[pwltr]

Description

Refresh 0.8.0-rc12 on merged master d10afd4, including the activity fee-rate fix (#187), trezor-connect-rs 10.0.1 (#192), and the Paykit router (#193). The former merge dependencies are satisfied. This rebuilds the SDKs with those changes and the BIP21 validation correction (#151) needed by synonymdev/bitkit-ios#909 and synonymdev/bitkit-android#1454.

Changes since the last mainline RC, v0.8.0-rc11:

• Reject ambiguous/concatenated BIP21 requests while preserving legitimate query metadata. (scanner: reject duplicate BIP21 parameter keys (#63) #151)
• Populate an unknown stored fee rate (0) from sync without overwriting a known positive rate. (fix(activity): fill unknown stored fee rate on sync (#186) #187)
• Preserve original/replacement RBF fee rates. (fix: preserve rbf replacement fee rates #166)
• Upgrade Trezor THP handshake handling to trezor-connect-rs 10.0.1. (chore(trezor): upgrade trezor-connect-rs to 10.0.1 #192)
• Add the Paykit direct/service-leg router, already merged from the 0.8.0-spark.3 feature line. (feat: pay contacts via spark #193)
• Include the wake gateway client/grants (feat: add a wake gateway client module #160) and cached transaction composition (perf(onchain): reuse a synced wallet across composes #188).

The refreshed release commit is authored by pwltr with a verified GitHub signature. Relative to current master, the PR still changes only Cargo.toml, Cargo.lock, Package.swift and bindings/android/gradle.properties. Generated Swift interface files match master after regeneration; generated mobile binaries remain untracked.

The rebuilt iOS ZIP is 87,988,628 bytes, SHA-256 aaccfb32e9028eb8336371788a8258c5ca4ac1789e276673ae33e41fb456b7ba, matching Package.swift. It replaces the old candidate archive. Android coordinates are com.synonym:bitkit-core-android:0.8.0-rc12.

Publication remains paused for explicit approval. No release or remote Android package has been published. Safe 7 Bluetooth cases 1–3 below remain unverified. On November 9, the release author explicitly accepted this unrun hardware QA gap for rc12; these cases no longer gate this RC publication decision and are not reported as passed. Python import remains broken on the unchanged baseline; the release author explicitly deferred that existing issue for this native RC on November 9, tracked in 194. The planned release uses a signed annotated tag, matching rc11. The author's GitHub account already has an SSH signing key registered as MacBook Signing Key. This runner has no configured private signing key and cannot access its inherited SSH agent (Permission denied); signing requires making that signer accessible or running the signing step where the existing key is available. An unsigned-tag fallback is not approved. Publication still requires explicit approval.

The publication process remains the same as rc11/#181: publish the exact preserved iOS ZIP with the tagged manifest checksum, then let gradle-publish.yml build and publish Android and its matching native debug symbols. Verify both published SDKs before updating application pins.

Design

N/A — no UI changes.

Preview

N/A — SDK release metadata and artifacts.

QA Notes

Setup

Validated candidate: 168de56de086e94bb9e4ca80f88e4259b8b76c08; source baseline: d10afd420474de8d0519965935c3f64695460aca (master after #187, #192 and #193). Local pre-commit checks used this exact candidate file tree, which was compared with the final signed commit tree. Earlier results are preserved separately below at their original revisions.

Local toolchain: Rust 1.90.0, Xcode 27.2 / Swift 6.4.2, Temurin JDK 17.0.21, protoc 36.2, Android SDK/build tools 34, Gradle 8.7, cargo-ndk 3.5.4, NDK r28c (28.2.13676358, matching the publication workflow). Put Cargo, protoc and Java 17 on PATH, and set JAVA_HOME, ANDROID_HOME, ANDROID_NDK_HOME and ANDROID_NDK_ROOT to those installations. Use the repository binding-build scripts sequentially; the Android script temporarily changes the source/build configuration.

On macOS 27, the host native-smoke/Python library is built with CARGO_PROFILE_RELEASE_STRIP=false for rust-lang/rust#157750. The iOS archive uses the repository's standard static-library build; its simulator library also links against the iOS simulator SDK without diagnostics.

For physical cases 1–3: a physical Safe 7, a phone with Bluetooth enabled, and a compatible Bitkit build consuming this exact SDK candidate are required. Stock staging is not evidence that this SDK is installed. Before publication, the Android script installs 0.8.0-rc12 into Maven Local for a consumer build configured to prefer mavenLocal(); iOS needs a local SwiftPM package override using the generated XCFramework (BITKIT_CORE_LOCAL=1). No verified consumer app build or physical Bluetooth fixture was configured for this run, so that setup remains a missing prerequisite. Record the app commit/build, phone/OS, Safe 7 firmware and SDK commit with any device results. Emulator firmware runs cited in #192 do not verify Bluetooth timing.

Manual Tests

All three cases are carried forward from #192 and remain not run. The release author accepted this gap for rc12 on November 9. IDs and unchecked status are preserved for any future execution; acceptance is not test evidence.

• 1. Reconnect to a physical Safe 7 with a stored credential over Bluetooth: connect without a new pairing prompt.
• 2. Fresh pairing with no stored credential: complete code entry and persist the credential; reconnect successfully afterward.
• 3. Keep the host remembered on the Safe 7, clear only the app's stored credential using the SDK trezor_clear_credentials(device_id) API (or corresponding binding), then reconnect: complete code-entry pairing instead of ending in ConnectionError. This is the regression-sensitive case identified in chore(trezor): upgrade trezor-connect-rs to 10.0.1 #192.

Automated Checks

• cargo test --locked --no-fail-fast: 745 passed, 11 failed, 30 ignored in the library target. All 11 failures are Blocktank staging request errors. A fresh cargo test --locked --lib modules::blocktank on unchanged d10afd4 reproduced the exact same 11 failing names (37 passed). The full suite is not green. Binary/doc targets completed successfully with zero tests.
• Activity (208), Trezor (72), Paykit route (8), scanner (41), on-chain (83) and wake (46) unit tests passed in that run. Ignored hardware/network/gateway/fork tests are not counted as passes.
• cargo fmt --check: passed.
• cargo clippy --locked --lib --tests: passed with 121 warnings, all identical to unchanged d10afd4; no new warnings.
• ./build_ios.sh, SwiftPM manifest validation, native Swift Trezor record smoke and native Swift BIP21 smoke: passed. The BIP21 smoke accepts two valid metadata cases and rejects nine ambiguous requests. The freshly archived simulator static library links successfully; it was not executed as a simulator app.
• The preserved iOS ZIP's SHA-256 matches the committed manifest and the checksum above. Regenerated Swift sources/header/module map are unchanged from master.
• ./build_android.sh: passed for all four ABIs, including native debug-symbol, stripping, 16 KB alignment, AAR and Maven Local validation. The AAR contains all four JNI libraries and nonempty consumer keep rules.
• ./gradlew :lib:check :lib:compileDebugUnitTestKotlin --no-daemon: passed. Android lint has zero errors and three existing dependency-update warnings; the Kotlin record fixture compiles. This does not constitute physical-device JNI/Bluetooth testing.
• CARGO_PROFILE_RELEASE_STRIP=false ./build_python.sh: generation passed. PYTHONPATH=bindings/python python3 tests/bindings/trezor_records.py: failed with SyntaxError: non-default argument follows default argument in the generated USDT constructor (required backup follows optional bridge_url). Fresh baseline generation/import on d10afd4 reproduces the failure; generated Python is byte-identical. Python import is not a pass. Python is not distributed by the iOS/Android publication workflow.
• Locked Cargo metadata, shell syntax and git diff --check: passed. GitHub verifies the refreshed commit signature and associates it with pwltr.
• All seven CI checks passed on 168de56de086e94bb9e4ca80f88e4259b8b76c08 on November 9. These checks do not exercise the physical Safe 7 cases or the Python import failure, and do not make the full Rust suite green.

Journeys

The shared BIP21 application journey remains in synonymdev/bitkit-ios#909 and synonymdev/bitkit-android#1454. It was not run as part of this core SDK preparation. Paykit contact-payment regtest journeys belong to the app integrations referenced by #193 (synonymdev/bitkit-ios#1191 and synonymdev/bitkit-android#1754); they are not claimed verified here.

Out of Scope

• Updating application dependency pins and running application/device journeys or wake/Paykit deployment end-to-end checks.
• Correcting the baseline Python constructor-generation issue: explicitly deferred by the release author for rc12, tracked in 194. The failing import remains recorded as a failure, not a pass.

Historical pre-refresh QA record — original revisions and artifacts

The following authored record applies to the earlier 787a3c6 / signed-equivalent 7b64caa candidate based on 4affda1. Both historical heads passed their six CI checks; the signed head's completed check runs were confirmed on November 9. None of those results, the old archive checksum, or the former metadata-only device-testing N/A establish verification of the new Trezor 10.0.1 candidate. Current device requirements and results are above.

Setup

Local verification was performed on 787a3c6f9ae8df5f988ea240a04e5092f1082852. Its signed replacement is 7b64caaf05dd84d1e428a8638da8b1c28b5b4043, with an identical Git tree; existing results remain recorded at their original revision, and CI is rerunning on the replacement. Source baseline: 4affda1dfdb7b0192a905632f2b1d4f2a1ea94c8. Local checks use Rust 1.90.0, Xcode 27.2 / Swift 6.4.2, Temurin JDK 17.0.21, Android SDK 34 and build tools 34.0.0, NDK r28c (28.2.13676358, matching the publication workflow), and protoc 36.2. Install the prerequisites, put Cargo/protoc/Java on PATH, and set JAVA_HOME, ANDROID_HOME, ANDROID_NDK_HOME and ANDROID_NDK_ROOT to those installations before running the repository build scripts.

On macOS 27, the host Rust dylib needs CARGO_PROFILE_RELEASE_STRIP=false for native smoke execution because of rust-lang/rust#157750. The iOS release archive contains static libraries and is preserved unchanged; its simulator library links against the iOS simulator SDK without diagnostics.

No device testing is required for this metadata-only release preparation. Hardware and live gateway/fork tests require their separately documented environments; ignored tests are not passes.

Automated Checks

• cargo test --locked: 736 passed, 11 failed, 30 ignored. All failures are Blocktank staging request failures. cargo test --locked --lib modules::blocktank on an archived unchanged master reproduced the exact same 11 failing test names (37 passed). Direct staging connectivity timed out after 15 seconds. The full suite is not green.
• All scanner (41), on-chain (83), and wake (46) unit tests passed in that run; 26 on-chain and two wake tests were ignored.
• cargo test --locked --bins and cargo test --locked --doc: passed, with zero tests in these targets.
• cargo fmt --check: passed.
• cargo clippy --locked --lib --tests: passed with 121 warnings, all identical to unchanged master; no new warnings.
• ./build_ios.sh, SwiftPM manifest validation, exact archive checksum verification, native Swift Trezor smoke, and native Swift BIP21 smoke: passed. The BIP21 smoke accepts two valid metadata cases and rejects nine ambiguous requests. The archived simulator static library links successfully.
• ./build_android.sh: passed for all four ABIs, including stripped/native-symbol, 16 KB alignment, AAR and Maven Local checks. ./gradlew :lib:check :lib:compileDebugUnitTestKotlin --no-daemon: passed; Android lint reports zero errors and three existing dependency-update warnings. The AAR contains all four JNI libraries and consumer keep rules, and its Maven coordinates are com.synonym:bitkit-core-android:0.8.0-rc12.
• CARGO_PROFILE_RELEASE_STRIP=false ./build_python.sh: generation passed. PYTHONPATH=bindings/python python3 tests/bindings/trezor_records.py: failed because the generated USDT constructor has required backup after optional bridge_url, producing SyntaxError: non-default argument follows default argument. Regenerating and running on unchanged master reproduces the same failure, and both generated Python files are byte-identical. This is an existing master regression relative to rc11's successful Python smoke, not a passing Python result. Python is not distributed by the iOS/Android release workflow; publication needs an explicit decision on this gap.
• Cargo locked metadata, shell syntax, final formatting and git diff --check: passed.

Journeys

The shared BIP21 application journey remains in synonymdev/bitkit-ios#909 and synonymdev/bitkit-android#1454. It requires the published SDK; it was not run as part of core release preparation.

Out of Scope

• Updating the application dependency pins, application/device journeys, and wake gateway end-to-end deployment.
• Correcting the existing Python constructor generation issue; it is reported above and left unchanged in this release metadata PR pending a publication decision.

Models used

• Planning/scoping: gpt-6.1-sol (reasoning: high)
• Implementation: gpt-6.1-sol (reasoning: high)
• Review: Not performed

[talosmachina]

No findings. Bumps the release metadata from 0.8.0-spark.3 to 0.8.0-rc12 (Cargo manifest and lock, Package.swift tag and checksum, Android gradle.properties) on top of current master. Reviewed 168de56, full tier (dependency manifest).

What I checked, and 2 candidates I ruled out

Read in full: the four changed files' hunks, Package.swift whole, .github/workflows/gradle-publish.yml
Base: master (d10afd4) is an ancestor of the head; git diff master...pr touches only the four files, so no source change rides along with the bump.
Version sync: git grep for spark.3 and 0.8.0-rc1 on the head finds only Cargo.toml, Package.swift and bindings/android/gradle.properties, all at 0.8.0-rc12; Cargo.lock matches. No stale version string left elsewhere.
Android: gradle-publish.yml takes the version from the release tag (-Pversion=${tag#v}), so v0.8.0-rc12 publishes com.synonym:bitkit-core-android:0.8.0-rc12, consistent with gradle.properties.
CI: green on this head (Android Bindgen, iOS Bindgen, SwiftPM manifest, manifests check, paykit-route, usdt, wake tests).
Build: not run locally; the PR changes no code relative to master, and both bindgen jobs built this head.

Ruled out

• Pre-release ordering: under SemVer 0.8.0-rc12 sorts below 0.8.0-spark.3 and 0.8.0-swaps.6, so a range-resolved dependency would never move to it. Dropped: the rc and feature pre-release lines already coexist in this repo's tags (v0.8.0-rc1 to rc11 alongside v0.8.0-spark.* and swaps.*), so the naming is deliberate.
• Checksum without an artifact: no v0.8.0-rc12 release exists yet, so the Package.swift checksum cannot be checked against a download. Dropped as a finding: SwiftPM rejects a mismatched ZIP at resolve time, and the body records the checksum of the archive to be uploaded.

Merge confidence: 4/5, the Package.swift checksum is a cross-repo contract nothing can verify until the ZIP is uploaded to the v0.8.0-rc12 release.

[coreyphillips]

Two independent reviews, nothing blocking a merge.