AXP-Resurection/specs/009-axp-los23-port/spec.md

Feature Specification: AXP LOS22 feature port to LOS23

Feature Branch: 009-axp-los23-port

Created: 2026-09-16

Status: Clarified — ready for /speckit-plan

Input: User description: "009-axp based LOS22 feature port to LOS23 — take vanilla LineageOS 23 for sunfish and integrate the full AXP.OS (LOS22 / Android 15 GOLDEN) feature set into LOS23 without product exceptions; only versions change (newest stable for each system / bundled app that still fits sunfish / Android 16); use the project's already updated patched Phonesky (Google Play)."

Owner clarifications (2026-09-16): Magisk like GOLDEN (newest Magisk; AXP-style preinstalled-but-not-fully-activated layout — measure on GOLDEN); hardening / signing / AVB like GOLDEN (full AXP resurrection on LOS23); WebView exception = keep LOS23 WebView (Aosmium EOL) but leave provider selection unlocked; Phonesky = project patched build from recent work unless it lacks GOLDEN-class fixes (then reconsider); microG newest stable integrated with that Phonesky; signature spoofing and call recording selectable (toggles); KernelSU (007) out of ship for now, with optional recycle of existing functional kernels if useful; otherwise everything equal to AXP/GOLDEN.

Context / non-goals

Product intent (this feature is normative for the AXP resurrection ship):

• This feature is an AXP.OS resurrection on LineageOS 23.2 / Android 16 sunfish: same capability set as AXP on LOS22 / GOLDEN, moved to LOS23.
• Base ROM = LineageOS 23.2 / Android 16 sunfish vanilla from 003 (or the best known-good vanilla-equivalent flashable baseline already proven on LAB).
• Feature source of truth for what to ship = what AXP.OS Pro / GOLDEN provides on LOS22 (inventory in 002, product catalog in docs/axp-pro-parity.md), without omitting AXP capabilities as “decide later” rows, including Magisk-class root and AXP-class hardening / signing / AVB posture that GOLDEN represents.
• Versions = newest stable (or newest tagged pre-release the upstream project currently ships) for each system/bundled component, constrained to what still works on sunfish / non-GKI 4.14 / LOS 23.2 — not stale laptop caches or shallow-clone version lies.
• Phonesky exception: ship the project's already patched / fixed Phonesky from the recent host pipeline (not “whatever newest Play APK is today”). If that build is missing fixes that GOLDEN's Phonesky path still needs for daily-driver parity, stop and reconsider the Phonesky plan before accepting the feature.
• WebView exception: do not ship Aosmium (EOL). Default WebView = LineageOS 23's WebView. The ROM MUST keep Android's multi-provider path so the owner can install another WebView later and select it (Developer options → WebView implementation) — not locked to a single provider.
• Flash / experiment LAB only; GOLDEN remains the read-only oracle (docs/device-roles.md).

Relationship to earlier features:

• 001–003 remain shared foundation (host, GOLDEN capture, vanilla build).
• Two parallel product tracks (neither deletes the other):
  • Standby / prior track: 004–008 + 007 KernelSU (+ deferred 006/010–013 as previously planned). Kept intact for later resume; live on its own git branch once pushed (see plan notes).
  • Active Magisk-resurrection track (this feature): AXP→LOS23 ship with Magisk like GOLDEN. Does not rewrite or remove 004–008/007 specs; it is a new Speckit directory that may reuse proven LAB runbooks/results from those features when helpful.
• KernelSU / SusFS from 007 stays out of this track’s ship for now. Recycle of the two functional 007 kernels is optional (FR-016) — never an acceptance gate for Magisk.
• Project-only FLAG_SECURE global override may still ship if already specified under 008 (not AXP catalog); it is optional relative to AXP resurrection acceptance. AXP call-recording unlock is required and must be selectable.

Out of scope for this feature (explicit):

• Flashing or modifying GOLDEN.
• Committing proprietary Google Phonesky APK bytes, private keys, or personal identifiers to Git.
• Replacing the LOS 23.2 sunfish kernel/device stack with an unrelated prebuilt (Graphene A13, stock A13, etc.).
• Shipping Aosmium / AOSmium as the default or only WebView (EOL).
• Building a custom AXP-style backup/restore ROM feature (personal backup remains an external user tool if needed).
• Claiming Yuh hardware-attestation PASS if GOLDEN itself currently FAILs that path — reproduce GOLDEN's workflow and document attestation parity honestly.
• Deleting or rewriting the standby KernelSU / split-roadmap specs (004–008/007) — they remain valid on the standby branch/track.
• Shipping KernelSU-Next as this track’s root (out of ship here; Magisk is the resurrection root). Optional later reuse of 007 kernels is allowed under FR-016 but MUST NOT delay Magisk acceptance.

User Scenarios & Testing (mandatory)

User Story 1 - AXP resurrection daily-driver on LAB (Priority: P1)

As the owner, after flashing one LAB build produced under this feature, the phone boots and presents the same class of daily-driver capabilities I rely on with AXP on GOLDEN (Google compatibility stack, Play, managed banking profile workflow, selectable call recording unlock, Magisk root/hide workflow like GOLDEN, AXP hardening/signing posture, and AXP bundled usability apps — except WebView as defined here), without a checklist of deferred AXP features.

Why this priority: This is the whole reason for the resurrection.

Independent Test: Flash one 009 build to LAB; walk the GOLDEN daily checklist (microG Self-Check, Play open/install, Island profile, call-record toggle off/on, spoofing toggle off/on, Magisk present in AXP-like install state, bundled apps present, hardening/signing checks that GOLDEN implies); compare against 002 inventory categories.

Acceptance Scenarios:

1. Given LAB on a vanilla 003 baseline (or documented equivalent), When the 009 image is flashed, Then the device boots to home and cellular/Wi‑Fi/basic hardware still work as in the vanilla smoke.
2. Given that build, When I compare shipped capability categories to GOLDEN/AXP Pro (Google stack, Play, selectable spoofing, managed profile tool, selectable call recording unlock, Magisk/DenyList-class path, DNS/hosts privacy helpers if present on GOLDEN, F‑Droid/Aurora/launcher/ gallery-class bundled apps, hardening/signing/AVB class), Then no category is left as “decide / later” without an explicit obsolescence note tied to Android 16 / sunfish impossibility (WebView exception allowed per FR-015).
3. Given Git and host artifact policy, When inspected, Then no proprietary Phonesky APK bytes or secrets were committed.

---

User Story 2 - Google stack: newest microG + project Phonesky (Priority: P1)

As the owner, newest-stable microG + GSF Proxy integrate with the project's recent patched Phonesky so I can open Play, sign in as needed, and install/update apps the same way I do on AXP; signature spoofing is selectable (off = stock-safe default behaviour; on = needed Play/microG path).

Why this priority: Without Play/microG parity, the ROM is not a daily driver.

Independent Test: microG Self-Check; Phonesky launches; install or update at least one ordinary app; toggle spoofing off/on and confirm expected behaviour; push notifications smoke for a known test app.

Acceptance Scenarios:

1. Given the 009 build on LAB, When microG Settings Self-Check runs with spoofing enabled as required, Then checks required for basic Google compatibility pass (or each remaining failure is documented as attestation/hardware outside packaging).
2. Given the project's current patched Phonesky host artifacts, When the ROM is built and flashed, Then com.android.vending is present as privileged Play and opens on LAB.
3. Given selectable signature spoofing, When the owner turns it on, Then Play install/update works with microG without FakeStore; When turned off, Then the device does not expose unrestricted spoofing to arbitrary apps.
4. Given version policy, When microG / GSF versions are recorded, Then each is the newest stable (or tagged pre-release upstream currently ships) verified on this stack; Phonesky version matches the project patched artifact (not a blind “newest Play from the internet”).
5. Given Play behaviour on LAB, When compared to GOLDEN needs, Then if the project Phonesky lacks a GOLDEN-class fix required for daily use, acceptance stops and the Phonesky plan is reconsidered.

---

User Story 3 - Banking profile workflow parity (Priority: P1)

As the owner, I can recreate the GOLDEN banking layout on LAB: install via the same store path I use on AXP, place banks in Island, and keep banking apps free of root via Magisk DenyList-class hiding like GOLDEN.

Why this priority: Compatibility hard gates; daily-driver without banks fails the resurrection.

Independent Test: Install Swissquote (hard gate) and attempt Yuh; run inside Island; Magisk DenyList (or AXP-equivalent) applied; record PASS/FAIL honestly vs GOLDEN.

Acceptance Scenarios:

1. Given Island on LAB, When I follow the documented GOLDEN banking install order, Then Swissquote reaches a usable logged-in state in the managed profile.
2. Given Yuh on the same workflow, When tested, Then either it PASSes or the failure matches the known GOLDEN attestation-class failure and is documented — not a silent packaging regression.
3. Given Magisk is present on the build, When banking apps run with DenyList-class configuration, Then they do not receive root.

---

User Story 4 - Magisk like GOLDEN + selectable call recording (Priority: P1)

As the owner, Magisk is present the way AXP/GOLDEN presents it (newest Magisk; preinstalled but not fully activated until I finish setup — exact UX measured from GOLDEN), with DenyList-class hiding; call recording unlock is selectable like other Developer Options toggles.

Why this priority: Root and call recording are core AXP daily behaviours.

Independent Test: Confirm Magisk package/binary layout vs GOLDEN notes; complete activation on LAB if required; DenyList a test app; toggle call recording unlock off (restricted) and on (record allowed).

Acceptance Scenarios:

1. Given a fresh 009 flash, When inspected, Then Magisk is present in an AXP-like preinstalled / not-fully-activated state consistent with GOLDEN measurement, using the newest Magisk stable that works on this stack.
2. Given Magisk setup completed on LAB, When DenyList-class hiding is configured for a banking package, Then that package does not receive root.
3. Given selectable call recording unlock, When OFF, Then stock LOS country/carrier style restrictions apply; When ON, Then Dialer can record on LAB without that block.

---

User Story 5 - AXP usability, privacy, hardening (Priority: P2)

As the owner, the ROM ships the rest of the AXP usability/privacy surface and GOLDEN-class hardening/signing/AVB posture at newest workable stables, with LOS23 WebView default and an unlocked provider chooser.

Why this priority: Completes resurrection beyond Google/banking/root core.

Independent Test: Package list vs 002; open bundled apps; confirm default WebView is LOS and another WebView can be selected if installed; hardening/signing checks agreed for GOLDEN-class parity.

Acceptance Scenarios:

1. Given the 009 build, When I list bundled system/user apps in the AXP usability set, Then each GOLDEN/AXP category is present or explicitly marked impossible on Android 16/sunfish with rationale (Aosmium absence is the allowed WebView exception).
2. Given Developer options, When I open WebView implementation, Then LOS23 WebView is available/default and the chooser is not locked against future alternate providers.
3. Given version policy, When bundled apps (except Phonesky per FR-004) are recorded, Then each is newest stable that still runs on the ROM.
4. Given GOLDEN/AXP hardening and signing expectations, When the accepted build is evaluated, Then equivalent class of protections / signing posture is present or each gap is documented as impossible on this stack — not silently dropped.

---

User Story 6 - Parallel tracks stay honest (Priority: P2)

As the owner, docs make clear that this Speckit is the Magisk AXP resurrection track on LOS23, while the prior KernelSU / split roadmap remains on standby (other branch / same 004–008/007 specs untouched).

Why this priority: Lets either track resume without rewriting history.

Independent Test: specs/004–008/007 still exist unchanged in intent; 009 describes Magisk resurrection; git branches separate standby vs active work when published.

Acceptance Scenarios:

1. Given the repo, When inspected, Then 001–008/007 spec directories remain present (not deleted by 009).
2. Given 009, When read as ship intent for Magisk resurrection, Then it does not claim to permanently retire the standby track — only that KernelSU is out of this track’s ship for now.

---

Edge Cases

• Newer “stable” of a bundled app breaks Android 16 / sunfish: pin last known good, document the regression, and retry when a fixed release exists.
• Project Phonesky missing a GOLDEN-class fix: halt acceptance; reconsider Phonesky patch/version plan before claiming Play parity.
• Magisk “preinstalled but not fully installed” UX differs across Magisk versions: match GOLDEN's class of first-boot/setup behaviour; document exact measured steps from GOLDEN before freezing LAB instructions.
• GOLDEN Yuh FAIL vs LAB FAIL: distinguish attestation/hardware class from packaging/spoofing regressions.
• Vanilla LOS already provides an AXP capability (e.g. WireGuard, encryption): keep LOS behaviour; do not duplicate.
• Dirty upgrade from older LAB experimental (incl. KernelSU) images: prefer clean flash for acceptance.
• Phonesky host artifacts missing or wrong signature: fail closed — never silently fall back to FakeStore.
• Alternate WebView installed by user later: selection must remain possible; default remains LOS23 WebView until the user changes it.

Requirements (mandatory)

Functional Requirements

• FR-001: The project MUST produce a flashable LineageOS 23.2 / Android 16 sunfish build that resurrects the AXP.OS on LOS22 / GOLDEN capability set (including Magisk-class root and GOLDEN-class hardening / signing / AVB posture), without leaving AXP capabilities as open “decide” omissions except the WebView exception in FR-015.
• FR-002: Version selection for system and bundled components (except Phonesky per FR-004) MUST prefer the newest stable (or newest tagged pre-release upstream currently ships) that still works on sunfish / LOS 23.2; GOLDEN versions are a floor reference, not a freeze.
• FR-003: The ROM MUST ship newest-stable microG Services Core and GSF Proxy integrated with the project Phonesky (no FakeStore as primary Play).
• FR-004: The ROM MUST ship the project's recent patched Phonesky as privileged com.android.vending, with a documented host-side obtain / patch / sign / deploy path that never commits APK bytes to Git. If that artifact lacks GOLDEN-class fixes required for daily-driver Play behaviour, the Phonesky plan MUST be reconsidered before acceptance.
• FR-005: The ROM MUST provide selectable signature spoofing for the microG + Phonesky path (owner-controlled toggle; default safe/off or project-documented default). Spoofing MUST remain restricted/controlled — not unrestricted platform spoofing for all apps.
• FR-006: The ROM MUST support the GOLDEN managed-profile banking workflow (Island as measured on GOLDEN) including Swissquote PASS as a hard gate.
• FR-007: Banking applications MUST run without being granted root (Magisk DenyList-class hiding).
• FR-008: The ROM MUST include selectable AXP-equivalent call recording unlock (toggle; OFF = stock LOS restrictions, ON = unlock).
• FR-009: The ROM MUST include the AXP usability/privacy bundled surface present on GOLDEN / AXP Pro (stores, launcher/gallery-class apps, DNS/hosts or equivalent blockers when part of that surface) at newest workable stables, subject to FR-015 for WebView.
• FR-010: The ROM MUST ship Magisk like GOLDEN: newest Magisk stable that works on this stack, in an AXP-like preinstalled but not fully activated layout (exact first-boot/setup behaviour measured from GOLDEN), with DenyList-class hiding sufficient for FR-007. KernelSU is out of ship for now (not the resurrection root path).
• FR-011: The feature acceptance gate MUST include GOLDEN/AXP-class hardening and signing / AVB posture (as applicable on LOS 23.2 / sunfish), not only apps and Google compatibility. Gaps MUST be documented as impossible on this stack rather than silently omitted.
• FR-012: Acceptance flashing MUST use LAB only; GOLDEN MUST remain unmodified by this feature's work.
• FR-013: Each shipped capability MUST be attributable (what upstream or AXP behaviour it reproduces) and reversible (known-good prior LAB image retained).
• FR-014: This feature MUST live as a new Speckit (009) in parallel with the standby KernelSU / split roadmap (004–008/007). Those older specs MUST NOT be deleted or rewritten to match Magisk resurrection. Reusable runbooks/results from them MAY be referenced. For this track’s ship only, Magisk (not KernelSU) is the root path.
• FR-015: Default WebView MUST be LineageOS 23's WebView. Aosmium MUST NOT be required. The ROM MUST keep WebView provider selection available so a future alternate WebView can be installed and chosen.
• FR-016: Existing functional KernelSU / related kernels and artifacts from 007 SHOULD be retained and MAY be recycled when useful (reference boot images, differential debugging, or a later optional non-ship path). Such reuse is optional (“si se puede, ok”), MUST NOT become an acceptance requirement for Magisk resurrection, and MUST NOT imply KernelSU is back in the ship path unless a future spec explicitly says so.

Key Entities

• Vanilla baseline: The LOS 23.2 sunfish build from 003 (or documented equivalent) before AXP feature integration.
• AXP capability set: Inventory of features/packages/behaviours from GOLDEN (002) plus AXP Pro catalog rows promoted by this spec (resurrection target).
• Version pin record: Documented package/component versions chosen for the accepted 009 build (newest workable stable each; Phonesky = project artifact id/version).
• Phonesky host artifact: Project patched/signed Play APK and permission metadata kept outside Git on the build host.
• Magisk preinstall state: Measured GOLDEN/AXP layout for Magisk present but not fully activated, plus LAB setup steps.
• LAB acceptance build: Flashable image set + hashes + smoke/banking / Magisk / hardening results for this feature.

Success Criteria (mandatory)

Measurable Outcomes

• SC-001: One LAB flash of a 009 build boots and completes the vanilla hardware smoke within the same session as flash (owner can place a call, use Wi‑Fi, and unlock the device).
• SC-002: 100% of AXP resurrection capability categories from the agreed inventory are either demonstrated on LAB or explicitly documented as impossible on Android 16/sunfish — zero silent omissions (WebView exception allowed only as FR-015).
• SC-003: With spoofing enabled as required, microG Self-Check required items and project Phonesky open/install succeed on LAB for ordinary apps on the first accepted build candidate (or within one documented fix iteration).
• SC-004: Swissquote managed-profile + Magisk DenyList-class workflow PASSes on LAB; Yuh result is recorded and is not worse than GOLDEN for packaging/spoofing reasons.
• SC-005: Every bundled/system app version in the acceptance record (except Phonesky) is newer than or equal to GOLDEN's measured version, unless a newer release was tried and failed with a written regression note; Phonesky matches the recorded project patched artifact.
• SC-006: Owner can turn signature spoofing and call recording unlock off and on and observe the documented behaviour each time.
• SC-007: Magisk is present post-flash in the AXP-like preinstall state and can be fully activated on LAB using documented steps measured from GOLDEN.
• SC-008: Default WebView is LOS23's; provider selection remains available.
• SC-009: Owner can perform the GOLDEN-equivalent daily checklist on LAB without consulting a scatter of conflicting feature specs for what “ships”.

Assumptions

• 003 vanilla LOS 23.2 sunfish is (or becomes) available as the integration base; LAB stock rescue from 002 remains valid.
• GOLDEN inventory (002) plus AXP Pro docs are sufficient to enumerate the capability set; live adb re-query of GOLDEN is allowed (especially Magisk preinstall/activation details).
• “AXP resurrection” means Magisk + GOLDEN-class hardening/signing/AVB + full AXP user surface on LOS23, with only the stated WebView and Phonesky-artifact exceptions.
• Island remains the managed-profile tool because that is what GOLDEN actually runs (AXP docs saying “Insular” are historical naming).
• FakeStore is never the primary Play path.
• Selectable spoofing and selectable call recording follow the same class of Developer Options UX already explored in 005/008 runbooks where useful.
• Project FLAG_SECURE override is nice-to-have, not an AXP resurrection hard gate.
• Personal app/data backup is not a ROM feature gate.
• Builds and long compiles run on rom-dev01; laptop holds docs/specs and flash tools only.
• Prior KernelSU LAB experiments (including the two functional kernels already built) are out of ship for now but kept as recyclable assets: reuse if helpful, never required for Magisk acceptance.