kleidos/test/vault/test_vault_envelope_binding/ at main · jmrp.io/kleidos

credential_repository_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

group_table_amalgam.cpp

Extend the record to its final shape, revive the dead panels, honor the index Three firmware waves of the gap-report program, built in parallel worktrees against the same tip and integrated with both-sides conflict resolution (two stitch errors — an unopened Doxygen comment and a lost closing brace — were caught by the compiler, as intended). Wave 1 — the record's final shape. CredentialRecord gains flags (bit0 = auto-submit: username, TAB, password, ENTER as one BLE action — and the trailing ENTER is now conditional where it used to be unconditional), three typed custom fields (label/value/hidden — hidden values ride behind the same plaintext-consent header as passwords), a group id, and TOTP entries gain an account label plus the algorithm byte everywhere. Groups are a 100-slot encrypted name table (one littlefs block) managed over GET/POST/DELETE /api/groups — deleting a group only clears labels, never credentials. The index row carries group, a derived domain column and real mtime, with names widened to 32 chars; brand is populated at save time from the url, ending the per-row decrypt the device paid for logos. URL capacity rises to 192 (the owner's real data maxed at 190), and every save/import reports per-field truncation instead of silently clamping. Backup, restore, the normalized importer and the CSV importer round-trip all of it; the importer maps 1Password vaults and CSV folder/tags/vault columns into groups server-side. Wave 2 — six dead routes live: /api/ota/status (the whole Firmware panel keyed on it), /api/vault/reindex, /api/time/diag (RTC coin-cell health), the GPS trio (gated to boards that have one), NTP-sync-on-exit through the AdminMode teardown choke point, and the staged-SD firmware apply behind the confirm gate. Both full-replace restores now demand the unlock secret (X-Unlock-Secret) — a backup passphrase proves nothing about owning the live vault — and the restore body cap is computed from the device's own backup bound instead of a 64 KB literal. Wave 3 — the UI stops lying: the audit export honors Accept: text/csv with real CSV, the web CSV importer honors the type column (Bitwarden non-logins skipped and counted), LastPass and Proton Pass get real header signatures, /api/runtime-stats is gone, AutoLockMode appears on the six boards that hid a working handler, and the device vault lists honor favorite-first plus manual order with an allocation-free comparator. Integration extras: the index envelope buffers and the rekey crypto scratch now live on the heap (the rekey frame was already past the 32 KB worker stack at the current 200-slot caps — the latent overflow the dimensioning study flagged); core2_v13's capacity-scaled view-cache block moves to PSRAM .ext_ram.bss (keys and passwords stay in internal DRAM), un-breaking its 48-byte link margin; the groups list distinguishes a corrupt table from an empty one; custom:null is refused rather than destructive; and the three amalgam suites learned the new seams, including rebasing an unreachable handler-413 assertion onto the gate-logic suite that actually pins the bound. Builds: sticks3_debug, tdeck, cardputer, m5stickc_plus1_debug, core2_v13_debug (now with SPIRAM bss). Native: full suite green with nine new suites registered. Claude-Session: https://claude.ai/code/session_01Q2J5gQSFMTDLVzPUYog51r

3 weeks ago

test_vault_envelope_binding.cpp

Widen the slot id to 16 bits so capacity can pass 255 Credential capacity is pinned per variant at up to 700 by the vault dimensioning study, but the slot id was a u8 across the app, web and persistence layers: every id above 255 would have aliased onto a live slot. Widen the id and the counts derived from it to uint16_t through vault, web, states and ui; TOTP and group ids deliberately stay u8 (their caps stay under 255) and are now pinned by co-located static_asserts instead of by assumption. The wire follows: index rows and the row count, and the slot id in the envelope's authenticated context, become u16 little-endian, growing the context prefix from 7 to 8 bytes. No version byte moves — the format is pre-release and every board is reflashed — but the security docs that quote the prefix byte-for-byte are updated so the audit dossier stays verifiable against the source. Adversarial review of the diff found four defects worth naming, all fixed here: - promoteAll() held two capacity-sized filename vectors live on the 32 KB vault-worker stack; at the 700-slot pin that is ~78 KB and a guaranteed overflow on the first SD import or re-key. Both move to the heap, matching the pattern the rest of the vault already uses. - The widened staged-filename grammar accepted cred_007.bin as well as cred_07.bin for the same slot, so an import deleted the canonical record and wrote a path the repository never opens — silent slot loss where the previous grammar had failed closed. The grammar is now canonical-only and lives in one header both readers share. - DevicePanel kept the last-viewed slot in editCredId_ after BACK, so the standalone password generator saved into it, blanking that credential's name, user and url. The id now resets to the invalid-slot sentinel, and the guard that also made slot 0 unwritable is gone. - The envelope test asserted the id's new high byte against its own zero-initialized fixture, so it would have passed against a writer that never wrote that byte at all. Verified: native 2843/2843 (including a new wide-capacity suite that exercises slot 260 end to end), sticks3_debug, cardputer_debug, tdeck and core2_v13_debug, plus the merge gate — a clean -Werror build at VAULT_MAX_CREDENTIALS=300, which is what proves no narrowing survives. Claude-Session: https://claude.ai/code/session_01Q2J5gQSFMTDLVzPUYog51r

3 weeks ago

totp_repository_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_backup_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_import_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_index_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_rekey_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_store_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

wifi_repository_amalgam.cpp

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

1 month ago

Configure Feed

Configure Feed