COLDCARD firmware

This commit fixes a UI label mix-up in the COLDCARD's 'SSSP' (Seed Safe Spending Policy) menu. Two settings were swapped: the menu item called 'Word Check' was actually controlling access to secure notes, while 'Allow Notes' was actually controlling the seed-word challenge. The fix swaps their labels and underlying setting keys so each toggle controls the feature its name describes. There is no direct evidence this is a security vulnerability, but mislabeled security controls can mislead users and cause unintended access grants.

This commit only changes documentation files. It adds a menu item to a text file, creates a new help document about spending policies, and makes a minor wording tweak to a web 2FA description. There are no code changes, no bug fixes, and no security-relevant modifications to the firmware itself.

This commit only updates user documentation for two COLDCARD features: Spending Policy and Web 2FA. It adds explanatory text, reorganizes sections, and fixes typos. No source code, firmware logic, or security behavior was changed.

This commit adds and reorganizes a 'Spending Policy' feature for the COLDCARD hardware wallet. It lets owners set rules (daily limits, allowed addresses, time delays, web 2FA) that block or allow transaction signing. The change is a feature implementation, not a reported security bug fix. There is no vendor statement that this commit fixes a vulnerability, and no independent researcher is credited.

This commit improves the Unix simulator's fake version of the COLDCARD's second secure element (SE2). It fixes a small bug where logging in with a 'trick PIN' could leave the wrong wallet loaded when later doing a normal login, and it makes the simulator better at rebuilding trick-PIN state from saved settings. These changes only affect the software simulator used for development/testing, not real COLDCARD hardware.

This commit only adds documentation notes to a markdown file describing how trick PINs and spending policies interact. There are no code changes, no bug fixes, and no security patches. It is purely informational guidance for users about existing product behavior.

This commit is a routine test-suite addition for the COLDCARD's Single Signer Spending Policy (SSSP) feature. It adds automated tests that verify the spending policy correctly allows or blocks transactions based on configured limits (amount, velocity, whitelist). The only production code change is removing an unreachable 'return default' line after a function that always raises an exception, which has no security effect.

This commit is a test-suite maintenance change for the COLDCARD firmware. It updates a test file to match new menu labels and adds a small helper fixture, while also adding a comment in the non-volatile storage code describing a new setting key ('lfr') that records why a spending policy blocked the last transaction. There is no code change that alters security behavior, fixes a vulnerability, or introduces an obvious bug.

This commit only changes a test file (testing/test_ccc.py). It moves a helper function inside another function and updates test assertions to handle two different warning scenarios. There is no change to the actual COLDCARD firmware or any user-facing security behavior.

This commit changes only a single word in a test file comment, capitalizing 'psbt' to 'PSBT'. It is a trivial documentation-style edit with no functional code changes and no apparent security relevance.

This commit only adds new test-plan comments to a test file. It does not change any firmware code, fix any bug, or alter behavior. It is a documentation/planning update for future tests of the 'hobbled mode' feature.

This is a minor cleanup commit ('nits'). It removes one outdated test assertion, adds some blank lines in test code, and simplifies a simulator-only default-setting line. There is no indication of any security fix or vulnerability being addressed.

This commit is a collection of tiny cleanups ('nits'): documentation wording and punctuation fixes, a comment tweak, a grammar fix, and adding one setting key ('lfr') to the list of values excluded from backups because it is a temporary error message. None of these changes affect security-relevant code behavior.

This commit mainly adds automated tests for a COLDCARD feature called Single-Signer Spending Policy (SSSP). It also makes a small code change in the login flow: when unlocking a spending policy, the device no longer loops asking for the main PIN over and over until secrets are loaded. Instead it asks once and proceeds. The change is framed as cleanup and test support; there is no clear security bug being fixed, but removing a retry loop could matter if the loop was hiding a logic issue.

This commit only adds and reorganizes automated test code in a single test file (testing/test_hobble.py). It does not change any firmware, application logic, or security-sensitive behavior. The changes implement previously planned tests for an existing 'hobble mode' spending-policy feature, ensuring QR scanning restrictions work as intended. There is no indication of a security vulnerability being fixed or introduced.

This commit is a minor cleanup. It removes an obsolete unused method from the PIN handling code and fixes a punctuation error in a user-facing message shown when a spending policy blocks an action. There is no security-relevant change.

This commit is a routine update to the on-device menu layout and the developer tool that prints that layout. It reorganizes where options appear for a special 'SSSP' limited mode, renames some menu labels, and fixes a few internal code patterns (like replacing inline checks with named helper functions). There is no direct evidence in the commit of a security vulnerability being fixed.

This commit is a small follow-up patch that fixes automated test scripts and a simulator boot helper after a previous code change. It does not change the actual COLDCARD firmware that runs on the device. The edits adjust test expectations, add a missing cleanup step in a multisig test, add short delays in a QR-code test, and ensure the Unix simulator falls back to default settings when no saved settings exist. There is no direct security fix visible in the diff, and no security relevance is claimed by the vendor.

This commit adds extra guardrails to a COLDCARD hardware wallet feature called 'hobble mode' (a spending-policy / restricted-access state). It now blocks several USB commands—such as creating backups, enrolling multisig wallets, and certain user-management commands—when the device is hobbled. It also makes firmware uploads in hobbled mode follow the same stricter rules used in HSM mode. The change appears to be a hardening patch rather than a fix for an active exploit, because the feature was already intended to restrict these commands but some were not being blocked.

This commit only adds and updates test files for the COLDCARD firmware. It expands automated tests for temporary seed handling under a restricted 'hobble' mode, including a new test case for BIP-39 passphrases and a more complete XPRV import test. There are no changes to the actual firmware code that runs on the device, so this commit does not introduce or fix any security vulnerability by itself.

This commit adjusts how COLDCARD's 'hobbled mode' handles temporary seeds and the Seed Vault. Hobbled mode is a restricted operating mode (often tied to a special PIN or duress-like setup). The change makes temporary seeds read-only: users can import and use an existing temporary seed for signing, but cannot generate new words or save the temporary seed into the Seed Vault. It also exposes a 'Temporary Seed' menu under Advanced/Tools when a spending-policy flag called 'okeys' is enabled. The commit is titled 'testing' and appears to be a work-in-progress feature patch with added tests, not a published security fix.

This commit only adds a new automated test file for an existing COLDCARD firmware feature called 'hobble mode.' It checks that the Seed Vault menu remains accessible and read-only when the device is in a restricted (hobbled) state. There is no change to actual firmware code, no security fix, and no vulnerability introduced.

This commit only changes a test file. It reorders some assertions, adds blank lines for readability, and updates a comment from 'skip words' to 'skip quiz'. There is no change to the actual COLDCARD firmware code that users run, and nothing that affects security.

This commit fixes a small bug in the COLDCARD wallet's login security check. When the device asks the user to confirm the first and last seed words (to prove they know the backup), the old code could accidentally keep leftover words from a previous attempt. The change makes the word collection more reliable and adds a 'Startup...' message so the screen doesn't look frozen. It is a cleanup/hardening fix rather than a clear-cut exploitable vulnerability.

This commit fixes the 'first and last seed word' login challenge on older COLDCARD Mk4 devices. Previously, the on-screen word picker for this security check was broken (the code even had a 'TODO: fix bugs here on Mk4' comment), which could have allowed someone with physical access to bypass or fail the word-check screen. The patch replaces the buggy callback-based picker with a working one, so the device can now properly verify the user's seed words during login.