Ryun1 · Oct 28, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
@@ -5,21 +5,21 @@
 # avoid making the PR author the only possible code owner.
 
 # Default owner for everything in the repo.
-*                       @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
+*                       @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
 
 # Security-sensitive boundaries — wallet crypto, encrypted storage, privileged
 # background and provider ingress, value-moving features, the CI/release
 # pipeline, and the vendoring/standards scripts
 # — always warrant maintainer review, even as the team grows.
-/.github/CODEOWNERS      @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/.github/workflows/     @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/apps/extension/src/background/ @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/apps/extension/src/content/    @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/apps/extension/src/provider/   @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/contracts/             @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/packages/features/privacy/     @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/packages/features/transactions/ @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/packages/foundation/wallet-protocol/ @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/packages/platform/kms-krusty/  @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/packages/platform/vault/       @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
-/scripts/               @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender
+/.github/CODEOWNERS      @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/.github/workflows/     @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/apps/extension/src/background/ @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/apps/extension/src/content/    @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/apps/extension/src/provider/   @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/contracts/             @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/packages/features/privacy/     @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/packages/features/transactions/ @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/packages/foundation/wallet-protocol/ @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/packages/platform/kms-krusty/  @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/packages/platform/vault/       @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
+/scripts/               @omarespejel @adrienlacombe @l-henri @robertkodra @Ryun1 @teddyjfpender @derek-flossman
@@ -256,7 +256,7 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.3.3
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
       - run: bun install --frozen-lockfile
@@ -285,14 +285,14 @@ jobs:
       # Fails on AMO errors; the manifest's warning-class regressions are held
       # by tests/scripts/firefox-manifest.test.ts, which runs in `check` above.
       - run: bun run check:firefox
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bramble-extension
           path: |
             artifacts/*.zip
             artifacts/*.zip.sha256
           if-no-files-found: error
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: failure()
         with:
           name: bramble-e2e-debug

@@ -109,17 +109,28 @@ jobs:
     runs-on:
       - codebuild-gha-runner-mc-wallet-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
+      # The token is not left in .git/config while dependency and vendoring code
+      # runs (supply audit F3). The one fetch below that needs it gets it through
+      # its own environment for that command only.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Check out resolved release commit
         env:
           REVISION: ${{ needs.resolve.outputs.revision }}
+          FETCH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           if [[ ! "$REVISION" =~ ^[0-9a-f]{40}$ ]]; then
             echo "::error::Nightly revision must be a full lowercase SHA-1."
             exit 1
           fi
-          git fetch --no-tags --depth=1 origin "$REVISION"
+          basic="$(printf 'x-access-token:%s' "$FETCH_TOKEN" | base64 -w0)"
+          echo "::add-mask::$basic"
+          GIT_CONFIG_COUNT=1 \
+            GIT_CONFIG_KEY_0="http.https://github.com/.extraheader" \
+            GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $basic" \
+            git fetch --no-tags --depth=1 origin "$REVISION"
           if [ "$(git rev-parse FETCH_HEAD)" != "$REVISION" ]; then
             echo "::error::Fetched nightly revision does not match the resolved commit."
             exit 1
@@ -128,7 +139,7 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.3.3
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
       - run: bun install --frozen-lockfile

@@ -41,10 +41,13 @@ jobs:
       # fetch-depth: 0 so the notes step can diff against the previous tag and
       # fall back to the commit range. Checkout starts from the trusted caller
       # revision; the next step verifies and detaches onto the release commit.
+      # Every later git step is local, so the token is not left in .git/config
+      # while dependency and vendoring code runs (supply audit F3).
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           fetch-tags: true
+          persist-credentials: false
       - name: Check out immutable release commit
         env:
           RELEASE_COMMIT: ${{ inputs.commit_sha }}
@@ -68,7 +71,7 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.3.3
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
       - run: bun install --frozen-lockfile
@@ -83,11 +86,23 @@ jobs:
         run: bun run check:release-version
       # Keep asserting the separate wallet-API/spec version axis too.
       - run: bun test tests/conformance/version-single-source.test.ts
-      - run: bun run build
+      # Both browser targets come from this one tagged commit, so the zip sent to
+      # addons.mozilla.org is the release, not a rebuild of a PR head. Each
+      # package step runs its own target's build, so no separate build step is
+      # needed. The Chromium zip keeps its `bramble-<version>.zip` name; the
+      # Gecko sibling is `bramble-firefox-<version>.zip`, and the Chrome Web
+      # Store job selects by that prefix, so the Firefox package can never be
+      # what reaches CWS.
       - run: bun run package:extension
-      # Confirm the released zip is byte-identical to what its checksum records
-      # (and therefore to the CI artifact at the same commit).
-      - name: Verify checksum
+      - run: bun run package:extension:firefox
+      # Mozilla's own validator, the one AMO runs at submission. A release whose
+      # Firefox zip AMO would reject fails here, before anything is published.
+      - run: bun run check:firefox
+      # Self-consistency only: the .sha256 was written by package:extension in
+      # this job, so this confirms the pair attached to the Release agree. It
+      # does not compare against the CI artifact or prove a reproducible build
+      # (supply audit F2); release.yml re-checks the pair after download.
+      - name: Verify checksum file
         working-directory: artifacts
         run: sha256sum -c ./*.zip.sha256
       # Release notes (issue #60): prefer the CHANGELOG.md section maintained on
@@ -117,7 +132,7 @@ jobs:
           echo "--- release notes ---"
           cat artifacts/release-notes.md
       # Consumable by the Chrome Web Store job so store bytes == release bytes.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bramble-release
           path: |
@@ -136,7 +151,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: bramble-release
           path: artifacts

@@ -24,11 +24,15 @@ jobs:
     runs-on:
       - codebuild-gha-runner-mc-wallet-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
+      # No later step talks to GitHub, so the token is not left in .git/config
+      # while dependency and vendoring code runs (supply audit F3).
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.3.3
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
       - run: bun install --frozen-lockfile
@@ -81,7 +85,7 @@ jobs:
       - name: Compute artifact name
         id: meta
         run: echo "name=bramble-extension-$(echo "$GITHUB_REF_NAME" | tr '/' '-')" >> "$GITHUB_OUTPUT"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ steps.meta.outputs.name }}
           path: |

@@ -142,7 +142,7 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.3.3
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: bramble-release
           path: artifacts

@@ -65,6 +65,8 @@ bun run dev:session          # headed browser on a kept profile, onboards/unlock
 - **Never** add fallback signing, key derivation, or mnemonic validation — Krusty KMS owns wallet
   crypto; if it is unavailable, fail closed. Keep its published package pinned exactly in
   `package.json` and `bun.lock`; don't bump it casually.
+  The one exception is off-wallet dev tooling that never ships, such as `tools/vendor-dataset`, which
+  derives test-vendor keys to record import fixtures. Nothing in `apps/` or `packages/` may import it.
 - Never log or persist secrets outside the encrypted vault. Secret-material field names are only
   allowed in the boundary modules whitelisted in `scripts/check-file-standards.ts`.
 - Clock/randomness calls live only in explicit boundary modules (inject `clock`/`fetch`/RNG into
@@ -83,7 +85,9 @@ bun run dev:session          # headed browser on a kept profile, onboards/unlock
   the background-only vault service, bound to its exact account, chain, pool, and derivation scheme;
   it must never enter account metadata, preferences, activity, logs, session storage, messages, or
   UI state. Privacy-service responses are untrusted, and only the configured pool's `apply_actions`
-  call may carry a prepared proof into submission.
+  call may carry a prepared proof into submission. A pool-shaped invoke (`apply_actions`, or any
+  call to the configured pool) always takes the STRK20 lane; only a dapp's non-pool SNIP-36 proof
+  goes out as an ordinary invoke.
 
 ## Schema migrations