AXP-Resurection/specs/009-axp-los23-port/research.md

# Research: `009-axp-los23-port`

## Decision: Product = AXP resurrection on LOS 23.2 (parallel track)

**Decision**: Treat `009` as the normative ship feature **for the Magisk AXP
resurrection track** that ports the AXP.OS / GOLDEN LOS22 capability set onto
LineageOS 23.2 vanilla (`003`), with only the explicit exceptions in the spec
(WebView, Phonesky artifact, optional KSU recycle). Keep the prior KernelSU /
split roadmap (`004`–`008`/`007` + deferred items) on a **standby git branch**
without deleting or rewriting those specs.

**Rationale**: Owner wants Magisk “todo igual” to AXP now, without throwing
away the earlier KSU investment; either track may resume later.

**Alternatives considered**: Hard-supersede/delete the split roadmap —
rejected (owner wants standby). Continue only KSU track — rejected for
current ship preference.

## Decision: Magisk ship root (constitution variance)

**Decision**: Ship **Magisk** like GOLDEN — newest Magisk stable that works on
sunfish / LOS 23.2 — in an AXP-like **preinstalled but not fully activated**
layout. Measure the exact first-boot/setup UX on GOLDEN (`adb` only) before
freezing LAB instructions. DenyList-class hiding for banks.

**Rationale**: FR-010 / owner clarification; true AXP resurrection requires
Magisk/Magia-class root, not KernelSU.

**Alternatives considered**:

- KernelSU-Next (`007`) as ship — rejected for this feature (out of ship for
  now).
- Rootless ship — rejected (banking DenyList workflow is part of GOLDEN).
- Magisk only as temporary A/B diagnostic — insufficient for resurrection
  acceptance.

**Follow-up (non-blocking)**: Amend constitution Root architecture section in
a later docs pass so it no longer contradicts Magisk-as-ship.

## Decision: Optional recycle of `007` kernels (FR-016)

**Decision**: Keep the two functional KernelSU kernels/artifacts. Reuse only
if helpful (boot reference, differential debug, later optional path). Never
gate Magisk acceptance on KSU work.

**Alternatives considered**: Delete `007` artifacts — rejected (sunk cost;
optional value). Force dual-boot Magisk+KSU ship — rejected (complexity).

## Decision: Reuse `004`/`005` Google stack; bump microG; keep project Phonesky

**Decision**:

- microG GmsCore + GSF = **newest stable** (or newest tagged pre-release
  upstream ships) verified on this stack; integrate with Phonesky as in AXP.
- Phonesky = **project patched artifact** from the recent host pipeline
  (`docs/004-phonesky-runbook.md` / `/srv/rom/prebuilts/phonesky/`), not a
  blind newest Play download.
- If LAB shows missing GOLDEN-class Play fixes with that artifact → **halt**
  and reconsider Phonesky (spec edge case), do not silently ship FakeStore.
- Signature spoofing = selectable DO toggle (`allow_signature_fake` class from
  `005`); restricted grants for microG + Phonesky only.

**Alternatives considered**: Newest Play APK every week without project patch
pipeline — rejected (breaks reproducible priv-app signing). FakeStore —
forbidden. Re-implement spoofing from scratch — reuse `005` unless A16 gaps.

## Decision: Selectable call recording = EXTENDROM / `008` model

**Decision**: Ship selectable call-recording unlock using GOLDEN-compatible
`Settings.Secure.extendrom_call_recording` + Dialer gate (EXTENDROM
`F_CALLREC` / `008` research). Default OFF.

**Alternatives considered**: Magisk Dialer RRO — rejected (not selectable /
not native). Blind old XML overlays — rejected for A16.

**Note**: Project `FLAG_SECURE` override remains optional vs AXP acceptance;
may ship if `008` work is cheap to include.

## Decision: WebView = LOS23 default, chooser unlocked

**Decision**: Do not ship Aosmium (EOL). Default = LineageOS 23 WebView.
Preserve Android multi-provider selection (Developer options → WebView
implementation).

**Alternatives considered**: Bundle Vanadium/AOSmium fork — rejected (EOL /
out of scope). Lock single provider — rejected (FR-015).

## Decision: Bundled apps = GOLDEN/AXP categories @ newest stable

**Decision**: Enumerate categories from `002` + AXP Pro catalog (Island,
Aurora, F-Droid/repos as on GOLDEN, launcher/gallery-class, DNS/hosts privacy
helpers if present). Install newest workable stables; pin versions in the
acceptance record. Island remains the managed-profile tool (measured on
GOLDEN).

**Alternatives considered**: LOS defaults only — fails resurrection. Exact
GOLDEN version freeze — rejected (owner wants newest stables except
Phonesky).

## Decision: Hardening / signing / AVB inside `009` (staged)

**Decision**: Acceptance includes GOLDEN-class hardening and signing/AVB
posture **as applicable** on LOS 23.2 / sunfish. Implement in **stages inside
`009`** (functional Magisk+Google+apps first, then hardening/signing gates),
but do not open a separate competing feature number for ship ownership.
Document impossible-on-sunfish gaps rather than silent omit.

**Rationale**: Owner Q2 = full resurrection; still obey constitution
“small attributable reversible changes” via staged known-good LAB images.

**Alternatives considered**: Defer all of `011`–`013` — rejected by owner.
One mega-commit everything — rejected (attribution / bisect).

## Decision: Banking workflow = GOLDEN Magisk DenyList + Island

**Decision**: Restore constitution banking steps with **Magisk DenyList**
(not KSU profiles) + Island: Aurora install → do not open → DenyList → clone
to Island → first launch in Island. Swissquote PASS hard gate; Yuh honest vs
GOLDEN attestation FAIL.

**Alternatives considered**: Rootless-only banking gate — incomplete vs AXP.
Insular rename — GOLDEN runs Island.

## Decision: Version freshness policy

**Decision**: Before long builds: `git fetch --tags` / refresh upstreams for
microG, Magisk, bundled apps; record tag/commit + version codes; never ship
from shallow or stale laptop caches (AGENTS.md lesson from `007`).

**Alternatives considered**: Trust whatever is already on the host — rejected.