tari-project / tari / 35192540237

73%

Build Type

push

github

Committed by web-flow

Commit Message

feat(ledger): drive and assert the device's review screen (#8027)

## Description

Spec 3 of seven — UI automation for the Ledger Speculos harness. Builds
the `Approver` and the screen assertions; the scenario suite that uses
them is Spec 4, and the CI workflow is Spec 5.

`GetOneSidedMetadataSignature` is the only instruction that puts a
screen in front of a human, and until now nothing checked what that
screen said. A wrong key bricks a wallet; a wrong *displayed* address
steals funds, because the screen is the only thing a user can trust when
the host cannot be.

Adds, in `comms_testing`:

* `speculos_api` — a hand-rolled client for Speculos' HTTP control API,
including its Server-Sent Events stream. Four endpoints, no TLS, a
dependency budget small enough to read.
* `review` — `ExpectedReview`, and the comparison between what a
scenario says the device will show and what it showed.
* `approver` — the `Approver` trait, `SpeculosApprover`,
`HumanApprover`, and `while_reviewing`, which runs the blocking
instruction on one thread while the review is answered on another.
* `tests/speculos_review.rs` — five scenarios, `#[ignore]`d like the
rest of the device tests, passing on `nanosplus` and `stax` under both
seeds.
* `examples/human_review.rs` — the same scenario against real hardware,
with an operator as the assertion oracle.

The comparison is an **equality**, not a containment. Containment passes
a device that shows the expected address followed by something else, and
that is exactly the difference the screen exists to reveal; equality
also makes an unasked-for `Payment ID` row impossible to miss.

Every wait blocks on the event stream. No `sleep`, no retry loop: the
nonce store and the script-offset context are precisely the state a
second attempt disturbs, so a retry-green test has usually destroyed the
evidence it was ever red. A wait that runs out dumps the full event log,
the last screen, and a PNG of it. The simulator is not restarted between
... (continued)

Coverage Stats

2 of 2 new or added lines in 1 file covered. (100.0%)

1012 existing lines in 31 files now uncovered.

85530 of 137540 relevant lines covered (62.19%)

318029.51 hits per line