[aruokhai]

Every e2e now runs from an Android emulator, the way the app runs. Every passkey goes through Android's real Credential Manager, against the dev enclave and MerlinPlatform. The host's Dart suite is replaced by its on-device port.

What runs (make e2e = scripts/e2e-all.sh)

It uses one boot of the dev enclave image's app bundle (ENCLAVE_BUNDLE=app: rp id vtxos.com, the app's origins), with MerlinPlatform, and runs two files on the emulator:

app/integration_test/app_test.dart, the app's full flow through its screens:

1. A passkey is created, then DKG, then the exit address.
2. 500k sats are boarded; the funds are protected and their exits signed.
3. The cosigner renews them by itself, and an entry with the passkey re-arms the renewal.
4. The Exit tab.
5. A payout through the platform: KSh 1,500 to M-PESA.
6. The app restarted: it opens from its own storage, with the same balance.
7. A new phone: wiped and restored with "I already have a wallet", the same balance, and it pays again.

app/integration_test/enclave_test.dart, the wallet against the cosigner. This is the host suite's tests, ported with every wallet the app's own client:

• attestation down to the component, and refusing another component or an unattested certificate;
• DKG, device enrolment and tenants;
• addresses, and a fresh wallet holding nothing;
• an exit for every VTXO, an exit bitcoind mines, and a wallet with no exit address;
• three sends, and a mixed exit-delay set;
• nothing secret at rest, and a wrong seed refused;
• a client rebuilt from storage, recovery on a new phone, a PRF that answers differently, and another tenant's contribution refused;
• an unknown service refused.

Not ported:

• The cosigner refreshing funds by itself: app_test.dart proves it through the app.
• The escrow service's own protocol (both halves arriving, a half refused, a payment paying once): the cosigner's tests prove it in isolation, and the payout end to end.

How the passkey is tested

• app/android/testpasskey is a passkey provider in software, set as the emulator's over adb.
  • PasskeyPlugin's calls take the real path: Credential Manager, a provider, and back.
  • It signs as the runtime's SoftwareAuthenticator does.
  • It claims Android's origin, android:apk-key-hash of the calling APK's certificate.
  • It answers WebAuthn's PRF extension.
  • It never ships in the app.
• scripts/approve-passkeys.sh taps each sheet's Continue.

CI

• One e2e job runs make e2e-all on an API 35 Play emulator on the runner's KVM, next to the enclave.
• rust, dart and flutter are unchanged.

Fixes this found

• Monospace font: eight text styles asked for RobotoMono, which the app doesn't bundle, so it was fetched from Google at runtime. They now use FiraCode, which is bundled.
• Exit tab: opening it with a signed exit threw in debug builds. The tile now has its own Material.
• gradle.properties: named /home/joshua/dev/jdk-17, so Gradle couldn't start on any other machine.
• A send's change: the delegate was renewed before the change was indexed (fix(core): renew over a send's change only once it is indexed #63, cherry-picked here so the e2e passes).

Blocked on

vtxos/infra#5, the dev enclave image with the app bundle. Until it is published and its digest pinned in docker-compose.enclave.yml, the e2e job boots the old image, whose relying party is enclave.test, and the app's passkey is refused.

What was run

make e2e on a KVM workstation: an API 35 Play emulator, against infra#5's image built locally. Both files pass, in 14:22, with 93 passkey sheets approved, and the enclave is taken down after.

🤖 Generated with Claude Code