@ducat-unit/wallet-snap 0.1.2 → 0.1.5

package/AUDIT_SCOPE.md

@@ -1,11 +1,11 @@
 # Ducat Snap Audit Scope
 
-This file defines the minimum security review scope before publishing `@ducat-unit/wallet-snap` or submitting it for MetaMask allowlisting.
+This file defines the minimum security review scope before MetaMask allowlisting for `@ducat-unit/wallet-snap@0.1.5`.
 
 ## In Scope
 
 - `snap.manifest.json` permissions and allowed origins.
-- BIP32 entropy use for `m/84'/1'` and `m/86'/1'`.
+- BIP32 entropy use for `m/84'/0'`, `m/86'/0'`, `m/84'/1'`, and `m/86'/1'`.
 - Local BIP32 child derivation in `src/bip32.ts`.
 - Account derivation in `src/accounts.ts`.
 - BIP322-style message signing in `src/message.ts`.
@@ -17,7 +17,7 @@ This file defines the minimum security review scope before publishing `@ducat-un
 - User confirmation content in `src/confirmations.ts`.
 - State storage in `src/state.ts`.
 - Home page network fetches in `src/home.ts`.
-- Build artifacts produced by `npm run verify`.
+- Build artifacts produced by `npm run verify:release`.
 
 ## Required Findings To Rule Out
 
@@ -25,7 +25,7 @@ This file defines the minimum security review scope before publishing `@ducat-un
 - Any signing path that signs an input not explicitly listed in `signInputs`.
 - Any signing path that signs inputs for addresses not derived by the Snap.
 - Any irreversible operation that can proceed without a MetaMask confirmation.
-- Any mainnet key path, address, broadcast endpoint, or signing support in V1.
+- Any mainnet request that uses a testnet key path, testnet address, or testnet broadcast endpoint, and any testnet request that uses a mainnet key path, mainnet address, or mainnet broadcast endpoint.
 - Any unauthorized origin able to invoke Snap RPC methods.
 - Any malformed PSBT, wrong-network PSBT, unknown address, or unknown input index that is accepted.
 - Any package dependency that violates MetaMask Snap SES constraints or creates avoidable key-management risk.
@@ -40,7 +40,7 @@ The final audit package should include:
 - Fixed commit hash, if fixes are required.
 - `npm pack --dry-run` output.
 - `npm audit --omit=dev` output.
-- `npm run verify` output.
+- `npm run verify:release` output.
 - Snapper/security scan output.
 - Final `snap.manifest.json` shasum.
 - Demo video URL following `DEMO_SCRIPT.md`.

package/DEMO_SCRIPT.md

@@ -6,8 +6,8 @@ Use this script for the MetaMask allowlist/directory submission video. Record ag
 
 1. Build and serve the Snap with `npm run verify` and `npm run serve`.
 2. Configure the Ducat frontend with `NEXT_PUBLIC_DUCAT_SNAP_ID` pointing at the local Snap during pre-submission testing, or `npm:@ducat-unit/wallet-snap` for the npm build.
-3. Use signet or mutinynet only.
-4. Fund the Snap-derived sats account with test BTC.
+3. Use the audited network being demonstrated. For mainnet demos, use small controlled amounts and the audited production validator/frontend configuration.
+4. Fund the Snap-derived sats account with BTC for the selected network.
 
 ## Recording Steps
 
@@ -31,5 +31,5 @@ Use this script for the MetaMask allowlist/directory submission video. Record ag
 - Every irreversible signing action shows a MetaMask confirmation.
 - Confirmations include origin, network, signed input indexes, output summary, and fee when calculable.
 - Private keys are never exported or shown.
-- Mainnet is not available in the V1 manifest or UI.
+- Mainnet, signet, and mutinynet all use the expected network-specific addresses, validator endpoints, and broadcast endpoints.
 - Xverse and UniSat remain available in the wallet list.

package/LISTING.md

@@ -6,16 +6,16 @@ Ducat Bitcoin accounts and Ducat-aware transaction signing in MetaMask.
 
 ## Long Description
 
-Ducat is a MetaMask Snap for using Ducat with Bitcoin signet and mutinynet accounts derived inside MetaMask. The Snap derives deterministic testnet Bitcoin accounts from the user's MetaMask Secret Recovery Phrase, keeps private keys inside MetaMask, and signs only explicit PSBT inputs requested by the Ducat web app.
+Ducat is a MetaMask Snap for using Ducat with Bitcoin mainnet, signet, and mutinynet accounts derived inside MetaMask. The Snap derives deterministic Bitcoin accounts from the user's MetaMask Secret Recovery Phrase, keeps private keys inside MetaMask, and signs only explicit PSBT inputs requested by the Ducat web app.
 
 The Ducat web app remains the action surface for create, deposit, borrow, repay, withdraw, swap, liquidation, and repossess flows. The Snap provides account discovery, BIP322-style message signing, PSBT signing, batch PSBT signing, a simple transfer path, Ducat-aware MetaMask confirmations, pending/completed/failed action notifications, recent action history, and a Snap home page with copyable account addresses, BTC/UNIT balance, vault summary lookups, recent activity, and Ducat app routes.
 
-Mainnet is intentionally not enabled in this release.
+Mainnet is enabled in this audit candidate and must be covered by the third-party review before production distribution.
 
 ## Permissions Rationale
 
 - `endowment:rpc`: Allows only approved Ducat frontend origins to invoke the Snap.
-- `snap_getBip32Entropy`: Derives Bitcoin testnet account keys for `m/84'/1'` and `m/86'/1'`.
+- `snap_getBip32Entropy`: Derives Bitcoin account keys for `m/84'/0'`, `m/86'/0'`, `m/84'/1'`, and `m/86'/1'`.
 - `snap_dialog`: Shows mandatory confirmations before message signing, PSBT signing, batch signing, or transfers.
 - `snap_manageState`: Stores recent Ducat action metadata for Snap home.
 - `snap_notify`: Shows informational MetaMask notifications for pending approvals, completed actions, and failed non-rejection actions.
@@ -28,7 +28,7 @@ Mainnet is intentionally not enabled in this release.
 - Install approval screen for the Ducat Snap.
 - Ducat app wallet modal showing MetaMask as a connector.
 - Connected Ducat account addresses.
-- PSBT confirmation for create or deposit showing an action title, origin, testnet network, compact summary rows, signed input details, output details, fees, warnings, and Ducat app metadata.
+- PSBT confirmation for create or deposit showing an action title, origin, network, compact summary rows, signed input details, output details, fees, warnings, and Ducat app metadata.
 - Batch confirmation for liquidation or repossess showing all-or-nothing signing, per-transaction rows, total fee, and warnings.
 - Message signing confirmation showing origin, network, signing account, BIP322 signature type, message fingerprint, message length, and copyable message body.
 - Transfer confirmation showing amount, fee, the `You pay` amount, change, sender, recipient, selected UTXOs, and broadcast endpoint.

package/README.md

@@ -1,242 +1,164 @@
 # Ducat MetaMask Snap
 
-`@ducat-unit/wallet-snap` is the Ducat Bitcoin account and signing Snap for MetaMask.
+`@ducat-unit/wallet-snap` is the Ducat Bitcoin account and signing Snap for MetaMask. It derives deterministic mainnet, signet, and mutinynet Bitcoin accounts from the user's MetaMask Secret Recovery Phrase, keeps private keys inside MetaMask, and exposes a narrow Ducat JSON-RPC API to approved Ducat frontend origins.
 
-The Snap derives deterministic Bitcoin testnet accounts from the user's MetaMask Secret Recovery Phrase and exposes a small Ducat JSON-RPC API to the Ducat frontend. The Ducat web app remains the action surface. Users create, deposit, borrow, repay, withdraw, swap, and liquidate in the web app; the Snap handles account derivation, MetaMask confirmations, PSBT/message signing, transfer signing, recent action state, action notifications, and a Snap home page.
+The Ducat web app remains the user action surface. Users create, deposit, borrow, repay, withdraw, swap, liquidate, and repossess in the web app; the Snap handles account discovery, MetaMask confirmations, message signing, PSBT signing, batch signing, transfer signing, recent action state, notifications, and Snap Home.
 
-## Launch Scope
+## Release Candidate Status
 
+- Package candidate: `@ducat-unit/wallet-snap@0.1.5`
+- Snap ID: `npm:@ducat-unit/wallet-snap`
 - Proposed Snap name: `Ducat`
-- npm package: `@ducat-unit/wallet-snap`
-- Snap ID after publish: `npm:@ducat-unit/wallet-snap`
-- Local development Snap ID: `local:http://localhost:8080`
-- V1 networks: `signet` and `mutinynet`
-- Mainnet: intentionally disabled until audit, soak testing, and allowlist approval
-- Derivation paths:
-  - sats: `m/84'/1'/0'/0/0`, P2WPKH `tb1q...`, compressed 33-byte public key
-  - runes: `m/86'/1'/0'/0/0`, P2TR `tb1p...`, x-only 32-byte internal public key
-  - vault: `m/86'/1'/0'/0/1`, P2TR `tb1p...`, x-only 32-byte internal public key
+- Audit candidate tag: `audit-candidate-0.1.5-20260615-audit-confirmation-hardening`
+- Audit candidate commit: tag target for `audit-candidate-0.1.5-20260615-audit-confirmation-hardening`
+- GitHub verification: `Verify Ducat Snap`
+- Manifest source shasum: `RE0s+LP6Soq0Xn0R8P+DA2ChhPOB2pasPp9BsJng5/Y=`
+- Package candidate digest evidence: `RELEASE_EVIDENCE.md`
 
-## Requirements
+Launch scope:
 
-- Node.js and npm. The repo is currently verified with the bundled Codex Node runtime, Node `24.14.0`.
-- MetaMask with Snaps support.
-- For `local:http://localhost:8080`, MetaMask must allow local Snap fetching. If MetaMask shows `Fetching local snaps is disabled`, enable local Snap development in MetaMask/Flask developer settings, then retry the install/update.
-- A Ducat frontend checkout configured to use this Snap. The current integration branch uses `/Users/lucasrodriguez/Desktop/Ducat/frontend-metamask-snap`.
+- Networks: `mainnet`, `signet`, and `mutinynet`
+- Mainnet: enabled in this audit candidate
+- Derivation paths:
+  - sats mainnet: `m/84'/0'/0'/0/0`, P2WPKH `bc1q...`, compressed 33-byte public key
+  - runes mainnet: `m/86'/0'/0'/0/0`, P2TR `bc1p...`, x-only 32-byte internal public key
+  - vault mainnet: `m/86'/0'/0'/0/1`, P2TR `bc1p...`, x-only 32-byte internal public key
+  - sats testnet: `m/84'/1'/0'/0/0`, P2WPKH `tb1q...`, compressed 33-byte public key
+  - runes testnet: `m/86'/1'/0'/0/0`, P2TR `tb1p...`, x-only 32-byte internal public key
+  - vault testnet: `m/86'/1'/0'/0/1`, P2TR `tb1p...`, x-only 32-byte internal public key
 
 ## Install
 
 ```bash
-cd /Users/lucasrodriguez/Desktop/Ducat/SNAP
 npm ci
 ```
 
-## Verify
-
-Use the normal development gate while editing:
+Recommended local edit gate:
 
 ```bash
 npm run type-check
-npm test
+npm test -- --runInBand
 npm run build
 npm run manifest
-```
-
-Or run the combined gate:
-
-```bash
-npm run verify
-```
-
-After `npm run verify`, smoke-test the built Snap in MetaMask's simulation runtime:
-
-```bash
 npm run harness:accounts
+npm run harness:smoke-signing
 ```
 
-The harness serves the local Snap, installs it with a deterministic test Secret Recovery Phrase, and invokes `ducat_getAccounts`.
-
-The stricter release gate also runs the MetaMask simulation harness smoke test, production dependency audit, Snapper, and an npm package dry-run:
+Full release gate:
 
 ```bash
 npm run verify:release
 ```
 
+`verify:release` runs type checking, Jest, build, manifest regeneration, MetaMask simulation harness checks, production dependency audit, Snapper, release metadata verification, release manifest verification, and `npm pack --dry-run`.
+
 ## Run Locally
 
-Serve the Snap manifest and bundle:
+Serve the local Snap:
 
 ```bash
-cd /Users/lucasrodriguez/Desktop/Ducat/SNAP
 npm run serve
 ```
 
-The Snap is served from:
+The local Snap is served at:
 
 ```text
 http://localhost:8080
 ```
 
-Every source, dependency, or icon change can change `snap.manifest.json`'s `source.shasum`. After changing the Snap, run:
-
-```bash
-npm run build
-npm run manifest
-```
-
-Then restart `npm run serve` if the server is already running.
-
-## Frontend Setup
-
-In the Ducat frontend `.env.local`, point the MetaMask connector at the local Snap:
+For local frontend testing:
 
 ```bash
 NEXT_PUBLIC_DUCAT_SNAP_ID="local:http://localhost:8080"
 NEXT_PUBLIC_DUCAT_SNAP_VERSION=""
 ```
 
-For the published Snap, use:
+For the published Snap:
 
 ```bash
 NEXT_PUBLIC_DUCAT_SNAP_ID="npm:@ducat-unit/wallet-snap"
-NEXT_PUBLIC_DUCAT_SNAP_VERSION="^0.1.2"
+NEXT_PUBLIC_DUCAT_SNAP_VERSION="^0.1.5"
 ```
 
-Run the frontend on an origin allowed by `snap.manifest.json`, for example:
+Allowed HTTPS Ducat origins in the published mainnet manifest:
 
-```bash
-cd /Users/lucasrodriguez/Desktop/Ducat/frontend-metamask-snap
-npm run dev -- -p 3002
-```
-
-Allowed local origins are:
-
-- `http://localhost:3000`
-- `http://localhost:3001`
-- `http://localhost:3002`
-- `http://localhost:3003`
-
-Allowed HTTPS QA origins are:
-
-- `https://dev-git-feat-metamask-snap-connector-ducat.vercel.app`
-
-These localhost origins are intentionally present for local development and Snap QA only. Do not remove them from the development manifest during local testing.
-
-### Known Deferred Issue: Localhost Manifest Origins
-
-`snap.manifest.json` currently includes localhost origins. That is intentional for local Snap development and QA, but the current development manifest is not directory-ready. Do not remove the localhost origins in this iteration; handle this as a dedicated release-manifest task before MetaMask submission.
-
-Release update plan:
-
-1. Keep the current development manifest available for local Snap testing.
-2. Add a release manifest path or manifest-generation mode that removes every localhost origin.
-3. Keep only approved HTTPS Ducat frontend origins in `endowment:rpc.allowedOrigins`.
-4. Rebuild from the audited commit and regenerate the Snap manifest source shasum.
-5. Update all release artifacts from that exact build: `RELEASE_EVIDENCE.md`, `AUDITOR_HANDOFF.md`, `submission/metamask-directory.json`, `submission/ALLOWLIST_SUBMISSION.md`, package shasum/integrity, screenshots, demo notes, and frontend production Snap env values.
-6. Run `npm run build`, `npm run manifest`, `npm run verify:release-manifest`, `npm run verify:release`, and `npm run verify:submission-ready`.
-7. Retag the final audit or submission candidate only after the release manifest, package evidence, and submission metadata are synced.
-
-## MetaMask Local Update Flow
+- `https://app.ducatprotocol.com`
+- `https://dev.app.ducatprotocol.com`
+- `https://staging.app.ducatprotocol.com`
 
-1. Run `npm run serve` in this repo.
-2. Run the frontend with `NEXT_PUBLIC_DUCAT_SNAP_ID="local:http://localhost:8080"`.
-3. Connect MetaMask from the Ducat wallet picker.
-4. If the Snap was already installed and the local shasum changed, use the frontend `Update Snap` button in the wallet picker or connected wallet dropdown.
-5. Approve the MetaMask update prompt.
-6. Retry the Ducat action.
-
-The connector intentionally does not call `wallet_requestSnaps` before every signature. Signing methods use `wallet_invokeSnap` against the installed Snap, so a stale local build must be updated explicitly.
+The published manifest authorizes only stable, org-controlled HTTPS Ducat origins. Local development (`http://localhost`) and ephemeral, re-registerable preview deployments (`*.vercel.app`) are deliberately excluded so a local process or a taken-over preview subdomain can never drive mainnet signing; use a separate, unpublished dev manifest for local Snap QA. The release verifier rejects localhost, non-HTTPS, wildcard, duplicate, or unknown origins in the shipped manifest.
 
 ## JSON-RPC API
 
 - `ducat_getAccounts({ network })`
-- `ducat_clearRecentActions()`
 - `ducat_getCapabilities()`
 - `ducat_signMessage({ network, address, message })`
 - `ducat_signPsbt({ network, psbt, signInputs, context })`
 - `ducat_signBatch({ network, entries, context })`
 - `ducat_sendTransfer({ network, address, amountSats, feeRate })`
 - `ducat_getHomeState({ network })`
+- `ducat_clearRecentActions()`
 
-## What Users See
+## User Confirmation Surface
 
-MetaMask confirmations are intentionally action-specific and use structured sections and rows:
+MetaMask confirmations are action-specific and structured:
 
-- Message signing shows the Ducat action label, origin, testnet network, signing account, BIP322 signature type, message length, message fingerprint, and copyable message body.
-- PSBT signing shows the Ducat action label, origin, testnet network, compact summary rows, signed input details, output details, fee, warnings, and Ducat app metadata.
+- Message signing shows the Ducat action label, origin, network, account, BIP322 signature type, message length, message fingerprint, and copyable message body.
+- PSBT signing shows the Ducat action label, origin, network, summary rows, signed input details, output details, fee, warnings, and Ducat app metadata.
 - Batch signing shows transaction count, all-or-nothing semantics, total fee, per-transaction summaries, and warning count.
-- Simple BTC transfer shows amount, estimated fee, the `You pay` amount, change, sender, recipient, selected UTXO count/value, and broadcast endpoint.
-- Snap Home shows structured cards for the last connected network, copyable BTC/UNIT/vault addresses, BTC and UNIT balances when services are available, vault status, recent action status, clickable links for HTTPS Ducat app origins, and copyable local routes during development. Approved Ducat origins can request a confirmed recent-action history clear.
-- MetaMask notifications announce pending approvals, completed signing/broadcast actions, and non-rejection failures. Notifications are informational only and never gate signing behavior.
-
-Errors returned to the frontend are friendly by default and include a stable `code` plus diagnostic `details` for developers. The frontend should display the `message` and keep details available for expanded debugging.
-
-## Troubleshooting
+- Simple BTC transfer shows amount, estimated fee, `You pay`, change, sender, recipient, selected UTXOs, and broadcast endpoint.
+- Snap Home shows last connected network, copyable BTC/UNIT/vault addresses, public balance and vault lookups when available, recent action state, approved HTTPS Ducat app links, and local development routes.
 
-| Symptom | Likely Cause | Fix |
-| --- | --- | --- |
-| `Fetching local snaps is disabled` | MetaMask local Snap development is disabled. | Enable local Snap fetching in MetaMask/Flask developer settings, then retry install/update. |
-| MetaMask asks to reinstall before signing | The served local Snap shasum changed. | Run `npm run build && npm run manifest`, restart `npm run serve`, then use the frontend `Update Snap` button. |
-| `This site is not authorized to use the Ducat Snap` | The frontend origin is not in `snap.manifest.json`. | Use one of the allowed local origins or add the origin intentionally and regenerate the manifest. |
-| `This transaction is trying to spend an input from a different Ducat Snap account` | The PSBT input does not match the derived Snap account requested in `signInputs`. | Refresh the frontend wallet account state and rebuild the Ducat transaction. Use diagnostic details to compare expected and actual input addresses. |
-| Balance or vault status is unavailable on Snap Home | Public indexer or Ducat validator lookup timed out or failed. | Retry later. Signing still uses PSBT data supplied by the Ducat app. |
+Errors returned to the frontend include a stable `code`, user-facing `message`, and diagnostic `details` for expanded debugging.
 
 ## Security Model
 
-- Private keys never leave the Snap.
-- The Snap only requests testnet BIP32 entropy paths in v1.
-- Mainnet requests are rejected.
+- Private keys, child private keys, WIFs, and raw entropy never leave the Snap.
+- The Snap requests Bitcoin mainnet and testnet BIP32 entropy paths: `m/84'/0'`, `m/86'/0'`, `m/84'/1'`, and `m/86'/1'`.
+- Mainnet requests use Bitcoin mainnet addresses, transaction parsing, and broadcast endpoints; signet and mutinynet requests use Bitcoin testnet parameters.
+- Unauthorized origins cannot invoke the Snap RPC API.
 - Only explicit `signInputs` indexes are signed.
 - Signing is restricted to derived Ducat Snap accounts.
-- Every message, PSBT, batch, and transfer signing path requires MetaMask confirmation.
-- Friendly frontend action context is display metadata only. Parsed PSBT data is the trusted signing summary.
-- Unauthorized origins cannot invoke the Snap RPC API.
-
-### Taproot Script-Path Policy
+- Message, PSBT, batch, and transfer signing require MetaMask confirmation.
+- Frontend context is treated as untrusted display metadata. Parsed PSBT data is the signing source of truth.
+- Snap state stores recent Ducat action metadata only.
 
-Vault PSBTs that spend Taproot script-path inputs must include a Ducat cosign tapleaf and control-block data that recomputes to the prevout P2TR output key. The tapleaf must place the derived Ducat vault key in the client slot, and the client and guard pubkeys must be distinct. The Snap rejects uncommitted script-path inputs, client/guard key collapse, and generic leaves even if the leaf contains the derived Ducat vault key.
+Taproot script-path inputs must include a Ducat cosign tapleaf and control-block data that recomputes to the prevout P2TR output key. The tapleaf must place the derived Ducat vault key in the client slot, and the client and guard pubkeys must be distinct. The Snap rejects uncommitted script-path inputs, client/guard key collapse, and generic leaves even when a leaf contains the derived vault key.
 
-Mainnet support still requires a separate audit pass, but the signet/mutinynet Snap no longer contains the earlier alpha fallback that accepted uncommitted tapleaf data.
+## Audit And Submission Packet
 
-## Audit Readiness Plan
+Primary audit documents:
 
-Use this plan to move the current audit candidate from "ready to review" to "ready to submit". Do not change `snap.manifest.json` localhost origins as part of this note; handle that as a dedicated release-manifest task before external submission.
+- `AUDITOR_HANDOFF.md`
+- `AUDIT_SCOPE.md`
+- `RELEASE_EVIDENCE.md`
+- `INTERNAL_SECURITY_REVIEW.md`
+- `DEPENDENCY_AUDIT.md`
+- `SNAPPER_REVIEW.md`
 
-Current candidate progress: duplicate previous-output rejection, missing previous-output data rejection, oversized signing request rejection, PSBT input/output size guard coverage, suspicious data-output warnings, malformed transfer broadcast txid rejection, bounded primitive app-context metadata validation, hostile app-context containment for decoded vault data, create/borrow/repay/withdraw/repo/liquidate vault action decode coverage, malformed Snap Home balance and vault-data rejection, public-account fixture replay for captured PSBT confirmation text, a HTTPS-only release-manifest verifier, and a final submission-readiness gate for fixtures, E2E evidence, screenshots, audit/demo URLs, and npm metadata are implemented. Remaining external evidence work is real transaction fixture capture, full E2E recording, final support/privacy/escalation details, npm publish evidence, and the third-party audit report.
+Submission documents:
 
-1. Expand the Ducat transaction fixture corpus. Capture real client-sdk/validator PSBT fixtures for create, deposit, borrow, repay, withdraw, swap, liquidation, and repossess flows on mutinynet/signet. Include the exact Snap `WalletAccountRecord` and expected confirmation text so `npm run verify:fixtures` can replay OP_RETURN decoding, action labels, vault state summaries, data-output labels, warning behavior, and confirmation rendering without private keys.
-2. Harden PSBT policy tests. Add adversarial cases for wrong network, unknown sign indexes, duplicate inputs, mixed account ownership, malicious frontend context, malformed data outputs, uncommitted Taproot script-path inputs, missing previous-output data, and suspicious zero-value outputs.
-3. Split development and release configuration. Keep localhost origins and `local:http://localhost:8080` for development, but create a release manifest path that allows only approved HTTPS Ducat origins. Update CI to verify the release manifest, package shasum, and submission metadata together.
-4. Complete E2E evidence. Record install, update, connect, reload reconnect, create, deposit, borrow, repay, withdraw, swap, liquidation, repossess, rejection, and disabled/re-enabled Snap flows using the same candidate bundle submitted to audit.
-5. Lock the external submission packet. Finalize privacy/support/escalation contacts, screenshots, demo video, npm publish evidence, audited commit, fixed commit if needed, and the audit report. Update `submission/ALLOWLIST_SUBMISSION.md`, `submission/metamask-directory.json`, and `RELEASE_EVIDENCE.md` from that final candidate.
+- `submission/README.md`
+- `submission/ALLOWLIST_SUBMISSION.md`
+- `submission/EXTERNAL_GATES.md`
+- `submission/metamask-directory.json`
+- `submission/fixtures/README.md`
+- `submission/e2e/README.md`
+- `submission/screenshots/README.md`
 
-## Release Path
-
-1. Confirm `npm run verify:release` passes from a clean checkout.
-2. Update `RELEASE_EVIDENCE.md` for the audited candidate.
-3. Tag the audit candidate.
-4. Complete the third-party audit required for `snap_getBip32Entropy`.
-5. Merge any audit fixes and tag the fixed candidate.
-6. Publish `@ducat-unit/wallet-snap@0.1.2` to npm.
-7. Replace pending external fields in `submission/metamask-directory.json` and `submission/ALLOWLIST_SUBMISSION.md`.
-8. Capture real PSBT fixtures into `submission/fixtures/`.
-9. Capture final E2E evidence into `submission/e2e/evidence.json`.
-10. Capture final screenshots into `submission/screenshots/`.
-11. Record the demo video using `DEMO_SCRIPT.md`.
-12. Run `npm run verify:submission-ready`.
-13. Submit the MetaMask allowlist/directory request with audit report, npm URL, public repo URL, demo video, support details, and listing assets.
+The source, package, metadata, and local verification evidence are ready for external audit handoff. MetaMask directory submission still requires the third-party audit report, final screenshots, demo video, real transaction fixtures, final E2E evidence, and project-owned support/escalation details listed in `submission/EXTERNAL_GATES.md`.
 
 ## Useful Commands
 
 ```bash
 npm run type-check
-npm test
+npm test -- --runInBand
 npm run build
 npm run manifest
-npm run serve
-npm run verify
+npm run verify:harness
 npm run verify:release
 npm run verify:metadata
+npm run verify:release-manifest
 npm run verify:submission-ready
 npm run audit:prod
 npm run pack:dry-run

package/RELEASE_CHECKLIST.md

@@ -1,51 +1,55 @@
 # Ducat Snap Release Checklist
 
-## Pre-Submission
+## Completed For `0.1.5`
 
-- [x] Public repository contains the current audit-candidate source commit.
-- [x] `.github/workflows/verify.yml` succeeds on the current audit candidate.
+- [x] Public repository contains the audit-candidate source tag.
+- [x] Audit candidate tag exists after the final handoff commit: `audit-candidate-0.1.5-20260615-audit-confirmation-hardening`.
+- [ ] `.github/workflows/verify.yml` succeeds on the current audit candidate.
 - [x] `npm run verify:release` succeeds locally.
-- [ ] `submission/metamask-directory.json` pending external fields are replaced.
-- [ ] `npm run verify:submission-ready` succeeds after external evidence is complete.
 - [x] `npm run pack:dry-run` output reviewed.
 - [x] `npm run audit:prod` output reviewed.
 - [x] Dependency audit reviewed.
 - [x] Snapper/security scan reviewed.
 - [x] Console logs, unused permissions, accidental placeholders, and dead RPC methods removed or documented as external gates.
-- [x] Alpha Taproot script-path compatibility fallback in `src/psbt.ts` was removed and replaced with committed tapleaf verification.
-- [ ] Real create/deposit/borrow/repay/withdraw/swap/liquidation/repossess PSBT fixtures captured in `submission/fixtures/`.
-- [ ] Final signet/mutinynet E2E evidence captured in `submission/e2e/evidence.json`.
+- [x] Legacy Taproot script-path compatibility behavior removed and replaced with committed tapleaf verification.
+- [x] Deterministic MetaMask simulation harness covers account derivation and owned P2WPKH PSBT signing.
+- [x] Mainnet derivation, network parsing, endpoint selection, and release metadata added to the audit candidate.
+- [x] `@ducat-unit/wallet-snap@0.1.5` release metadata prepared for audit handoff.
+- [ ] Frontend PR #675 default Snap version range updated to `^0.1.5`.
+
+## Required Before MetaMask Submission
+
 - [ ] Third-party audit completed because the Snap uses `snap_getBip32Entropy`.
-- [ ] Audit fixes merged and tagged.
+- [ ] Audit fixes merged and tagged, if the audit requires fixes.
+- [ ] `submission/metamask-directory.json` pending external fields are replaced.
+- [ ] `submission/ALLOWLIST_SUBMISSION.md` pending external fields are replaced.
+- [ ] Real create/deposit/borrow/repay/withdraw/swap/liquidation/repossess PSBT fixtures captured in `submission/fixtures/`.
+- [ ] Final mainnet/signet/mutinynet E2E evidence captured in `submission/e2e/evidence.json`.
+- [ ] Final screenshots captured in `submission/screenshots/`.
+- [ ] Demo video recorded with `DEMO_SCRIPT.md`.
+- [ ] Production support, escalation, and response-time details finalized.
+- [ ] `npm run verify:submission-ready` succeeds after external evidence is complete.
 
 ## Listing Assets
 
-- [x] Icon.
-- [ ] `submission/screenshots/` contains final screenshots.
-- [ ] Screenshots captured from the audited build using `LISTING.md`.
+- [x] Icon: `images/icon.svg`.
 - [x] Short description from `LISTING.md`.
 - [x] Long description from `LISTING.md`.
-- [x] Privacy policy.
-- [ ] Support and escalation contact.
-- [ ] Demo video recorded with `DEMO_SCRIPT.md`, showing install, connect, create/deposit/borrow/repay/withdraw/swap/liquidation signing, and Snap home.
-
-## Publish
-
-- [ ] Publish `@ducat-unit/wallet-snap` to npm.
-- [ ] Submit MetaMask allowlist/directory request with:
-  - [ ] audited commit
-  - [ ] fixed commit
-  - [ ] audit report
-  - [ ] npm URL
-  - [ ] public repo URL
-  - [ ] demo video
-  - [ ] support details
-  - [ ] listing assets
+- [x] Privacy policy source: `PRIVACY.md`.
+- [x] Security disclosure source: `SECURITY.md`.
+- [x] Support source: `SUPPORT.md`.
+- [ ] Final PNG screenshots captured from the audited build.
+- [ ] Demo video recorded from the audited build.
+- [ ] Support and escalation contact copied into the submission form.
 
-## Production Cutover
+## Submission
 
+- [ ] Submit MetaMask allowlist/directory request with the audited commit, fixed commit if any, audit report, npm URL, public repository URL, demo video, support details, and listing assets.
 - [ ] MetaMask allowlist approval received.
+
+## Production Cutover
+
 - [ ] Frontend production config uses `NEXT_PUBLIC_DUCAT_SNAP_ID=npm:@ducat-unit/wallet-snap`.
 - [ ] Frontend production config uses the approved release range in `NEXT_PUBLIC_DUCAT_SNAP_VERSION`.
 - [ ] Existing Xverse and UniSat regression flows pass.
-- [ ] Signet/mutinynet install, connect, create, deposit, borrow, repay, withdraw, swap, and liquidation/repossess E2E scenarios pass.
+- [ ] Mainnet/signet/mutinynet install, connect, create, deposit, borrow, repay, withdraw, swap, liquidation, and repossess E2E scenarios pass.

package/SECURITY.md

@@ -2,12 +2,11 @@
 
 Report security issues privately to the Ducat maintainers before public disclosure.
 
-Production release requirements:
+Release requirements:
 
 - Third-party audit for key-management usage of `snap_getBip32Entropy`.
-- MetaMask allowlist/directory review.
-- Dependency audit and Snapper/security scan.
-- No mainnet permissions until the mainnet release audit delta is complete.
-
-V1 signs only explicit PSBT input indexes that match the Snap-derived signet/mutinynet addresses.
+- MetaMask allowlist/directory review before production distribution.
+- Production dependency audit and Snapper/security scan for every release candidate.
+- Mainnet key derivation, signing, and broadcast support must be covered by the third-party audit before production distribution.
 
+`@ducat-unit/wallet-snap@0.1.5` supports mainnet, signet, and mutinynet. It signs only explicit PSBT input indexes that match Snap-derived addresses and requires MetaMask confirmation before message, PSBT, batch, or transfer signing.

package/SNAPPER_REVIEW.md

@@ -6,7 +6,9 @@ Last local command:
 npx --yes @sayfer_io/snapper --path . --output snapper-report.json
 ```
 
-Local result: 206 findings, all risk 1 and all under the `ESLinting` category.
+Local result: 221 findings across the `ESLinting`, `ExcessiveComments`, and `HardcodedSecrets` categories.
+
+The three `HardcodedSecrets` findings are the Ducat guardian x-only **public** key (`ef8e6d84…ca2e`) hardcoded per network in `src/networks.ts`. It is a public key that is intended to be embedded so the Snap can pin the vault cosigner identity; it is not a secret. The remaining findings are style/comment-density scanner policy, not signing, key-export, origin-authorization, confirmation-bypass, or network-scope findings.
 
 ## Addressed Findings
 

package/SUPPORT.md

@@ -6,4 +6,4 @@ https://github.com/DUCAT-UNIT/ducat-snap/issues
 
 Security issues should not be filed as public issues. Follow `SECURITY.md` for private disclosure.
 
-For MetaMask directory submission, the public support URL, escalation contact, and response-time expectations must also be copied into `submission/ALLOWLIST_SUBMISSION.md`.
+Before MetaMask directory submission, copy the final public support URL, private escalation contact, and response-time expectation into `submission/ALLOWLIST_SUBMISSION.md`.