feat(atlas): section TD, structured EIP-712, with hardware evidence - #49
Merged
Conversation
Four entries for the walk, and the first section in this catalog whose expected
values come from OUTSIDE the repository.
TD1 asserts the domainSeparator and messageHash published by
assets/eip-712/Example.js in ethereum/EIPs -- the reference implementation the
spec links to -- republished by Example.sol, by eth-sig-util's V3 and V4
snapshots, and by Mrtenz/eip-712.
That distinction is the section's reason to exist. The firmware C, the hdwallet
TypeScript and the python client were written by one hand against one reading
of the spec, so three of them agreeing proves the reading is self-consistent
and nothing more. A shared misreading produces three consistent WRONG answers.
It cannot produce those two numbers.
Hardware evidence recorded in the notes, 2026-08-21, K1-14AM, unsigned build of
the 7.15 line:
- nine screens, one per leaf, all correct on operator review
- 42-character addresses rendered IN FULL. That is the truncation class that
shipped as a bug at >42 chars, and it is the one claim the emulator's
framebuffer genuinely cannot settle
- the published hashes matched on silicon, not just in the emulator
- device address 0x73d0385F4d8E00C5e6504C6030F47BF6212736A8, identical to
the emulator, so key derivation agrees too
TD2 covers arrays, which were refused outright until a kilobyte came back from
MAX_DECODE_SIZE: at 13 KB the ARM image missed the linker's runtime-reserve
gate by 204 bytes, at 12 KB it clears by 812. TD3 covers a fixed dimension
being checked against the document -- the count is the only thing the device is
ever told, so accepting a wrong one signs a type nobody declared. TD4 covers
the AdvancedMode gate.
The section id is two characters because all 26 letters were taken. The catalog
keys on a string, so it costs nothing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four entries for the structured EIP-712 walk, and the first section in this catalog whose expected values come from outside this repository.
TD1 asserts the
domainSeparatorandmessageHashpublished byassets/eip-712/Example.jsinethereum/EIPs— the reference implementation the spec links to — republished byExample.sol, by eth-sig-util's V3 and V4 snapshots, and by Mrtenz/eip-712.That distinction is the section's reason to exist. The firmware C, the hdwallet TypeScript and the python client were written by one hand against one reading of the spec, so three of them agreeing proves the reading is self-consistent and nothing more. A shared misreading produces three consistent wrong answers. It cannot produce those two numbers.
Hardware evidence, recorded in the notes
2026-08-21, K1-14AM, unsigned build of the 7.15 line:
0x73d0385F4d8E00C5e6504C6030F47BF6212736A8, identical to the emulator, so key derivation agrees tooTD2 covers arrays, refused outright until a kilobyte came back from
MAX_DECODE_SIZE(at 13 KB the ARM image missed the linker's runtime-reserve gate by 204 bytes; at 12 KB it clears by 812). TD3 covers a fixed dimension checked against the document — the count is the only thing the device is ever told. TD4 covers the AdvancedMode gate.Section id is two characters because all 26 letters were taken; the catalog keys on a string.