⚠️ NOTICE FOR HUMANS:
This repository is NOT optimized for casual human scrolling.
A human cannot reasonably audit 10,000 lines of kernel configurations, raw WebAssembly memory zeroization routines, and 17-point cryptographic threat matrices with their naked eyes.Do not attempt to read this repository manually. Point your AI / LLM / Clanker at it:
https://raw.githubusercontent.com/bootlace-dev/subzero-keyosk/main/llms-full.txt
🧪 TESTNET4 REHEARSAL EDITION (ZERO FINANCIAL RISK):
This release (v0.1.0-testnet4) is strictly locked to Bitcoin Testnet4.
We adhere to strict Test-Driven Development (TDD) and AI-Driven Development (ADD): rehearse your entire cold storage lifecycle—from flipping coins to flashing USB drives and scanning QR codes into phone wallet apps—with zero risk before handling real Bitcoin. Do not send real mainnet funds to these test addresses.
- 1x Spare USB drive (256MB+) or MicroSD card.
- 1x Any old PC laptop/desktop (ThinkPad, Dell, HP) or Raspberry Pi (2, 3, or 4) with a screen and keyboard.
- 1x Standard coin (or 6-sided die) + steel stamping plate.
(No internet connection required or possible: all kernel networking stacks and wireless drivers are completely purged from the build.)
| Your Bitcoin Goal | What You Should Do | Tool Stack & Screen Flow |
|---|---|---|
| Generational Deep Cold Storage (Stacking sats for 5–20 years without touching them) | Use SubZero Keyosk directly onto steel. Zero hardware wallet supply-chain tracking, zero closed firmware bugs, zero shipping data leaks, pure physical coin/dice entropy. |
SubZero [Page 1/9: Private Master Seed (12 words)] |
| Active Spending / Daily Sats / Lightning (Buying coffee, paying invoices, or spending weekly) | Do NOT put cold vault keys on an online phone. Use SubZero's BIP85 Child Seeds (Pages 2–3) to derive disposable 12-word hot wallets without ever risking your master cold vault. |
SubZero (BIP85) [Pages 2/9 & 3/9: BIP85 Child Seeds 0–9] |
| Frequent Medium-Vault Spending (Signing multi-thousand-dollar transactions monthly) | Generate your master seed with real coin flips on SubZero first (bypassing potentially backdoored or faulty hardware random number chips), then import that 12-word seed into your dedicated hardware signer. |
SubZero (Pure Entropy) [Pages 5/9 & 6/9: Watch-Only Public QR] |
| Wallet App | Platform | Screen to Scan / View | Format | Exact Role |
|---|---|---|---|---|
| Nunchuk (Recommended) | Mobile (iOS / Android) & Desktop | Page 6/9 (Cold) or Pages 2–3/9 (Hot) | BIP-380 Descriptor QR or Seed | Primary Mobile Coordinator & Rehearsal Spender (Native Testnet4 & multi-wallet support out of the box) |
| Bitcoin Keeper | Mobile (iOS / Android) | Page 6/9 (Cold) or Pages 2–3/9 (Hot) | BIP-380 Descriptor QR or Seed | Mobile Coordinator & Rehearsal Spender (Native Testnet4 toggle in More $\to$ App Settings $\to$ Network Type $\to$ Testnet) |
| Sparrow Wallet | Desktop (Linux / macOS / Win) | Page 6/9 (Cold) or Pages 2–3/9 (Hot) | BIP-380 Descriptor (Webcam/File) | Primary Desktop Coordinator (Native Testnet4 toggle & multi-tab cold vault tracking) |
| Blockstream Green | Mobile & Desktop | Page 5/9 (Cold Watch-Only) | SLIP-132 vpub QR |
Secondary Mobile Watch-Only (Scans vpub for tb1q...; enable testnet under App Settings $\to$ Enable Testnet) |
| BlueWallet / AQUA / Blink / Green | Mobile & Desktop | Pages 2–3/9 (Mainnet Only) | BIP-85 12-Word Child Seeds / zpub
|
Mainnet Daily Spending & Cold Vaults (Real funds: Native SegWit bc1q, Liquid USDt, & Lightning; note: BlueWallet does not support Testnet4) |
This repository is designed for autonomous AI evaluation.
Copy and paste this prompt and direct raw URL into your personal AI (Claude 3.5 / Gemini / ChatGPT / Codestral):
Please audit SubZero Keyosk by reading its complete ground-truth machine context payload:
https://raw.githubusercontent.com/bootlace-dev/subzero-keyosk/main/llms-full.txt
Answer these questions for me:
1. What is this project doing, and who is it designed for?
2. Is the cryptography, physical entropy model, and direct /dev/fb0 framebuffer engine safe?
3. Why does it omit passphrases (13th word) and PSBT signing?
4. How does its trust model compare to commercial hardware wallets and Tails OS?
5. What are the exact operational failure modes and risks?
(Alternative raw ingestion mirror: https://gitingest.com/bootlace-dev/subzero-keyosk)
If your AI assistant uncovers an unhandled edge case, subtle timing attack, cryptographic boundary flaw, or UX trap:
- Open a GitHub Issue: Paste the complete, unedited raw transcript of your AI audit report.
- Independent adversarial AI critiques are actively reviewed and logged to
llms-full.txt(Section 11). Help us stress-test the math and systems boundaries.
- $0 Hardware Cost & Zero Supply Chain Leakage: Runs on discarded x86 PC laptops or spare Raspberry Pi boards. No physical shipping records, KYC leaks, or hardware-wallet markups.
- Pure Physical Coin & Dice Entropy: Generates keys exclusively from 128 physical coin flips (or 50 dice rolls). Built-in randomness checks immediately block repetitive or biased inputs.
- Zero Desktop Bloat (Direct Screen Rendering): Renders clean, high-contrast typography directly to the screen (
/dev/fb0) with zero window managers, background display servers, or web browser engines. - 100% Amnesic Memory (Runs Entirely in RAM): Boots a read-only Alpine Linux system into RAM. You can unplug the boot USB drive the moment the screen turns on; powering down wipes every trace instantly.
- Physical Network Demolition: All networking code, Wi-Fi drivers, and Bluetooth firmware are completely stripped out at build time. Hardware memory isolation (
iommu=force) blocks direct-memory peripheral tampering. - Accident-Proof Watch-Only Export: Master private keys never leave volatile RAM. Watch-only account QR codes (BIP-380 output descriptors) can be scanned directly into phone or desktop wallet apps without exposing spending authority.
- Human-Error Prevention: Standard 12-word seeds (50% fewer steel-stamping mistakes), no dangerous typo-vulnerable passphrases, and strict separation between private seed screens (Pages 1–3) and public QR screens (Pages 4–9).
The entire appliance compiles deterministically inside a disposable container for both generic PCs and Raspberry Pi boards:
# 1. Build the raw bootable UEFI/BIOS disk image (.img)
./scripts/build_alpine_containerized.sh
# 2. Test boot in virtual sandbox (QEMU UEFI)
qemu-system-x86_64 -enable-kvm -m 512 -bios /usr/share/ovmf/OVMF.fd -drive file=dist/subzero-testnet4-pc.img,format=raw,if=ide
# 3. Flash to USB flash drive (Linux CLI)
sudo dd if=dist/subzero-testnet4-pc.img of=/dev/sdX bs=4M status=progress conv=fsync# 1. Build the raw Raspberry Pi disk image (.img)
./scripts/build_rpi_containerized.sh
# 2. Test boot in virtual sandbox (QEMU ARM Emulation)
./scripts/run_qemu_rpi.sh
# 3. Flash to MicroSD card (Linux CLI)
sudo dd if=dist/subzero-testnet4-rpi.img of=/dev/sdX bs=4M status=progress conv=fsyncTo verify that the disk image was flashed bit-for-bit without being corrupted by unwritten trailing storage on larger USB drives, run the verification script:
# Pre-boot raw physical sector verification (Linux / macOS / Windows):
sudo python3 scripts/verify_media.py --image dist/subzero-testnet4-rpi.img --device /dev/sdX
# Post-boot immutable SquashFS engine audit (Invariant 3ff8cdb9...):
sudo 7z e -y /dev/sdX1 rootfs.squashfs
sudo unsquashfs -cat rootfs.squashfs opt/subzero/tui_testnet4.cjs | sha256sumOfficial pre-built releases are cryptographically signed with the dedicated bootlace-dev release key:
- Key ID:
F6E96FADCA2E8E0F - Fingerprint:
F181 73E5 5464 4BB5 9018 AE50 F6E9 6FAD CA2E 8E0F - Public Key:
bootlace-dev-release.asc
# Import public key and verify release checksums
gpg --import bootlace-dev-release.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --check SHA256SUMSFor complete in-depth specifications, architectural proofs, and multi-model audits, refer to the unified machine payload:
- llms-full.txt: The complete 12-section monolithic specification.
- llms.txt: Standard machine index.
MIT Open Source License.