Clench Wallet 0.3.28

Clench Wallet 0.3.28

Clench Wallet 0.3.28 adds physically unverified air-gapped PSBT protocol presets
intended for OneKey Pro, Krux, and Specter DIY; expands QR compatibility with
formats used by coordinators and hardware signers; and implements a narrowly
scoped TAPSIGNER BIP-48 native-SegWit multisig cosigner path whose physical
acceptance remains NOT RUN. It also fixes persisted TAPSIGNER settings being
displayed as None.

The new device and TAPSIGNER multisig paths have extensive automated and
independent-vector coverage but no recorded physical-device acceptance. This
release does not claim compatibility with a particular model, firmware,
camera, NFC controller, or removable-media implementation. The exact deferral
is recorded in docs/qa/physical-hardware-gates-v0.3.28.md.

Air-gapped hardware-wallet paths

• A preset intended for OneKey Pro uses animated BC-UR v2 crypto-psbt QR.
• A preset intended for Krux uses animated BC-UR v2 QR and an explicitly
  selected microSD/file PSBT round trip.
• A preset intended for Specter DIY uses animated BC-UR v2 QR and an explicitly
  selected microSD/file PSBT round trip.
• Clench still does not open a USB or Bluetooth data connection to a signer.
  QR, an intentional NFC tap, and a user-selected file/removable card remain
  the allowed transfer classes.

These entries implement protocol paths intended for those devices; they are not
a claim of interoperability or that the v0.3.28 APK was exercised on
representative physical hardware.

Sparrow-compatible QR imports

The scanner and payload decoder now accept additional bounded inputs commonly
encountered in coordinator and signer workflows:

• legacy UR v1 multipart payloads;
• ur:psbt;
• binary PSBT/raw-transaction ur:bytes, or strict control-safe UTF-8 text
  handed to the existing downstream decoders; and
• bounded static Base43 PSBT/raw-transaction text.

Legacy multipart sessions are isolated and bounded, tolerate valid out-of-order
frames, and reject conflicting or malformed streams. Binary ur:bytes is no
longer forced through UTF-8 text conversion. Single-key crypto-output imports
preserve the declared script type instead of silently treating every key as
native SegWit.

A fixed vector produced with Sparrow's Drongo code is used as an independent
digest/signature oracle. No Sparrow Wallet coordinator or Drongo dependency was
added to the app; Clench's existing Hummingbird BC-UR library remains a runtime
QR dependency.

TAPSIGNER native-P2WSH multisig

An imported TAPSIGNER may now sign its own member inputs in a standard native-
SegWit multisig wallet. The production boundary is deliberately narrow:

• PSBT v0 only;
• BIP-48 account zero, with the card-reported network flag required to agree
  with the hardened path coin type;
• native P2WSH standard CHECKMULTISIG multi or sortedmulti policy;
• receive/change child paths below the authenticated card account;
• ECDSA SIGHASH_ALL only; and
• complete in-app transaction review followed by a separate explicit broadcast
  action.

Before requesting an NFC signature, Clench validates the witness UTXO and
witness script, the complete multisig policy, card-reported network/path
consistency, all supplied derivation pubkeys as policy members, the card's eligible member key/path, and any existing
policy-member partial signatures. Other cosigner origins may differ and are not
authenticated by the card. Clench accepts only a matching returned public key
and valid low-S signature for the exact BIP-143 digest. Verified signatures are merged
atomically: if any later input fails or the tap is interrupted, no earlier
input is changed.

After threshold finalization, the normal transaction policy still requires the
same recipients, amounts, change, fee, version, locktime, sequences, and inputs
that were reviewed. NFC signing never auto-broadcasts.

TAPSIGNER is screenless, so it cannot independently display the transaction.
Review every detail in Clench before entering the PIN and tapping the card.
Taproot, legacy, nested SegWit, nonstandard P2WSH, other BIP-48 accounts,
non-SIGHASH_ALL policies, and TAPSIGNER PIN change remain unsupported.

Verification and security evidence

The feature pull request passed the full JVM unit suite, Android lint, debug
assembly, strict dependency verification, release-control self-tests, CodeQL,
and the separate 5,000-case hostile protocol lane. Focused evidence includes:

• positive and hostile TAPSIGNER BIP-48/P2WSH cases for policy binding, mixed
  cosigner origins, existing partial signatures, wrong key/path/card material,
  unsupported sighash, multi-input failure, and atomic merge;
• a fixed Drongo-derived native-P2WSH vector that independently anchors the
  exact BIP-143 digest and known ECDSA signature; the same Clench test separately
  exercises the synthetic BIP-48 key/path selection and DER plus
  SIGHASH_ALL PSBT injection; and
• an end-to-end legacy-UR scanner-to-payload fixture with reversed multipart
  frames, plus positive and hostile tests for the other accepted encodings.

The release-preparation pull request, exact protected master, Android
instrumentation, and the protected Signed Release workflow must revalidate the
release gates before publication. The source-level review and residual risks
are recorded in docs/security/security-review-v0.3.28.md.

Physical evidence and authorized deferral

After being told that OneKey Pro, Krux, Specter DIY, representative camera-
format round trips, and real-card TAPSIGNER BIP-48 multisig acceptance remained
outstanding, the maintainer instructed “merge and release” on 2026-08-31 UTC.
This authorizes publication with those rows NOT RUN; automated, simulator,
emulator, and independent-vector results are not relabeled as physical passes.

The v0.3.27 record contains one identified debug-candidate real-card TAPSIGNER
single-signature payment. That useful result does not prove v0.3.28 multisig or
the final signed v0.3.28 APK. No new SATSCARD or previously listed hardware-
wallet physical pass is claimed by this release.

Release verification

The only installable production artifact is clench-0.3.28-release.apk from
the signed GitHub release. clench-0.3.28-unsigned.apk is non-installable
reproducibility evidence. Verify the pinned-key signed annotated source tag,
checksum manifests, APK signer certificate, package/version, SBOM, OSV result,
provenance, independent-build evidence, and GitHub attestations as described in
docs/release/signed-release-verification.md.

The release workflow preserves the v0.3.27 three-build and isolated-runtime
signing controls. The Android signing values are currently stored as repository
secrets but referenced only by the approval-gated no-source signing job; moving
or rotating them into environment-scoped secrets remains a documented defense-
in-depth follow-up.

F-Droid follows its own build and publication cadence and may continue to show
v0.3.27 after the signed GitHub v0.3.28 release becomes available.