feat(vault): land ClearSign Studio, Solana outflow check, and the 7.15 docs from #384 - #402
Open
BitHighlander wants to merge 4 commits into
Open
feat(vault): land ClearSign Studio, Solana outflow check, and the 7.15 docs from #384#402BitHighlander wants to merge 4 commits into
BitHighlander wants to merge 4 commits into
Conversation
Pure additions carried over from the stale ClearSign Studio / Ironwood consolidation branch: 7.15 release handoffs, the clear-sign attestor and trust-model spec, the Solana swap metadata v1 spec, and the on-device gate-3 evidence captures for the attestor confirms and built-in anchor. The root-level HANDOFF-PASSPHRASE-SIGNING-BUG.md moves under docs/ to match every other handoff.
…384 Cherry-picked from the stale consolidation branch (5eed902) rather than merging it, because that branch also carried a regression: its regenerated SDK dropped getEntropy and the signing timeouts that shipped on develop after it was cut. This takes only the new work. ClearSign Studio — a developer surface behind the device's AdvancedMode policy for attesting Solana schemas, loading a RAM-only signer, and exporting test evidence. Closes itself when AdvancedMode is turned off. Solana outflow check — a host-side "what will I be left with?" panel on the opaque-signing consent screen. It reads post-execution balances out of a single simulateTransaction call rather than differencing two reads, because pre-state and simulation land on different slots on load-balanced public endpoints and misattribute unrelated traffic (measured: a 1.5 SOL transfer reported 6.5 and then 101 SOL of outflow, reproducibly). Presented as "checked on this computer", never as verification — the device cannot confirm these figures. Conflict resolutions all keep develop's newer work: the deviceErrorMessage unwrap in swap.ts, the host/device blind-sign cause split in SwapDialog, verifyEvmSigner in bun/index.ts, the deduped Hive outline-button style, the scriptTypeOverride param in estimateUtxoFee (unioned with this branch's memo param), and the removed Experimental toggle stays removed. Both new test files are wired into make test-unit — they were not in the target on the source branch, so they would never have run in CI.
…pin check Both carried over from #384, and both deliberately narrowed. The SDK descriptor tests (offline + on-device KKSOLSW1) only call methods develop's SDK already exposes — solanaGetAddress, loadClearsignSigner, solanaSignTransaction — so the source commit's SDK changes are NOT taken. Those edited only the generated lib/ and never src/, so `npm run build` would erase them; they also dropped getEntropy and the signing timeouts that shipped on develop after that branch was cut. verify-zcash-ironwood-protocol.mjs asserts the pinned device-protocol actually round-trips ZcashSignPCZT fields 19/20 and action booleans. The pin can build cleanly and still be missing them, and a missing setter degrades to a silently unshielded PCZT — so this runs as part of preflight gate 5 rather than as a script nobody invokes. Passes on the current pin. Not taken: postprocess-device-protocol.mjs and the CI plumbing around it. Develop already fixed device-protocol codegen a different way (the pbjs bin-link pin), and swapping that out days before a release is risk with no matching benefit.
The cherry-picks came in below the old 636, so lock the improvement in — otherwise the gate silently tolerates seven regressions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the stale draft #384 by cherry-picking only its genuinely-new work onto current develop.
Why not just merge #384
#384 was cut on 2026-07-31 and has not moved since. Half of it already shipped on develop independently — NU6.3 Ironwood (
d527cb31), and the reusable Solana/EVM signed clear-sign schemas (ad2bd911,2b088f6a). The half that had not shipped was trapped behind a regression: the branch'sfix(sdk): stabilize generated clear-sign methodsregenerated the SDK from a pre-develop source and droppedgetEntropy, theshow_displaysigning timeout on/addresses/utxo, the/utxo/sign-transactiontimeout, and theloadClearsignSignertimeout fix (18c6584f). Merging a 113-file conflicting draft to recover ~840 lines was the wrong trade.What landed
ClearSign Studio — developer surface behind the device's AdvancedMode policy for attesting Solana schemas, loading a RAM-only signer, and exporting test evidence. Auto-closes when AdvancedMode is turned off.
Solana outflow check — host-side "what will I be left with?" panel on the opaque-signing consent screen. Reads post-execution balances from a single
simulateTransactionrather than differencing two reads: on load-balanced public endpoints the pre-state and the simulation land on different slots and misattribute unrelated traffic (measured — a 1.5 SOL transfer reported 6.5 then 101 SOL of outflow, reproducibly). Worded as "checked on this computer", never as verification, because the device cannot confirm it.Ironwood
pendingbalance —zcash-clireported"pending": 0unconditionally; it now reports the immature slice inside theMIN_CONFIRMATIONSwindow.Solana ClearSign descriptor tests (offline + on-device KKSOLSW1) — these use only SDK methods develop already exposes, so none of #384's SDK
lib/edits came along.verify-zcash-ironwood-protocol.mjs— asserts the pinned device-protocol round-tripsZcashSignPCZTfields 19/20 and action booleans. A pin can build cleanly and still lack them, and a missing setter degrades to a silently unshielded PCZT. Wired into preflight gate 5, not left as a script nobody runs.63 docs/evidence files — 7.15 handoffs, the clear-sign attestor and trust-model spec, Solana swap metadata v1, and the on-device gate-3 captures.
Conflict resolutions — develop's newer work wins everywhere
swap.tsdeviceErrorMessageunwrap; theblockedclear-sign event now reports the unwrapped reasonSwapDialog.tsxapplyPolicyno-timeout call; outflow panel added alongsidebun/index.tsverifyEvmSigner; unioned the new ClearSign type imports; dropped a duplicateos/pathimporttxbuilder/utxo.tsscriptTypeOverride, unioned with this branch'smemoparamDeviceSettingsDrawer.tsx1f0cdb38)HiveAccountPanel.tsxoutlineBtnstyleDeliberately not taken
postprocess-device-protocol.mjsand its CI plumbing. Develop already fixed device-protocol codegen a different way — the pbjs bin-link pin (5cadb708) — and swapping that out days before a release is risk with no matching benefit.Verification
make preflight— all gates pass, including the new Ironwood field checkmake test-unit— 353 pass / 0 fail across 20 files; both new test files added to the target (they were not wired into it on the source branch, so they would never have run in CI)npm run test:solana-clearsign:offline— PASS (193B KKSOLSW1, exact-message + instruction binding)make build— cleanNot verified: on-device. ClearSign Studio and the outflow panel are both new UI paths that have never run against hardware on develop. Both need a device smoke before 1.5.1 ships.