feat(vault): consolidate ClearSign Studio and Ironwood release work - #384
feat(vault): consolidate ClearSign Studio and Ironwood release work#384BitHighlander wants to merge 16 commits into
Conversation
Covers what shipped (firmware #321, vault #380, pioneer v1.3.149 — Relay swaps clear-sign both directions on real hardware), the persistence design that was rejected after review and precisely why the reasoning was wrong, and the two remaining pieces: a KeepKey that issues clear-sign signatures, and certificate chains so onboarding a provider does not need a firmware release. The chain work is deliberately left as a spec-first item. The rejected PR is a direct demonstration of what skipping that step costs on a trust-model change.
The capture caught two truncation bugs in firmware #323 -- the discriminator rendered off the bottom of the confirm body, and batched labels scrolled off at max length -- so the harness ships alongside the PNGs rather than the PNGs alone. Re-runnable against any kkemu built with KK_CLEARSIGN_ATTESTOR=ON.
Emulator proof that a metadata blob verifies with no LoadClearsignSigner and leads with INSIGHT VERIFIED instead of a host-chosen identity, plus the script that produced it.
The issuing firmware bakes no key, so it ships first. The constraint that actually orders the work is the bootloader's signedness-match rule for restoring storage, which is why the attestor ships as a signed variant.
|
Superseded by #402. Rather than rebase 113 conflicting files, #402 cherry-picks this branch's genuinely-new work onto current develop:
Already landed on develop independently, so not carried over: NU6.3 Ironwood ( Deliberately not carried over: Every conflict in #402 resolved in favour of develop's newer work. Closing this one. |
1 participant
Summary
developWhy
The release work had accumulated across the primary Vault worktree while canonical protocol, Python, and hdwallet staging moved forward independently. This PR reconciles that intentional Vault/SDK work with current
develop, preserves the exact upstream dependency flow, and gives reviewers one clean integration branch to test before any release action.The transaction-builder barrel also eagerly loaded the Pioneer database layer. Pure unit tests consequently booted Electrobun's updater and failed while looking for packaged
Resources/version.jsonin a source checkout. Pioneer is now loaded only when a Pioneer BTC operation is actually invoked; runtime behavior is unchanged and pure imports remain side-effect-free.SOP / release boundary
This is a Vault integration PR only. It does not publish packages, merge firmware upstream, cut RC23, or claim hardware validation. Firmware and physical-device testing remain separate release gates.
Validation
make test-unit— 335 passed, 0 failedcargo testinprojects/keepkey-vault/zcash-cli— 66 passed, 1 ignorednpm testinprojects/keepkey-sdk— 14 passed, 0 failednpm run test:solana-clearsign:offline— passedbun run buildinprojects/keepkey-vault— passedReview notes
The branch was reconciled with
origin/developat76af0f2f. The hdwallet submodule is left at the canonical pin already present on currentdevelop. Unrelated unpublished nested-submodule experiments and generated build caches were excluded from this PR.