test(solana): KKSOLSC1 v2 schema reviews asserted by screen text - #110

Emulator tests for keepkey-firmware feat/solana-schema-v2 (BitHighlander/keepkey-firmware#828). They assert what the OLED says, not how many screens there are.

tests/oled_text.py

DebugLinkState.layout is pixels only, so this helper renders the expected string with the firmware's own title and body glyphs. The tables are generated from lib/board/font.c, and python oled_text.py path/to/font.c regenerates them. It wraps the text the way draw_string_walk() does, then requires every line to be whole (nothing lit just before or after it) and left-aligned on consecutive rows of one screen. On recorded frames it rejects one-character changes, dropped characters and prefix/suffix variants of every checked string.

tests/test_msg_solana_schema_v2.py

All tests use requires_firmware("7.16.0") and requires_fullFeature().

Certified (public Vault 501 certificate and the real Relay v1 delegate signature; no secrets):

• A static System Transfer companion is reviewed: "Funding account" and "Send 0.002000000 SOL to <dest>?" under INSTR 2/2.
• With SetComputeUnitPrice, consecutive FEE screens show "Fee payer <key>" and "Max priority fee 0.000200000 SOL". Without a price, neither screen appears.
• A duplicate price or limit is refused with "Invalid priority fee".
• These tests skip when the emulator refuses the certificate ("Invalid certified Solana certificate"), which means it was built without KK_CLEARSIGN_ALPHA_ROOT. Any other refusal fails the test. The existing test_relay_certified_v0_no_lookup_proof_reaches_signer_check does not skip: it fails on a root-less build, so CI still has a hard guard on the root.

Runtime (CI signer in slots 2 and 3, requires_message("LoadClearsignSigner")):

• A Transfer companion is refused with "Invalid Solana instruction schema". The control request is reviewed ("AMOUNT: 0.996374000 SOL").
• The test uses the real SoltoshiDICE join (the firmware fixture kSoltoshiJoinMessageHex), with the schema signed by slot 2. Slot 2's SDICE definition shows "1000.000000 SDICE" with the mint beneath it for Buy-in, Allowance and Max wager. Slot 3's definition renders pixel-identical to no definition: "1000000000 base units of mint" plus the mint.

ClearsignAttestor (requires_message("ClearsignAttestorSign")):

• A v2 TOKEN_AMOUNT arg costs exactly one extra screen, "Arg 1 token mint is / account feat: add Solana protocol support (GetAddress, SignTx, SignMessage) #3", right after the arg. All other screens are pixel-identical to the u64 control. The returned signature verifies over sha256(payload).

Verification

The tests ran against kkemu built from the firmware branch with KK_FORCE_UDP=1 on UDP 23644/23645:

• With the alpha root: 6 passed.
• Without the root: the 3 certified tests skipped with the reason above, and the runtime and attestor tests passed.

Each of these firmware mutations (kkemu rebuilt) fails at least one test:

• Certified reviews stop binding the priority fee (review_binds_fee without || certified).
• The attestor mint screen is removed.
• The mint is dropped beside a trusted symbol.
• Companion instructions are no longer screened.
• The fee is computed without the explicit compute-unit limit. The screen count stays the same and only the text changes.
• Runtime token definitions are accepted from any slot.

scripts/generate-test-report.py is unchanged. Its audit checks the tests it catalogues but does not require every test to be catalogued.