[jackchuma]

Linear: https://linear.app/coinbase/issue/CHAIN-6505/bind-the-signing-account-to-the-validated-validation-profile

What changed? Why?

The hardware-signing step took its Ledger account from the profile list fetched at user selection (/api/upgrade-config). Validation re-reads the Validation profile from disk later, so a profile edited between listing and validation could make the signer use a different account than the one validated.

• ValidationData now has a required top-level ledgerId, set by validateUpgrade from the loaded Validation profile on both return paths (success and task-origin failure).
• page.tsx passes validationData.ledgerId to HardwareSigning instead of selectedUser.ledgerId.
• The sign route is unchanged: it still trusts the client-sent ledgerAccount (no server-side reread), per the ticket.

Notes to reviewers

• The page wiring (page.tsx) has no component test; the repo has no React component test setup.
• Spec: objective and acceptance criteria are those of CHAIN-6505 (validation result carries ledgerId; signing step uses it; sign route trusts client; regression test at the validateUpgrade seam).

How has it been tested?

• New src/lib/__tests__/validation-service.test.ts drives validateUpgrade against a fixture Task on disk, replacing only StateDiffClient. It asserts the returned ledgerId equals the profile's (7) with task origin disabled, and also on the task-origin-failure early return.
• npm test (161 passed), npm run lint, npx tsc --noEmit, prettier --check on changed files.

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 2/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[jackchuma]

Review round 1

Reviewers: cbhq-openai/gpt-6.1-sol, anthropic/claude-opus-5-5 (parallel). Both: premise worth it, No findings.

• Dropped in triage: [P2] page.tsx passes validationData.ledgerId to HardwareSigning with no component test (raised by both reviewers as a residual risk; spec check marked criterion 2 untested) — out of scope: the repo has no React component test setup. A test would need jsdom + Testing Library dev deps, a Jest environment/transform change for .tsx (package.json, package-lock.json, jest.config.js, all outside this PR's files) and a ~60-line page test. The ticket accepts this gap and the PR notes it.
  Synced with main: bbc06f3 (already current)
  Validation: npm test 161 passed; npm run lint, npx tsc --noEmit, prettier on changed files clean
  Spec check (anthropic/claude-opus-5-5): criteria 1, 3, 4, 5 met; 2 implemented, untested (accepted by spec)

🤖 Reply generated with Toshi

[0xth4nh]

Looks Good to Thanh's Toshi