Merge branch 'odudex:master' into merge/tdisplay-p4-upstream-0.0.15

Author: sandman21vs

CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.0.16] - 2026-08-11
+
+### Added
+- PSBT review shows the fee as a percentage of the total inputs and flags it in red at or above 10%, so an outsized fee no longer reads like a normal one
+- Signing reports inputs that did not receive a signature: cleared inputs are counted against inputs that actually gained one (ECDSA map, taproot key signature and leaf signatures diffed rather than trusting the return code), and the scan page names the shortfall before offering export
+- Project landing page at `site/index.html`, with the web flasher moved under `site/flash/`; `just site` stages branding plus locally built firmware exactly the way CI does and serves it on localhost, so a board can be flashed from the local copy before anything is pushed
+
+### Changed
+- New devices default to testnet. Consolidating Kern as a research platform, experimentation is the out-of-box state instead of a setting to find first
+- The unproven-fee confirmation behind Sign is dropped; both fee warnings now live on the review screen itself
+- Dev tools and the QR decode debug scaffolding are removed, both gates were permanently compiled out and k_quirc's own test harness covers the capture/decode pages
+- Updated k_quirc and cUR
+
+### Fixed
+- An input Kern refused could still collect a signature: libwally signs every input whose keypath names the key it is given, so a UTXO of ours listed under someone else's fingerprint was shown as external while its signature was harvested anyway. Classification now runs up front, refused inputs are snapshotted and restored around signing, and discarded signatures are counted and reported
+- Sighash flags other than ALL are refused, in the review gate and again per-input inside signing; under NONE, SINGLE or ANYONECANPAY the outputs and fee on screen are not what gets broadcast
+- Input amounts are verified against the prevout txid instead of trusting whichever utxo the PSBT offered: amounts are classified as proven, asserted, invalid or missing, the proven value wins for display, and contradictory data is refused before the review screen. Unproven amounts still sign, coordinators trim the previous transaction for air-gapped transfers, but the fee is marked unproven
+
 ## [0.0.15] - 2026-07-24
 
 ### Added

CONTRIBUTING.md

@@ -2,6 +2,8 @@
 
 Thank you for your interest in contributing to Kern! This document outlines the guidelines for contributing to the project.
 
+Kern is a research and development project exploring new hardware and Bitcoin self-custody ideas. Contributions are welcome in that spirit: the goal is to learn and publish, not to ship a product.
+
 ## Getting Started
 
 1. Fork the repository and clone it locally.
@@ -15,10 +17,10 @@ Thank you for your interest in contributing to Kern! This document outlines the
 
 Kern follows a strict layer separation:
 
-- **`main/core/`** — Bitcoin logic. Must never depend on UI headers. Use callbacks for any user interaction.
-- **`main/pages/`** — UI pages with create/show/hide/destroy lifecycle.
-- **`main/ui/`** — Reusable LVGL UI primitives.
-- **`main/qr/`** — QR scanning, parsing, and encoding.
+- **`main/core/`**: Bitcoin logic. Must never depend on UI headers. Use callbacks for any user interaction.
+- **`main/pages/`**: UI pages with create/show/hide/destroy lifecycle.
+- **`main/ui/`**: Reusable LVGL UI primitives.
+- **`main/qr/`**: QR scanning, parsing, and encoding.
 
 Do not introduce UI dependencies into core modules. If a core function needs user confirmation, accept a callback parameter.
 
@@ -38,7 +40,7 @@ The project uses two static analysis tools to catch bugs early. Both are availab
 
 Both tools cover `main/` and first-party components (`bbqr`, `cUR`, `k_quirc`, `sd_card`, `video`, `wave_4b`, `wave_35`, `wave_43`, `crowpanel`, `tdisplay_p4`). `libwally-core` and `wave_5` are excluded (third-party upstream code: libwally-core is the original; wave_5 ships a vendored ST-style HX8394 driver).
 
-**clang-tidy** (recommended — catches real bugs):
+**clang-tidy** (recommended, catches real bugs):
 ```bash
 # Requires a build first (for compile_commands.json)
 idf.py build
@@ -55,7 +57,7 @@ find main components/bbqr components/cUR components/k_quirc \
   xargs -P$(nproc) -I{} clang-tidy -p build/compile_commands.json {}
 ```
 
-The project `.clang-tidy` config enables bug-finding and security checks tuned for embedded C. Warnings about unknown GCC flags (`-fno-tree-switch-conversion`, `-fstrict-volatile-bitfields`) are expected and harmless — they come from clang analyzing GCC-compiled code.
+The project `.clang-tidy` config enables bug-finding and security checks tuned for embedded C. Warnings about unknown GCC flags (`-fno-tree-switch-conversion`, `-fstrict-volatile-bitfields`) are expected and harmless; they come from clang analyzing GCC-compiled code.
 
 **cppcheck**:
 ```bash
@@ -73,7 +75,7 @@ cppcheck main/ components/bbqr components/cUR components/k_quirc \
   --std=c11
 ```
 
-Note: `cppcheck` does not understand secure memory wipe patterns (zeroing variables before return) and will flag them as dead stores — these are intentional and should be ignored.
+Note: `cppcheck` does not understand secure memory wipe patterns (zeroing variables before return) and will flag them as dead stores. These are intentional and should be ignored.
 
 ### Security
 
@@ -86,7 +88,7 @@ Kern is a Bitcoin signing firmware. Security is not optional.
 
 ## Objectivity
 
-We value focused, purposeful contributions. Every PR should clearly state **what problem it solves** — this helps reviewers understand your intent and keeps the project lean.
+We value focused, purposeful contributions. Every PR should clearly state **what problem it solves**. This helps reviewers understand your intent and keeps the project lean.
 
 Whenever possible, link to a previously discussed **Issue** where the problem has been described and agreed upon. If no issue exists yet, consider opening one first to give the community a chance to weigh in. For small, self-evident fixes (typos, obvious bugs), describing the problem directly in the PR is perfectly fine.
 
@@ -104,7 +106,7 @@ Whenever possible, link to a previously discussed **Issue** where the problem ha
 
 Open an Issue describing:
 
-- **The problem** — what is wrong or missing, and why it matters.
+- **The problem**: what is wrong or missing, and why it matters.
 - **Steps to reproduce** (for bugs).
 - **Hardware and firmware version** (if relevant).
 

README.md

@@ -9,11 +9,13 @@
   <a href="ROADMAP.md"><b>Roadmap</b></a>
 </p>
 
-Kern is a young open-source project building an air-gapped Bitcoin signing device on the ESP32-P4. The chip has no radio, so keys are generated and used on hardware that physically cannot reach a network. Transactions cross the air gap as QR codes or over an SD card.
+Kern is a research and development project exploring what new hardware can do for Bitcoin self-custody. It takes the form of an air-gapped signing device on the ESP32-P4: the chip has no radio, so keys are generated and used on hardware that physically cannot reach a network. Transactions cross the air gap as QR codes or over an SD card.
+
+The goal is to explore ideas: new silicon, new interfaces, new backup and signing workflows. They get implemented, tested and documented in the open. Kern is a research platform and intends to stay one; it is not on a path to becoming a product.
 
 It signs PSBTs for single-sig, multisig and miniscript policies on both native segwit and taproot, built on [libwally](https://github.com/ElementsProject/libwally-core/), the same core library used by Blockstream Jade.
 
-> **Warning:** Kern is under active development and has not been audited. Secure boot is not enabled by default and builds are unvetted development snapshots. Do **not** use Kern to manage real savings.
+> **Warning:** Kern is a research and development project, built for experimentation and testnet use. It has not been audited and secure boot is not enabled by default; builds are unvetted development snapshots. Any mainnet use is entirely at your own risk. The project makes no security guarantees.
 
 ## Hardware
 
@@ -29,7 +31,7 @@ the LilyGO T-Display-P4:
 | [CrowPanel Advanced 10.1" ESP32-P4](https://github.com/Elecrow-RD/CrowPanel-Advanced-10.1inch-ESP32-P4-HMI-AI-Display-1024x600-IPS-Touch-Screen) and 7" siblings (`crowpanel`) | 1024x600 MIPI DSI | GT911 | SC2336, included |
 | [LilyGO T-Display-P4](https://lilygo.cc/en-us/products/t-display-p4) AMOLED (`tdisplay_p4`) | 568x1232 MIPI DSI (RM69A10) | GT9895 | OV2710, onboard |
 
-ESP32-P4 does not contain radio (WiFi, BLE), but these boards have a radio in a secondary chip (ESP32-C6 mini). Later the project will migrate to use radio-less, simpler and cheaper boards with ESP32-P4 only.
+ESP32-P4 does not contain radio (WiFi, BLE), but these boards have a radio in a secondary chip (ESP32-C6 mini). Exploring radio-less, simpler and cheaper ESP32-P4-only boards is part of the project's hardware research.
 
 A MIPI CSI camera is required for all boards. Kern ships drivers for the
 OV5647 and SC2336 sensors and probes for whichever one is attached at boot, so
@@ -169,7 +171,7 @@ The flasher offers two modes:
 - **Latest CI Build**: fetches firmware built by the most recent `master` push directly from the site and flashes it to the selected board.
 - **Custom ZIP Bundle**: accepts a `firmware-<board>.zip` artifact downloaded from the [Actions tab](../../actions) to flash any PR or older build.
 
-> **Warning:** CI builds are unvetted development snapshots from a young, unaudited project. Secure boot is not enabled; do **not** use flashed firmware to manage real savings.
+> **Warning:** CI builds are unvetted development snapshots from a research project. Secure boot is not enabled. Flash them for experimentation and testnet use; any mainnet use is entirely at your own risk.
 
 > **Note:** The project site and flasher are deployed automatically on every successful push to `master`, from `site/` in this repository. To enable it for your fork, go to **Settings → Pages** and set the source to **GitHub Actions**. To preview the site locally, run `just site` and open http://localhost:8000. Web Serial works on localhost, so you can flash a real board from the local copy.
 
@@ -218,7 +220,7 @@ Every pull request and push to `master` produces a firmware artifact for each su
 
 ## Flashing Pre-releases
 
-Pre-release firmware is provided **for testing purposes only**. Do not use pre-release builds as a signer for real savings.
+Pre-release firmware is provided **for research and testing purposes only**. Any mainnet use is entirely at your own risk.
 
 ### Supported Devices
 

ROADMAP.md

@@ -1,5 +1,7 @@
 # Roadmap
 
+Kern is a research and development project. This list tracks what has been explored and what is still open: research directions, not a release schedule.
+
 - ✅ Basic UI
 - ✅ Multi-board support
 - ✅ Camera video pipeline
@@ -64,7 +66,7 @@
   - ❌ Option to disable USB-serial and JTAG
 
 - Easy Installer
-  - ❌ Flasher
+  - ✅ Flasher
   - ❌ Secure boot activation
   - ❌ Flash/RAM encryption activation