{
  "title": "mtk_root: pre-arrival Android rooting toolkit",
  "objective": "Prepare host tooling and recon scripts before a Ulefone Armor X12 Pro (MediaTek MT6765) arrives, so that rooting on arrival day is one script plus a decision rather than an evening of setup. Validate everything possible read-only against an already-connected Pixel 6a, and label honestly what remains untested because it is MediaTek-specific. Success means 00-preflight.sh reports HOST READY, the fixture suite passes, and READY.md states per-capability which parts are device-validated versus fixture-tested only.",
  "acceptance_criteria": [
    "00-preflight.sh reports HOST READY (all checks pass) on this machine",
    "tests/run_tests.sh passes with zero failures and touches no phone",
    "Partition discovery selects init_boot over a co-present boot, and boot when init_boot is absent, without hardcoding either name",
    "10-recon.sh classifies an unrecognised device as UNKNOWN and refuses to name a path, rather than assuming it is the Ulefone",
    "20-dump-stock.sh refuses any device lacking a positive MediaTek platform signal",
    "10-recon.sh performs no device-mutating operation, enforced by a static scan that is itself proven to fail on an injected mutating command",
    "Carrier lock is reported as UNDETERMINED, never as a negative, since no readable property discriminates it",
    "10-recon.sh run read-only against the Pixel 6a reports PIXEL, boot_a, A/B, no init_boot, and path C-or-D indeterminate",
    "mtkclient is cloned fresh and its venv imports usb, usb.core and serial under the current Python",
    "READY.md distinguishes device-validated, host-validated, fixture-tested-only and untested per capability"
  ],
  "out_of_scope": [
    "Any flashing or partition-write script: automating irreversible writes would defeat the confirmation steps that catch a wrong partition or missing slot suffix, so flashing stays manual",
    "Any write, unlock, wipe, or bootloader reboot of the Pixel 6a, which is the user's daily driver: today is read-only recon only",
    "Modifying linux_configuration/scripts/single_use/utils/root_bl9000.sh, which still serves a different device (Blackview MT6893)",
    "Pre-fetching Ulefone firmware: the stock ramdisk is dumped off the device itself so it matches that exact unit and build",
    "Downloading a Pixel factory image, since the toolkit does not act on the Pixel",
    "Play Integrity / SafetyNet bypass, which needs Zygisk plus a hiding config",
    "Committing binary artifacts: images, APKs and dumps stay in ~/.cache/mtk-root/ outside the repo"
  ],
  "verifier": "./linux_configuration/scripts/mtk_root/tests/run_tests.sh (58 assertions, offline); ./linux_configuration/scripts/mtk_root/00-preflight.sh (host readiness); shellcheck via pre-commit run --files; and a read-only ./10-recon.sh run against the attached Pixel 6a"
}