report: catalog the 7.15 seed-generation evidence and state the report's scope

The PDF is the artifact a release review actually reads, and it was quietly
claiming more than it knew. Two defects, one visible consequence.

parse_junit only emitted a 'mod::meth' key when the JUnit classname contained
a dotted test_msg_*/test_sign_*/test_verify_* module. Native gtest suites carry
a bare classname ("Dice", "Storage"), so they produced no such key, and _lookup
has no bare-method fallback by design. CI merged the firmware-unit XMLs into the
report input and every one of the 432 native tests was then structurally
impossible to reference from SECTIONS. Bare classnames are now keyed as
'Suite::Test'.

The header reported "N/N PASSED" against the catalog with nothing saying the
catalog is a subset. A 7.15 RC audit grepped this PDF for feature keywords,
found no hits for dice and PIN KDF, and reported both as having zero coverage.
Both had in fact run green in the same CI run: test_reset_device_dice passed,
and so did all five Dice unit tests and the PIN KDF rewrap tests. The header now
states catalogued-vs-executed and says outright that absence here is not
evidence of absence.

New section K catalogues what that audit went looking for: the dice flow
end-to-end (digest equals SHA256 of exactly the injected rolls, then the
mnemonic is derived from post-mix internal entropy, which is what proves the
rolls reached the seed), the aborted-reset EntropyAck disarm regression, the
five Dice known-answer and independence vectors, and the v16->v19 PIN KDF
rewrap plus storage migration.

Verified against the 7.15.0 RC artifacts from run 31284108490: dice went from 0
to 13 occurrences in the rendered PDF, section K renders 11/11 passed, and
poisoning Dice::MixDependsOnRolls in the merged JUnit turns the header red and
fails --validate-junit, so the entries are wired to real results.

Needs the companion firmware change: the CI trigger validated against the
Python JUnit alone, where every native entry resolves to "missing".

Author: BitHighlander

scripts/generate-test-report.py

@@ -340,9 +340,22 @@ def detect_fw():
         v = f'{r.major_version}.{r.minor_version}.{r.patch_version}'; c.close(); return v
     except: return None
 
+# Census of everything the merged JUnit actually contained, so the report can
+# state how much of the run it covers.  Without this the PDF silently implies
+# that its catalog IS the test suite -- an RC audit read "no dice in the report"
+# as "dice is untested" when test_reset_device_dice had in fact run green.
+JUNIT_CENSUS = {'ran': 0, 'native': 0}
+
+
 def parse_junit(path):
     """Parse junit XML for pass/fail. Returns dict keyed by 'module::method' (precise)
-    and 'method' (fallback). Module is extracted from classname: tests.test_msg_foo.TestBar → test_msg_foo."""
+    and 'method' (fallback). Module is extracted from classname: tests.test_msg_foo.TestBar → test_msg_foo.
+
+    Native gtest suites carry a bare classname ("Dice", "Storage") with no dotted
+    python module, so they get keyed as 'Suite::Test'. They used to produce no
+    'mod::meth' key at all, which made every native unit test structurally
+    impossible to put in SECTIONS -- the firmware-unit XMLs were merged in and
+    then silently unusable."""
     if not path or not os.path.exists(path): return {}
     import xml.etree.ElementTree as ET
     results = {}
@@ -353,6 +366,7 @@ def parse_junit(path):
         elif tc.find('error') is not None: status = 'error'
         elif tc.find('skipped') is not None: status = 'skip'
         else: status = 'pass'
+        JUNIT_CENSUS['ran'] += 1
         # Extract module from classname: tests.test_msg_foo.TestBar → test_msg_foo
         mod = ''
         if cls:
@@ -361,6 +375,9 @@ def parse_junit(path):
                 if p.startswith('test_msg_') or p.startswith('test_sign_') or p.startswith('test_verify_'):
                     mod = p
                     break
+            if not mod and '.' not in cls:
+                mod = cls               # native gtest suite
+                JUNIT_CENSUS['native'] += 1
             results[f'{cls}.{name}'] = status
         # Key by module::method (disambiguates collisions like test_sign_btc_eth_swap)
         if mod:
@@ -672,6 +689,84 @@ def _arg_shown(a):
           ['Wordlist rejection warning']),
      ]),
 
+    ('K', 'Seed Generation Hardening (7.15)', '7.15.0',
+     'The 7.15 changes to how a seed comes into existence: user-supplied dice entropy folded in '
+     'on-device, and the PIN key-derivation rewrap. These ran green from the first 7.15 RC but '
+     'appeared nowhere in this report, because the catalog could not reference native firmware '
+     'unit tests at all and nobody had catalogued the two new pyk cases. Absent evidence read as '
+     'absent coverage during an RC audit, which is exactly the failure this section exists to '
+     'prevent.',
+     [
+         'DICE: user rolls a d6 on-device; short press advances 1-6, long press commits, undo backs out.',
+         'The roll string is hashed and the digest confirmed on the OLED before it is mixed in.',
+         'MIX: int_entropy = SHA256(int_entropy || rolls), folded in BEFORE the host EntropyRequest,',
+         'so the device commits to its own contribution first and the host cannot choose the seed.',
+         'ABORT: any aborted reset must disarm EntropyAck, or a later host EntropyAck would derive',
+         'a seed from sha256(0*32 || host_bytes) -- entirely host-chosen. That is K2.',
+         'PIN KDF: a v16 storage blob must still unlock and then rewrap to v19, or the upgrade bricks.',
+     ],
+     [
+         ('K1', 'test_msg_resetdevice', 'test_reset_device_dice',
+          'Dice entropy end-to-end',
+          'Drives the full on-device dice flow over DebugLink: 99 rolls injected in chunks with undo '
+          'exercised, extras past the cap dropped. Asserts the device-computed digest equals '
+          'SHA256 of exactly the expected roll string, then derives the mnemonic from the post-mix '
+          'internal entropy and compares -- which is what proves the rolls actually reached the seed '
+          'rather than being collected and discarded.',
+          ['Dice entry screen', 'Digest confirmation']),
+         ('K2', 'test_msg_resetdevice', 'test_reset_reentry_disarms_entropy_ack',
+          'Aborted reset disarms EntropyAck',
+          'Regression for a host-chosen-seed hole: reset_init aborts left awaiting_entropy set from '
+          'an earlier run while zeroing int_entropy, so a following EntropyAck derived the seed '
+          'from host bytes alone. Arms a reset, re-enters with dice, cancels, and asserts the '
+          'next EntropyAck is refused with "Not in Reset mode" and the device stays uninitialized.',
+          []),
+         ('K3', 'Dice', 'RollsForStrength',
+          'Roll count per seed strength',
+          'd6 carries log2(6)=2.585 bits, so 128/192/256-bit seeds need 50/75/99 rolls '
+          '(the Coldcard convention). A short count would silently weaken the seed.',
+          []),
+         ('K4', 'Dice', 'MixZeroEntropyVector',
+          'Mix known-answer vector (zero entropy)',
+          'SHA256(0x00*32 || "123456") against a hardcoded digest. Pins the mix construction so a '
+          'refactor cannot quietly change how dice enter the seed.',
+          []),
+         ('K5', 'Dice', 'MixNonZeroEntropyVector',
+          'Mix known-answer vector (non-zero entropy)',
+          'Same construction with a non-zero starting entropy buffer, pinned to a hardcoded digest.',
+          []),
+         ('K6', 'Dice', 'MixDependsOnRolls',
+          'Different rolls produce different entropy',
+          'Two mixes differing only in the final roll must diverge. Catches a mix that ignores its '
+          'roll argument -- the failure mode where dice appear to work and contribute nothing.',
+          []),
+         ('K7', 'Dice', 'MixUsesExactCount',
+          'Only the counted rolls contribute',
+          'Bytes past the declared roll count must not affect the result, so uninitialized tail '
+          'bytes of the roll buffer can never leak into seed material.',
+          []),
+         ('K8', 'Storage', 'PinKdfV16RewrapsToV19AfterCorrectPin',
+          'v16 storage unlocks and rewraps to v19',
+          'The migration path for the hardened PIN KDF: an existing device on the old format must '
+          'still unlock with its current PIN and then be rewrapped. If this regressed, every '
+          'upgrading device would be locked out of its own seed.',
+          []),
+         ('K9', 'Storage', 'PinKdfV2FlagIsVersionedInV19',
+          'KDF version flag is recorded in v19',
+          'The new KDF is marked in the storage version band, so firmware can tell which derivation '
+          'a blob was written with instead of guessing.',
+          []),
+         ('K10', 'Storage', 'StorageUpgrade_Normal',
+          'Normal storage upgrade path',
+          'Baseline upgrade across storage versions with policies and cache preserved.',
+          []),
+         ('K11', 'Storage', 'NoopSecMigrate',
+          'Idempotent security migration',
+          'Re-running the migration on already-migrated storage must be a no-op rather than a '
+          'second rewrap.',
+          []),
+     ]),
+
     ('B', 'Bitcoin', '7.0.0',
      'Bitcoin is the primary chain and most extensively tested. Covers legacy P2PKH, P2SH-wrapped '
      'SegWit, native SegWit (bech32), and Taproot (P2TR). Transaction signing validates that the '
@@ -2044,6 +2139,18 @@ def _section_state(s):
     if build_label:
         for line in _w(f'Candidate: {build_label}', 95):
             pb.text(8, line, bold=True)
+    # Scope of this document. The catalog is a curated subset, and saying so is
+    # the difference between evidence and a misleading completeness claim: an RC
+    # audit grepped this PDF for feature keywords, found none, and reported four
+    # features as untested when their tests had run green in the same CI run.
+    ran = JUNIT_CENSUS['ran']
+    if ran:
+        pb.gap(3)
+        for line in _w('Scope: this report is a curated catalog of %d tests. The CI run executed %d '
+                       '(%d of them native firmware unit tests). Absence from this report is NOT '
+                       'evidence that a feature is untested -- check the JUnit artifacts.'
+                       % (total, ran, JUNIT_CENSUS['native']), 100):
+            pb.text(8, line, color=GRAY)
     pb.gap(6)
     pb.text(12, 'Sections', bold=True)
     _hdr_withheld = _hdr_pending = False