ci(bitcoin-only): actually run the product-boundary suite

tests/test_msg_bitcoin_only_variant.py calls requires_bitcoinOnly() in
setUp(), and ci.yml built and started only the regular emulator. All eleven
product-boundary tests therefore ran as skips in the one required
integration job, so the advertised bitcoin-only coverage was never executed
by any check. The module docstring also claimed "NOTHING HERE SKIPS",
which the unconditional gate had already made false.

Add an integration-btc job that builds the emulator with
-DKK_BITCOIN_ONLY=ON via the Dockerfile's existing coinsupport build arg,
asserts features.firmware_variant is EmulatorBTC before pytest runs, and
fails when any test in the module skips -- pytest exits 0 on a fully
skipped module, so a green run proves nothing unless the skip count is
zero. Rewrite the docstring to describe the real scope and name the job the
file now depends on.

Author: pastaghost

.github/workflows/ci.yml

@@ -7,7 +7,9 @@
 #   └─ lint        Python syntax + deterministic protocol contract tests
 #
 # Stage 2: TEST (gated by Stage 1)
-#   └─ integration full pytest suite against emulator
+#   ├─ integration     full pytest suite against the regular emulator
+#   └─ integration-btc bitcoin-only product boundary against a
+#                      -DKK_BITCOIN_ONLY=ON emulator
 
 name: CI
 
@@ -282,3 +284,215 @@ jobs:
         run: |
           STATUS=$(cat keepkey-firmware/deps/python-keepkey/tests/status 2>/dev/null || echo "1")
           [ "$STATUS" = "0" ] || exit 1
+
+  # ═══════════════════════════════════════════════════════════
+  # STAGE 2b: TEST — the OTHER shipping product
+  # ═══════════════════════════════════════════════════════════
+
+  integration-btc:
+    needs: [lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    # KK_BITCOIN_ONLY=ON is a second shipping product, not a build flavour:
+    # coins.def keeps only Bitcoin and Testnet, messagemap.def drops every
+    # altcoin handler, ZCASH_PRIVACY is forced OFF, and transaction.c takes a
+    # BITCOIN_ONLY arm on the OP_RETURN path.
+    #
+    # tests/test_msg_bitcoin_only_variant.py asserts all of that, and its
+    # setUp() calls requires_bitcoinOnly() -- so against the regular emulator
+    # the `integration` job runs it as ELEVEN SKIPS. Skips are green. Without
+    # this job the advertised bitcoin-only coverage is never executed by any
+    # required check, which is the exact condition that file was written to
+    # end. The step below therefore fails closed on a skip, not just on a
+    # failure.
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          path: python-keepkey
+
+      - name: Checkout firmware
+        uses: actions/checkout@v4
+        with:
+          repository: BitHighlander/keepkey-firmware
+          ref: alpha
+          path: keepkey-firmware
+
+      # Same non-recursive init as the regular job: trezor-firmware's
+      # micropython vendor tree pulls lib/lwip from git.savannah.gnu.org,
+      # which cannot serve the shallow clone actions/checkout asks for.
+      - name: Init the submodules the emulator build needs
+        working-directory: keepkey-firmware
+        run: |
+          git submodule update --init --depth 1 deps/crypto/trezor-firmware
+          git submodule update --init --depth 1 deps/device-protocol
+          git submodule update --init --depth 1 deps/googletest
+          git submodule update --init --depth 1 deps/qrenc/QR-Code-generator
+          git submodule update --init --depth 1 deps/sca-hardening/SecAESSTM32
+
+      - name: Overlay this python-keepkey onto the firmware tree
+        run: |
+          rm -rf keepkey-firmware/deps/python-keepkey
+          cp -a python-keepkey keepkey-firmware/deps/python-keepkey
+
+      # scripts/emulator/Dockerfile forwards ARG coinsupport into the cmake
+      # invocation, so this is the same emulator build with the product flag
+      # the shipping bitcoin-only image is built with.
+      - name: Build the bitcoin-only emulator
+        timeout-minutes: 20
+        working-directory: keepkey-firmware
+        run: |
+          docker build -t kkemu-btc-ci \
+            --build-arg coinsupport=-DKK_BITCOIN_ONLY=ON \
+            -f scripts/emulator/Dockerfile .
+
+      - name: Start the emulator
+        run: |
+          docker run -d --name kkemu-btc \
+            -p 11044:11044/udp -p 11045:11045/udp -p 5000:5000 kkemu-btc-ci
+          sleep 3
+          docker logs kkemu-btc | head -5
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        working-directory: python-keepkey
+        run: |
+          pip install --upgrade pip
+          pip install "protobuf>=3.20,<4"
+          pip install -e .
+          pip install pytest semver rlp requests eth-keys pycryptodome
+
+      - name: Wait for emulator
+        run: |
+          echo "Waiting for emulator bridge on port 5000..."
+          for i in $(seq 1 30); do
+            if curl -sf -X POST http://localhost:5000/exchange/main \
+                 -H 'Content-Type: application/json' \
+                 -d '{"data":""}' > /dev/null 2>&1; then
+              echo "Emulator ready after ${i}s"
+              break
+            fi
+            sleep 1
+          done
+
+      # A bitcoin-only emulator that reports "Emulator" instead of
+      # "EmulatorBTC" makes requires_bitcoinOnly() skip the whole file, and a
+      # regular emulator built by a broken --build-arg does the same. Assert
+      # the variant BEFORE pytest so that failure is named, not silent.
+      - name: Assert the emulator really is the bitcoin-only product
+        timeout-minutes: 2
+        env:
+          KK_TRANSPORT_MAIN: "127.0.0.1:11044"
+          KK_TRANSPORT_DEBUG: "127.0.0.1:11045"
+          KK_MIN_FW: "7.15.0"
+          KK_UDP_TIMEOUT: "20"
+        working-directory: keepkey-firmware/deps/python-keepkey/tests
+        run: |
+          python - <<'PY'
+          import os, sys
+          sys.path.insert(0, '..')
+          import config
+          from keepkeylib.client import KeepKeyDebuglinkClient
+          c = KeepKeyDebuglinkClient(config.TRANSPORT(*config.TRANSPORT_ARGS,
+                                                      **config.TRANSPORT_KWARGS))
+          c.set_debuglink(config.DEBUG_TRANSPORT(*config.DEBUG_TRANSPORT_ARGS,
+                                                 **config.DEBUG_TRANSPORT_KWARGS))
+          c.init_device()
+          f = c.features
+          got = (f.major_version, f.minor_version, f.patch_version)
+          floor = tuple(int(x) for x in os.environ['KK_MIN_FW'].split('.'))
+          print('emulator firmware %d.%d.%d, variant %r' %
+                (got + (f.firmware_variant,)))
+          if got < floor:
+              sys.exit('FATAL: the emulator image predates the tests that run '
+                       'against it.')
+          if f.firmware_variant not in ('KeepKeyBTC', 'EmulatorBTC'):
+              sys.exit('FATAL: firmware_variant is %r, so requires_bitcoinOnly() '
+                       'would skip every test in this job. The -DKK_BITCOIN_ONLY=ON '
+                       'build arg did not take effect.' % (f.firmware_variant,))
+          PY
+
+      - name: Run the bitcoin-only product-boundary tests
+        timeout-minutes: 8
+        env:
+          KK_TRANSPORT_MAIN: "127.0.0.1:11044"
+          KK_TRANSPORT_DEBUG: "127.0.0.1:11045"
+          PYTHONPATH: "${{ github.workspace }}/keepkey-firmware/deps/python-keepkey"
+          KK_UDP_TIMEOUT: "45"
+        run: |
+          cd keepkey-firmware/deps/python-keepkey/tests
+          pytest -v --junitxml=junit-btc.xml test_msg_bitcoin_only_variant.py \
+            2>&1 | tee pytest-btc-output.txt
+          echo "${PIPESTATUS[0]}" > status-btc
+
+      # The whole reason this job exists. `pytest` exits 0 on a fully skipped
+      # module, so a green run proves nothing unless the skip count is zero.
+      - name: Fail if the product-boundary tests skipped
+        if: always()
+        run: |
+          XML="keepkey-firmware/deps/python-keepkey/tests/junit-btc.xml"
+          if [ ! -f "$XML" ]; then
+            echo "::error::no junit-btc.xml -- the suite crashed before completion"
+            exit 1
+          fi
+          python3 - "$XML" <<'PY'
+          import sys, xml.etree.ElementTree as ET
+          tree = ET.parse(sys.argv[1])
+          cases = list(tree.iter('testcase'))
+          skipped = [c for c in cases if c.find('skipped') is not None]
+          print('bitcoin-only boundary: %d tests, %d skipped' %
+                (len(cases), len(skipped)))
+          if not cases:
+              sys.exit('FATAL: collected zero tests.')
+          for c in skipped:
+              print('::error::SKIPPED %s: %s' %
+                    (c.get('name'), c.find('skipped').get('message', '')))
+          if skipped:
+              sys.exit('FATAL: %d of %d bitcoin-only tests skipped. A skip here '
+                       'means the variant went unaudited, which is the failure '
+                       'this job exists to catch.' % (len(skipped), len(cases)))
+          PY
+
+      - name: Bitcoin-only summary
+        if: always()
+        run: |
+          XML="keepkey-firmware/deps/python-keepkey/tests/junit-btc.xml"
+          echo "## 🔑 KeepKey python-keepkey — Bitcoin-only product boundary" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          if [ ! -f "$XML" ]; then
+            echo "❌ **No test results found** — suite may have crashed." >> "$GITHUB_STEP_SUMMARY"
+          else
+            TOTAL=$(grep -oP 'tests="\K[0-9]+' "$XML" | head -1)
+            FAILED=$(grep -oP 'failures="\K[0-9]+' "$XML" | head -1)
+            ERRORS=$(grep -oP 'errors="\K[0-9]+' "$XML" | head -1)
+            SKIPPED=$(grep -oP 'skipped="\K[0-9]+' "$XML" | head -1)
+            TOTAL=${TOTAL:-0}; FAILED=${FAILED:-0}; ERRORS=${ERRORS:-0}; SKIPPED=${SKIPPED:-0}
+            PASSED=$((TOTAL - FAILED - ERRORS - SKIPPED))
+            echo "| Metric | Count |" >> "$GITHUB_STEP_SUMMARY"
+            echo "|--------|-------|" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Total | $TOTAL |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| ✅ Passed | $PASSED |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| ⏭️ Skipped (must be 0) | $SKIPPED |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| ❌ Failed | $FAILED |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| 💥 Errors | $ERRORS |" >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Annotate test results
+        uses: mikepenz/action-junit-report@v4
+        if: always()
+        with:
+          report_paths: keepkey-firmware/deps/python-keepkey/tests/junit-btc.xml
+          annotate_only: true
+          require_tests: true
+          fail_on_failure: true
+
+      - name: Fail on test failure
+        if: always()
+        run: |
+          STATUS=$(cat keepkey-firmware/deps/python-keepkey/tests/status-btc 2>/dev/null || echo "1")
+          [ "$STATUS" = "0" ] || exit 1

tests/test_msg_bitcoin_only_variant.py

@@ -7,13 +7,21 @@
 None of that had a test, and CI only ever ran the multi-chain emulator -- so
 the whole variant was unaudited.
 
-NOTHING HERE SKIPS. Each test asserts the behaviour that is correct for the
-variant it is talking to, so it is evidence on both builds: on the bitcoin-only
-image it proves the strip happened, and on the regular image it proves the
-strip did NOT happen (a guard that leaked into the multi-chain product would
-fail here just as loudly). `requires_fullFeature()` is deliberately not used --
-see test_firmware_variant_names_the_bitcoin_only_product for why it cannot
-work.
+SCOPE: THIS FILE RUNS ON THE BITCOIN-ONLY IMAGE ONLY. `setUp()` calls
+`requires_bitcoinOnly()`, so every test here SKIPS on the regular multi-chain
+build. That is deliberate and not symmetric coverage: several tests assert
+screen sequences that legitimately differ on the multi-chain build -- the
+OP_RETURN one decodes a THORChain memo there and draws more screens -- so
+running them against a full-feature device is a category error, not a finding.
+The regular image is covered by the rest of the suite, which asserts the
+altcoin handlers these tests assert are absent.
+
+Because of that gate, this file is only evidence when a bitcoin-only emulator
+is actually under test. `.github/workflows/ci.yml` runs the `integration-btc`
+job for exactly that reason: it builds the emulator with
+`-DKK_BITCOIN_ONLY=ON` and runs this module against it. If that job is ever
+dropped, these eleven tests go silently green-by-skip and the variant is
+unaudited again -- which is the state this file was written to end.
 
 The variant is identified by GetCoinTable, not by features.firmware_variant:
 the coin table comes from coins.def, which is a different mechanism from the