Alpha accepted PR #557 with red CI and every firmware build/unit/integration job skipped

[BitHighlander]

Security/release-gate defect

PR #557 was merged into alpha at 2026-08-25T06:08:39Z while both workflow runs had a failing aggregate CI gate. The checks visible on the merged PR show:

• secret-scan: failed (the repo-wide baseline tracked in secret-scan blocked repo-wide: git history contains unrelated keepkey-vault/keepkey-sdk content (42 gitleaks findings, needs human secret-safety review) #544)
• generate-test-report: failed because test-reports/python-keepkey/junit.xml did not exist
• both ARM firmware build jobs: skipped
• both emulator build jobs: skipped
• both firmware unit-test jobs: skipped
• both Python integration-test jobs: skipped
• both Python dylib-test jobs: skipped

Lint, crypto tests, submodule checks, and static analysis passed, but those are not substitutes for compiling the changed firmware or running its unit/integration suites. The merge also landed without the requested boundary regressions for #550 and #553 (Solana 33/256-account fail-closed cases and Ripple 1e17 boundary/serializer-FSM agreement).

This is a release-process security defect, not merely a red badge: changes to signing and parser boundaries reached alpha without any CI evidence that the firmware builds or that those paths work.

Evidence:

• Merged PR: fix(security): round-2 signing/hygiene audit -- clear-sign disclosure gaps, secret scrubbing, digest corruption #557
• Merge commit: 858dfff056c8e643fb34dbebe8fd7b6ae424ebd3
• Workflow runs: https://github.com/BitHighlander/keepkey-firmware/actions/runs/32814751839 and https://github.com/BitHighlander/keepkey-firmware/actions/runs/32814755225
• Independent pre-merge review requesting the missing tests: fix(security): round-2 signing/hygiene audit -- clear-sign disclosure gaps, secret scrubbing, digest corruption #557 (comment)

Required remediation

1. Configure alpha protection/rulesets so the aggregate CI gate is required and applies to repository owners/administrators; a red or skipped required gate must prevent merge.
2. Decouple the known historical secret-scan baseline (secret-scan blocked repo-wide: git history contains unrelated keepkey-vault/keepkey-sdk content (42 gitleaks findings, needs human secret-safety review) #544) from firmware build/test execution. It may remain a separately visible required remediation, but it must not skip every functional job.
3. Make test-report generation depend on successful evidence-producing jobs/artifact download; a report job must not run without JUnit and then mask the underlying skipped tests.
4. Add the missing Solana: >32 accounts in a message silently skips signer verification before blind-sign, due to an assign-after-early-return ordering bug #550/Ripple: payment.amount has no upper-bound check (unlike fee) -- amounts >= 2^62 display a different value than what's actually signed #553 boundary regressions and run the complete build/unit/integration matrix against the merge commit.
5. Add an automated ruleset/branch-protection audit that fails if alpha can accept a PR while the aggregate CI gate is red.

[BitHighlander]

Root cause (secret-scan scanning all refs via --log-opts fetch-depth:0) fixed by PR #585, merged into alpha at 42fff90. Formal merge-gate process documented separately per user request; the aggregate 'CI gate' job must now be checked by name before any merge.