docs(release): gate status after the rc30 hardware round - #490
Merged
Conversation
Supersedes the 249f2d6 table, which predates the round entirely. Gates 1 and 4 are now met on evidence: T1 proved the #429 ceremony rolls back on hardware, and twelve cards ran on 7.14.2 silicon. Gate 2 is met for the paths measured, with the gap named rather than rounded off -- custom-layout address/xpub bodies still clip unmeasured, because confirm_helper() only measures layout_standard_notification. Records the two things the round actually established: AdvancedMode PERSISTS across a power cycle. efa18ad and b53b63b both assert the opposite in their commit messages and build their risk analysis on it. Release-note correction. #485, the Cut Off screen that promised disclosure and redrew the same clipped body -- found by reading confirm_sm.c, not by the device. And states plainly what did not pay off: most of the wire-level checks duplicated the emulator suite, and one finding (#484/#486) was retracted after resting on an inferred button press. Written down so the next round is aimed at the screens and the press durations, which are the parts hardware alone can establish. Also records why CI was measuring the wrong release: FW_VERSION fell back to 7.14.0 (#467), so every test gated to 7.14.1+ was excluded from the screenshot filter and from report validation for the entire release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation only. Brings
docs/release/7.14.2.mdup to date for final review —its gate table was measured at
249f2d61b, before the hardware round happened.Gates that moved
Gate 2's remaining gap is named rather than rounded off:
confirm_helper()measures only
layout_standard_notification, so custom-layout address/xpubbodies still clip with no warning. Observed at T12 A4 and tracked against #428.
What the round established
AdvancedMode persists across a power cycle (T8 leg C).
efa18ad77andb53b63b0aboth state it is session state and build their risk analysis on that.It isn't — blind-signing stays enabled until explicitly revoked. This needs to
be in the release notes.
#485 — the Cut Off screen that promised to reveal hidden text and redrew the
same clipped body. Fixed by #488, hardware-verified. Found by reading
confirm_sm.c:441, not by the device.What did not pay off, recorded on purpose
Most of the wire-level checks in the round duplicated the emulator suite, which
already asserts the same
Failurecodes and signatures in CI. And one finding(#484, PR #486) was retracted after resting on "the device confirmed with no
press" — the tester was pressing.
That is written into the release doc rather than quietly dropped, because the
useful conclusion is where to aim next time: the screens and the press
durations are what hardware alone can establish. The screens are now automated
(#487, 345 → 375 captures) and the durations were measured for the pager (T13).
Why CI was measuring the wrong release
FW_VERSIONfell back to 7.14.0 on the 7.14.2 branch (#467, fixed in #487),so every test gated to 7.14.1+ was excluded from the screenshot filter and report
validation for the entire release.
Third instance of one pattern here, after the Stage-1 skip (#474) and the
integration deadlock (#477): a check that ran, went green, and measured something
other than its name.
Also repins python-keepkey to
bdb4444(the paging captures) and adds therc30-evidence/set — thirteen documents, including the #484 retraction.