├── quickstart.md
├── contracts/
│   ├── ksu-hide-surface.md
│   └── banking-yuh-gate.md
└── tasks.md                 # via /speckit-tasks (not this command)

Host + tree

# rom-dev01
/srv/rom/src/lineage/kernel/…     # LOS 23.2 sunfish-compatible kernel
/srv/rom/src/lineage/…            # product builds including boot.img
/srv/rom/artifacts/007-kernelsu/  # bacon outs, pins, Yuh log packs
/srv/rom/references/…             # optional mirrors of KSU/SusFS/TrickyStore docs

# Meta repo
docs/002-*-*.md                   # Yuh/KeyMint baselines (read-only input)
docs/reference-sources.md §8–10   # community inspiration, not base
docs/a15-a16-delta.md             # attestation notes as measured

Structure Decision: Kernel work lives on rom-dev01 LOS tree; meta-repo keeps specs, contracts, runbooks, and pin records. No Magisk tree. No megapatch dumps in Git — pin URLs/commits + small project patches only.

Complexity Tracking

Violation / stretch	Why needed	Simpler alternative rejected because
Start 007 without closing 006 rootless Yuh	002 shows Yuh fails with and without Magisk (KeyMint/RKP)	Waiting on rootless Yuh green has no known path
SusFS + TrickyStore-class in same feature as KSU	Owner: Yuh PASS mandatory; hide alone insufficient on GOLDEN	KSU-only “done” without Yuh → root not worth keeping
Yuh PASS hard-gate on EOL sunfish	Product rationale: else stock phone + 008/009	Soft FAIL documentation wastes a root maintenance burden

Phase 0 / Phase 1

See research.md, data-model.md, contracts/*, quickstart.md.

Remediation alignment — 2026-09-15

Constitution 0.2.0 explicitly defers 006; T039 records our current rootless LAB state before kernel changes, without requiring PASS. US5 alone owns banking acceptance: both Yuh and Swissquote must pass on the same stack. US4 owns attestation investigation/evidence, not a duplicate acceptance gate. Older iodé/GOLDEN KeyMint logs are correlations, not proof of our ROM's failure cause. T040 explicitly verifies the no-Zygisk/LSPosed constraint.