Merge branch 'develop' into fix/reproducibility-audit-findings

Author: ethicnology

.github/workflows/bullock.yml

@@ -76,7 +76,11 @@ jobs:
     # Write-access gating happens twice: the first step fails fast for
     # non-write actors, and claude-code-action enforces it again internally —
     # this `if` just avoids spinning a runner on unrelated comments.
-    if: contains(github.event.comment.body, '@bullock')
+    # The Bot filter matters because GITHUB_TOKEN comments never retrigger
+    # workflows (GitHub anti-recursion) but GitHub-App comments DO: a claude.yml
+    # review quoting "@bullock" from the thread would otherwise spin a runner
+    # and die red at the access gate — noise on the PR, wasted runner.
+    if: contains(github.event.comment.body, '@bullock') && github.event.comment.user.type != 'Bot'
     runs-on: ubuntu-24.04
     # analyze_and_test's checks job needs ~30min for setup + `make checks` alone;
     # Bullock adds Claude's implement/verify loop on top of the same prefix.
@@ -213,6 +217,13 @@ jobs:
       # format, and Write the verdict sentinel.
       - name: Bullock (Claude Code)
         if: steps.src.outputs.cross != 'true'
+        # Step-level timeout on purpose: the job-level 60min timeout CANCELS the
+        # job, and "Act on Bullock's verdict" is guarded by !cancelled() — so a
+        # job timeout would be a silent red run with no comment. A step timeout
+        # merely FAILS this step, which degrades to the no-valid-verdict comment.
+        # Budget: ~6min gate+setup before this step + 45 here + ~2 of git/PR
+        # plumbing after stays under the job's 60.
+        timeout-minutes: 45
         uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -272,6 +283,7 @@ jobs:
 
             ## Step 4 — Implement (ONLY if sufficient)
             - Change ONLY what was requested. No opportunistic refactors, no unrelated cleanup.
+            - NEVER modify anything under `.github/` (workflows, actions, CI config) — the workflow refuses to commit such changes. If the request requires a CI change, treat it as insufficient and say so in "question".
             - Follow AGENTS.md strictly: use `fvm`; respect the layer/facade/failure/naming rules; NEVER log or expose secrets (mnemonic/seed/xpriv/PIN); no hardcoded user-facing strings (use `context.loc.*`); no raw colors.
             - After editing, format your new/changed Dart files so the CI format gate can't fail on untracked files:
               run `fvm dart format` on the files you touched, then `git add -A` for the changed source (do NOT add `.bullock/`).
@@ -319,7 +331,10 @@ jobs:
 
           if [ "$sufficient" != "true" ]; then
             body="🐂 Bullock needs more info before implementing:"
-            body="${body}"$'\n\n'"> ${question:-Please clarify what you'd like changed.}"
+            # NB: no apostrophes inside ${var:-word} — bash treats a single
+            # quote there as a quoting char even inside double quotes, which
+            # made this whole script unparseable (exit 2 at EOF).
+            body="${body}"$'\n\n'"> ${question:-Please clarify what you would like changed.}"
             comment "$body"
             echo "Insufficient info — asked for clarification, no PR opened."
             exit 0
@@ -329,22 +344,27 @@ jobs:
           git config user.name "bullock[bot]"
           git config user.email "bullock@users.noreply.github.com"
 
-          # GITHUB_TOKEN cannot push changes under .github/workflows/ — the push
-          # (below) would be rejected AFTER commit, going red with no feedback.
-          # Bail early with an explanation. This is also a deliberate backstop
-          # against Bullock modifying its own workflow. `git status --porcelain`
-          # reports both tracked edits and new untracked files, and is checked
-          # before staging so a workflow-file change never enters the commit.
-          if [ -n "$(git status --porcelain -- .github/workflows)" ]; then
-            comment "🐂 Bullock's changes touch \`.github/workflows/\`, which a bot token isn't allowed to push. Please make workflow changes manually."
-            echo "Workflow files touched — declined (GITHUB_TOKEN cannot push workflows)."
+          # ALL of .github/ is off-limits to Bullock, for two distinct reasons:
+          # - .github/workflows/: GITHUB_TOKEN cannot push these — the push
+          #   (below) would be rejected AFTER commit, going red with no feedback.
+          # - the rest (.github/actions/ composite, CI config): the token CAN
+          #   push them, but they execute in future CI runs with secrets — a
+          #   prompt-injected change here must be blocked mechanically, not just
+          #   by the prompt's SECURITY section. Bullock has no legitimate reason
+          #   to touch CI; a maintainer changes it manually.
+          # `git status --porcelain` reports both tracked edits and new
+          # untracked files, and is checked before staging so a CI-file change
+          # never enters the commit.
+          if [ -n "$(git status --porcelain -- .github)" ]; then
+            comment "🐂 Bullock's changes touch \`.github/\` (workflows or CI config), which Bullock isn't allowed to modify. Please make CI changes manually."
+            echo "CI files touched — declined (.github/ is off-limits to Bullock)."
             exit 0
           fi
 
           # Stage only source changes; never sweep the whole tree (build_runner
           # drift, make side effects, stray artifacts) into the stacked PR, and
-          # never stage workflow files (guarded above).
-          git add -A -- ':(exclude).github/workflows'
+          # never stage CI files (guarded above).
+          git add -A -- ':(exclude).github'
 
           if git diff --cached --quiet; then
             comment "🐂 Bullock judged the request actionable but produced no changes. Please re-summon with a more specific instruction."

.gitignore

@@ -115,7 +115,7 @@ CLAUDE.md
 # sentry-native build artifacts pulled by sentry_flutter on Linux
 .sentry-native/
 
-# Generated integration-test aggregator (see tool/gen_all_test.dart)
+# Generated integration-test aggregator (see tools/gen_all_test.dart)
 integration_test/all_test.dart
 
 # Generated swap debug log export (written during test runs)

AGENTS.md

@@ -171,7 +171,7 @@ Workflow when you need a widget:
 3. **If genuinely new and reused by ≥ 2 features**, put it in `lib/core/widgets/<category>/` from the start — that *is* growing the UI Kit.
 4. **If used by exactly one feature**, it lives in `<feature>/ui/widgets/` — but write it composable enough to be promoted later (no hardcoded colors, no hardcoded text, take callbacks not bloc refs).
 5. **Widgets never live under `adapters/`, `frameworks/`, `domain/`, or `application/`.** UI goes in `ui/` or `lib/core/widgets/`. Full stop.
-6. **No hardcoded user-facing strings.** Always `context.loc.<key>` — the `BuildContext` extension (`build_context_x.dart`) that wraps `AppLocalizations.of(context)`; it is the dominant convention (≈2564 uses vs 3 raw `AppLocalizations.of`). Add the key to [`localization/`](localization/) and run `make translations`. A duplicated literal across screens means a missing l10n key.
+6. **No hardcoded user-facing strings.** Always `context.loc.<key>` — the `BuildContext` extension (`build_context_x.dart`) that wraps `AppLocalizations.of(context)`; it is the dominant convention (≈2564 uses vs 3 raw `AppLocalizations.of`). Manage keys in [`localization/`](localization/) with [`tools/arb.dart`](tools/README.md) (`fvm dart run tools/arb.dart help`) — don't hand-edit the `.arb` files — then run `make translations`. A duplicated literal across screens means a missing l10n key.
 7. **Theme tokens only** — colors, spacing, typography pulled from the theme. See rule #10 above.
 
 When you spot a duplicate of an existing core widget in feature code, flag it in the PR description as a follow-up cleanup. Don't silently leave it. Don't fix unrelated duplicates in the same PR either — that breaks atomic commits.

Containerfile.tools

@@ -190,15 +190,21 @@ RUN fvm install ${FLUTTER_VERSION} --verbose --no-setup
 RUN fvm global ${FLUTTER_VERSION}
 ENV PATH="/home/$USER/fvm/default/bin:${PATH}"
 
+
 # Download Android cmdline-tools
-RUN sudo wget -q https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_CMDLINE_TOOLS_VERSION}_latest.zip -O /tmp/android-cmdline-tools.zip
+# (USER root instead of sudo: setuid binaries are unreliable under rootless
+# podman user namespaces — sudo fails with "account validation failure" —
+# and are unnecessary at build time since USER switching achieves the same.)
+USER root
+RUN wget -q https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_CMDLINE_TOOLS_VERSION}_latest.zip -O /tmp/android-cmdline-tools.zip
 
 # Set up Android SDK
-RUN sudo mkdir -p ${ANDROID_HOME}/cmdline-tools
-RUN sudo unzip -q /tmp/android-cmdline-tools.zip -d ${ANDROID_HOME}/cmdline-tools
-RUN sudo mv ${ANDROID_HOME}/cmdline-tools/cmdline-tools ${ANDROID_HOME}/cmdline-tools/latest
-RUN sudo rm /tmp/android-cmdline-tools.zip
-RUN sudo chown -R $USER ${ANDROID_HOME}
+RUN mkdir -p ${ANDROID_HOME}/cmdline-tools
+RUN unzip -q /tmp/android-cmdline-tools.zip -d ${ANDROID_HOME}/cmdline-tools
+RUN mv ${ANDROID_HOME}/cmdline-tools/cmdline-tools ${ANDROID_HOME}/cmdline-tools/latest
+RUN rm /tmp/android-cmdline-tools.zip
+RUN chown -R $USER ${ANDROID_HOME}
+USER $USER
 
 # Install Android SDK components
 RUN yes | sdkmanager --sdk_root=${ANDROID_HOME} --licenses

integration_test/coins_test.dart

@@ -33,7 +33,7 @@ import 'package:flutter_test/flutter_test.dart';
 //      wallet's real UTXOs and asserts the confirmations/labels fields the view
 //      renders. Needs a funded testnet wallet → skipped when absent.
 //
-// Run via `make integration-test` (auto-aggregated by tool/gen_all_test.dart).
+// Run via `make integration-test` (auto-aggregated by tools/gen_all_test.dart).
 Future<void> main({bool isInitialized = false}) async {
   TestWidgetsFlutterBinding.ensureInitialized();
   if (!isInitialized) await Bull.init();