Present both apps as Tether Wallet and document what a clone needs

The Prime app shares no code with WDK — it re-implements transaction parsing
in Rust — so naming it after the SDK overstated the relationship. Both apps
now present as Tether Wallet.

User-visible strings only. Identifiers stay as they are, and the README now
explains why: the Prime appId seeds GetAppSeed, so renaming it derives a
different wallet and orphans any funded account, and changing the Android
package or storage keys discards a user's pairing and history.

Documentation gaps that would have blocked a fresh clone:

- mobile/.env.example listed four variables that nothing in the codebase
  reads, and omitted all three that it does. It would have sent someone to
  obtain a WDK API key and Tron credentials they do not need.
- The arm-none-eabi toolchain was never listed as a prerequisite even though
  the Xous build has always required it, and the firmware script now refuses
  to run without arm-none-eabi-ar.
- Chain-derived history, its Blockscout dependency, and the override were
  undocumented, as was the fact that a refresh discloses wallet addresses to
  those indexers. That disclosure is now recorded in docs/SECURITY.md, along
  with why indexer responses cannot influence signing.
- The Bitcoin endpoint silently selects testnet3 or testnet4, since tb1
  addresses and the derivation path are identical on both.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: BitcoinQnA

README.md

@@ -16,6 +16,20 @@ authoritative review, and signs only after an approval gesture.
 > not send mainnet assets, real USD₮, real BTC, or production secrets to this
 > software.
 
+## A note on naming
+
+Both applications present to the user as **Tether Wallet**. "WDK" survives
+throughout the code as identifiers — the `gui-app-tether-wdk` crate, the
+Android package `com.foundationdevices.tetherwdkpassport`, the `Wdk*`
+QuantumLink message types, and the stored-preference keys. Those are
+deliberately frozen: the Prime `appId` seeds `GetAppSeed`, so renaming it
+derives a different wallet and orphans any funded account, and changing the
+Android package or storage keys discards a user's pairing and history.
+
+Note also that WDK itself runs only on the phone. The Prime app shares no code
+with it and re-implements transaction parsing independently, which is what
+makes its review screen a second opinion rather than an echo.
+
 ## Compatibility
 
 The current integration is pinned, built, and tested against:
@@ -82,6 +96,12 @@ and local environment files are intentionally ignored.
 - Android SDK 36, NDK 27, and an arm64 Android device for BLE testing
 - Rust plus `aarch64-linux-android`
 - `cargo-ndk` and the UniFFI tooling used by the native module
+- The `arm-none-eabi` GNU toolchain on `PATH`, for Prime firmware builds.
+  KeyOS pins `CC` for the Xous target but not `AR`, so
+  `scripts/build_prime_firmware.sh` pins `AR_armv7a_unknown_xous_elf` itself
+  and refuses to run without `arm-none-eabi-ar`. Without that pin the host
+  archiver produces an empty micro-ecc archive and the recovery image fails to
+  link on undefined `uECC_*` symbols.
 
 KeyOS carries its own pinned Rust toolchain, which Rustup selects when commands
 run from inside its checkout.
@@ -175,7 +195,20 @@ Never commit that file.
 
 The companion uses `https://mempool.space/testnet/api` for Bitcoin Testnet by
 default. Override it with `EXPO_PUBLIC_BITCOIN_TESTNET_API` when using another
-Esplora-compatible testnet service.
+Esplora-compatible testnet service. That endpoint selects the chain: `tb1`
+addresses and the `m/84'/1'/0'/0/0` path are identical on testnet3 and
+testnet4, so pointing it at a testnet4 host switches chains silently and
+testnet3 coins stop appearing.
+
+Transaction history is read from public indexers rather than accumulated
+locally, so receives appear at all. Sepolia history comes from
+`https://eth-sepolia.blockscout.com`, overridable with
+`EXPO_PUBLIC_SEPOLIA_EXPLORER_API`, and Bitcoin history from the same Esplora
+endpoint as balances. A refresh discloses the wallet addresses to those
+services. Token history is restricted to the allowlisted test USD₮ contract so
+a look-alike token cannot write entries into the list.
+
+All overrides live in `mobile/.env.example`.
 
 ## Build the Passport Prime app
 
@@ -237,7 +270,7 @@ a distributable or hardware-test image.
 ## Run the POC
 
 1. Install the Android APK on an arm64 handset.
-2. Install the developer-signed Tether WDK app or complete developer firmware
+2. Install the developer-signed Tether Wallet app or complete developer firmware
    on a Passport Prime running KeyOS 1.3.0.
 3. Open Tether Wallet on Passport Prime and complete its wallet onboarding.
 4. In the Android app, choose Passport, grant camera/Bluetooth permissions, and

docs/ARCHITECTURE.md

@@ -12,7 +12,7 @@ flowchart LR
     BP --> RN
     RN --> BLE["BLE Nordic UART"]
     BLE --> QS["KeyOS QuantumLink service"]
-    QS --> PA["Tether WDK Prime app"]
+    QS --> PA["Tether Wallet Prime app"]
     PA --> KD["KeyOS per-app seed + BIP32"]
     PA --> RV["Policy parser + device review"]
     EVM --> RPC["Sepolia JSON-RPC"]

docs/DEMO_RUNBOOK.md

@@ -41,8 +41,8 @@ adb install -r artifacts/tether-wdk-passport-arm64-poc.apk
 
 ## Pair
 
-1. Open **Tether WDK** on Passport Prime and unlock the device if asked.
-2. Open **Tether WDK for Passport** on Android.
+1. Open **Tether Wallet** on Passport Prime and unlock the device if asked.
+2. Open **Tether Wallet** on Android.
 3. Tap **Pair Passport Prime** once. Accept the camera permission first, then
    the nearby-device permission. The scanner opens automatically after both
    dialogs settle.

docs/SECURITY.md

@@ -59,6 +59,22 @@ zeroizing storage; derived BIP32 private fields and the signing key are erased
 after use. The phone identity is encrypted with an AES-GCM key held by Android
 Keystore. Public pairing metadata is stored separately.
 
+## Network disclosure
+
+The phone reaches three public testnet services: a Sepolia JSON-RPC, an Esplora
+Bitcoin Testnet API, and a Blockscout instance for Sepolia history. Balance and
+history refreshes disclose the wallet's EVM and Bitcoin addresses to whichever
+hosts are configured, which links those addresses to the device's IP. That is
+acceptable for a testnet POC and is not acceptable for production; a real
+deployment needs self-hosted or privacy-preserving indexers.
+
+Indexer responses are untrusted display data. They never influence signing:
+Passport Prime derives its own addresses and re-parses every transaction it is
+asked to sign, so a hostile or compromised indexer can mislead the history
+screen but cannot cause a transfer. Token history is filtered to the
+allowlisted test USD₮ contract, because any address can deploy a token that
+claims to be USD₮ and airdrop it to produce convincing entries.
+
 ## Dependency posture
 
 Package versions are locked. As validated on 24 July 2026,

mobile/.env.example

@@ -1,4 +1,16 @@
-EXPO_PUBLIC_WDK_INDEXER_BASE_URL=https://wdk-api.tether.io
-EXPO_PUBLIC_WDK_INDEXER_API_KEY=PUT_WDK_API_KEY_HERE
-EXPO_PUBLIC_TRON_API_KEY=PUT_HERE
-EXPO_PUBLIC_TRON_API_SECRET=PUT_HERE
+# Every value below is optional and testnet-only. The app runs without this
+# file; copy it to .env only to point at different public endpoints.
+# Never commit .env.
+
+# Ethereum Sepolia JSON-RPC used for balances, gas, and broadcast.
+EXPO_PUBLIC_SEPOLIA_RPC_URL=https://ethereum-sepolia-rpc.publicnode.com
+
+# Esplora-compatible Bitcoin Testnet API. Must be testnet3: the app derives
+# m/84'/1'/0'/0/0 and tb1 addresses encode identically on testnet3 and
+# testnet4, so pointing this at a testnet4 host silently switches chains.
+EXPO_PUBLIC_BITCOIN_TESTNET_API=https://mempool.space/testnet/api
+
+# Blockscout instance used to read Sepolia transaction history. Receives never
+# reach the phone, so history is read back from an indexer; a refresh discloses
+# the wallet address to this host.
+EXPO_PUBLIC_SEPOLIA_EXPLORER_API=https://eth-sepolia.blockscout.com

mobile/README.md

@@ -1,4 +1,4 @@
-# Tether WDK for Passport Android app
+# Tether Wallet Android companion
 
 This Expo/React Native application is a focused fork of Tether's WDK starter. It
 demonstrates WDK through a Tether-branded Ethereum Sepolia and Bitcoin Testnet

mobile/app.json

@@ -1,6 +1,6 @@
 {
   "expo": {
-    "name": "Tether WDK for Passport",
+    "name": "Tether Wallet",
     "slug": "tether-wdk-passport",
     "version": "1.0.0",
     "orientation": "portrait",

mobile/modules/quantumlink/android/src/main/java/com/foundationdevices/passport/wdk/quantumlink/PassportQuantumLinkModule.kt

@@ -420,14 +420,14 @@ class PassportQuantumLinkModule : Module() {
               "pair_stale_peer",
               "Passport Prime did not answer. This phone was paired to a different " +
                 "Passport identity, and Passport may still hold that connection. " +
-                "Remove the Tether WDK connection in Passport's settings, then scan again.",
+                "Remove the Tether Wallet connection in Passport's settings, then scan again.",
               null
             )
           } else {
             promise.reject(
               "pair_timeout",
               "Passport Prime did not answer the pairing request. If Passport already " +
-                "lists a Tether WDK connection, remove it in Passport's settings and " +
+                "lists a Tether Wallet connection, remove it in Passport's settings and " +
                 "scan again.",
               null
             )

mobile/src/app/onboarding/index.tsx

@@ -207,7 +207,7 @@ export default function PassportOnboardingScreen() {
         : 'Scan secure identity';
   const instruction =
     phase === 'static'
-      ? 'Scan the first QR code shown by the Tether WDK app on Passport.'
+      ? 'Scan the first QR code shown by the Tether Wallet app on Passport.'
       : phase === 'connecting'
         ? 'Keep both devices nearby while Bluetooth connects.'
         : 'Passport now shows an animated identity code. Hold steady while all frames are read.';
@@ -232,11 +232,11 @@ export default function PassportOnboardingScreen() {
               style={styles.heroMark}
             />
           </View>
-          <Text style={styles.eyebrow}>WDK HARDWARE WALLET</Text>
+          <Text style={styles.eyebrow}>PASSPORT HARDWARE WALLET</Text>
           <Text style={styles.heading}>Your keys stay on Passport Prime.</Text>
           <Text style={styles.body}>
-            Pair over encrypted Bluetooth with QuantumLink, then use Tether WDK to view and transfer
-            Sepolia ETH and USD₮. Every transaction is reviewed and approved on Passport.
+            Pair over encrypted Bluetooth with QuantumLink, then use Tether Wallet to view and
+            transfer Sepolia ETH and USD₮. Every transaction is reviewed and approved on Passport.
           </Text>
           <View style={styles.featureCard}>
             <Feature
@@ -338,7 +338,7 @@ export default function PassportOnboardingScreen() {
           </Text>
           <Text style={styles.body}>
             {phase === 'complete'
-              ? `${deviceName} is ready to authorize Tether WDK transactions.`
+              ? `${deviceName} is ready to authorize Tether Wallet transactions.`
               : 'Exchanging encrypted QuantumLink identities with Passport Prime.'}
           </Text>
         </View>

mobile/src/app/send/details.tsx

@@ -285,7 +285,7 @@ export default function SendScreen() {
               <Text style={styles.modalSubtitle}>
                 {stage === 'signing'
                   ? 'Compare the details below with Passport Prime, then slide to approve on the device.'
-                  : `WDK prepared this ${quote?.asset === 'BTC' ? 'Bitcoin testnet' : 'Sepolia'} transfer. Passport will independently reconstruct and review it.`}
+                  : `Your phone prepared this ${quote?.asset === 'BTC' ? 'Bitcoin testnet' : 'Sepolia'} transfer. Passport will independently reconstruct and review it.`}
               </Text>
               <View style={styles.reviewCard}>
                 <ReviewRow label="Asset" value={quote?.asset ?? ''} />
@@ -357,7 +357,7 @@ function ResultView({ result, onDone }: { result: PassportActivity; onDone(): vo
       </Text>
       <Text style={styles.modalTitle}>Transfer submitted</Text>
       <Text style={styles.modalSubtitle}>
-        Passport Prime approved the transaction and Tether WDK broadcast the signed payload.
+        Passport Prime approved the transaction and Tether Wallet broadcast the signed payload.
       </Text>
       <View style={styles.hashCard}>
         <Text style={styles.reviewLabel}>TRANSACTION HASH</Text>