kleidos/test/vault/test_vault_backup_zeroize/ at main · jmrp.io/kleidos

credential_repository_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

group_table_amalgam.cpp

Extend the record to its final shape, revive the dead panels, honor the index Three firmware waves of the gap-report program, built in parallel worktrees against the same tip and integrated with both-sides conflict resolution (two stitch errors — an unopened Doxygen comment and a lost closing brace — were caught by the compiler, as intended). Wave 1 — the record's final shape. CredentialRecord gains flags (bit0 = auto-submit: username, TAB, password, ENTER as one BLE action — and the trailing ENTER is now conditional where it used to be unconditional), three typed custom fields (label/value/hidden — hidden values ride behind the same plaintext-consent header as passwords), a group id, and TOTP entries gain an account label plus the algorithm byte everywhere. Groups are a 100-slot encrypted name table (one littlefs block) managed over GET/POST/DELETE /api/groups — deleting a group only clears labels, never credentials. The index row carries group, a derived domain column and real mtime, with names widened to 32 chars; brand is populated at save time from the url, ending the per-row decrypt the device paid for logos. URL capacity rises to 192 (the owner's real data maxed at 190), and every save/import reports per-field truncation instead of silently clamping. Backup, restore, the normalized importer and the CSV importer round-trip all of it; the importer maps 1Password vaults and CSV folder/tags/vault columns into groups server-side. Wave 2 — six dead routes live: /api/ota/status (the whole Firmware panel keyed on it), /api/vault/reindex, /api/time/diag (RTC coin-cell health), the GPS trio (gated to boards that have one), NTP-sync-on-exit through the AdminMode teardown choke point, and the staged-SD firmware apply behind the confirm gate. Both full-replace restores now demand the unlock secret (X-Unlock-Secret) — a backup passphrase proves nothing about owning the live vault — and the restore body cap is computed from the device's own backup bound instead of a 64 KB literal. Wave 3 — the UI stops lying: the audit export honors Accept: text/csv with real CSV, the web CSV importer honors the type column (Bitwarden non-logins skipped and counted), LastPass and Proton Pass get real header signatures, /api/runtime-stats is gone, AutoLockMode appears on the six boards that hid a working handler, and the device vault lists honor favorite-first plus manual order with an allocation-free comparator. Integration extras: the index envelope buffers and the rekey crypto scratch now live on the heap (the rekey frame was already past the 32 KB worker stack at the current 200-slot caps — the latent overflow the dimensioning study flagged); core2_v13's capacity-scaled view-cache block moves to PSRAM .ext_ram.bss (keys and passwords stay in internal DRAM), un-breaking its 48-byte link margin; the groups list distinguishes a corrupt table from an empty one; custom:null is refused rather than destructive; and the three amalgam suites learned the new seams, including rebasing an unreachable handler-413 assertion onto the gate-logic suite that actually pins the bound. Builds: sticks3_debug, tdeck, cardputer, m5stickc_plus1_debug, core2_v13_debug (now with SPIRAM bss). Native: full suite green with nine new suites registered. Claude-Session: https://claude.ai/code/session_01Q2J5gQSFMTDLVzPUYog51r

3 weeks ago

test_vault_backup_zeroize.cpp

test(vault): de-flake SecureAllocator wipe assertions test_vault_backup_zeroize read a freed pointer to assert the block was zeroed. On glibc, tcache safe-linking writes an XOR-mangled next pointer plus a key into the first 16 bytes of every freed chunk, so the post-free read is nondeterministic and fails on Linux CI (while passing on macOS malloc). This failure aborted `pio test -e native_coverage` on every main CI run since 2026-07-04, blocking coverage.xml generation and skipping the SonarCloud job — freezing Sonar's coverage at a stale snapshot. Observe the wipe without undefined behavior: free then immediately re-allocate the same size, which returns the just-released chunk via LIFO free-list reuse (glibc tcache and macOS malloc alike), and inspect the payload tail past the bytes libc may reuse for bookkeeping. Reading a freshly-allocated unsigned-char block is defined; the tail still holds the wiped zeros, never the pre-wipe pattern a non-wiping allocator would leave. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

totp_repository_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_backup_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_import_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_index_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_rekey_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_store_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

wifi_repository_amalgam.cpp

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

Configure Feed

Configure Feed