pico-quorum

The test ladder: from a simulated Safe to Ethereum mainnet

This is the tracker for getting the console’s approvals from the laptop to real chains. Each rung runs the same firmware and the same approval: someone proposes, the console shows it, you hold A, and the Safe executes. Only the Safe and the money behind it change from rung to rung. Tick boxes as things land, and link the evidence (a buildlog entry, an explorer link).

How a chip key owns a Safe, on every rung:

• The owner. Each key sits behind its own SafeWebAuthnSignerProxy, Safe’s audited passkey signer (safe-modules passkey v0.2.1). The owner address is that proxy.
  • The console computes it itself (firmware/webauthn.py, pinned in quorum_cfg.py "signer").
  • It’s the same address on every chain.
• The signature. The console signs a WebAuthn assertion over the safeTxHash it computed from the fields on its own screen.
• The contracts. The factory, the Daimo verifier and the P-256 precompile are on Base, Base Sepolia, OP and Ethereum mainnet. They were checked onchain on 2026-09-25.

#	Rung	Where	Who signs	Status
0	Simulated	tools/quorum serve, no chain	Alice and Bob (simulated), the real Pico	✅ 2026-09-24, the real Pico (buildlog)
1	Local fork	tools/quorum up: Safe 1.4.1 on an Anvil fork of Base, chain 31337	Alice and Bob, the chip	✅ emulator (tools/quorum e2e) · ✅ real Pico, 2026-09-25 (buildlog)
2	Base Sepolia	testnet: the Safe web app and api.safe.global	your browser wallet, the chip	✅ rehearsal with the emulator · ✅ real Pico, end to end over HTTPS, 2026-09-25 (buildlog)
3	Base	a few dollars	your browser wallet, the chip	☐
4	Ethereum mainnet	a few dollars (base fee about 0.05 gwei in Sept 2026)	your browser wallet, the chip	☐

Tools

Everything is tools/quorum. tools/quorum doctor checks what’s installed.

Command	What
serve	the simulated Family Safe (rung 0)
up [--manual-exec]	anvil forking Base, plus the service on a real Safe (rung 1). --manual-exec makes it wait for live exec, as Safe’s real service does
e2e	rung 1 end to end with the emulator’s chip, checked onchain
live key [--from URL \| --usb \| --emu]	the console’s P-256 key and its owner address, kept in live.json (public values only)
live enroll --chain C	deploy the key’s signer proxy (about 110k gas)
live status --chain C --safe 0x…	the Safe and its queue, every signature checked here
live rehearse --chain C	the emulator’s console, with a throwaway key, signs on the real service: the spike before the Pico
live exec --chain C NONCE	execute, with the signatures laid out right (see Known issues)
live pico --chain C[,C…]	point the board’s console at the Safe recorded for each chain (QUORUM_SAFES); several chains are watched together (guide/NETWORKS.md)

C is local, basesep, base or eth.

How live sends. Writes go through your browser wallet, the one you co-sign with in the Safe web app: live opens a one-page form on 127.0.0.1 and the wallet shows the transaction and asks. --account NAME sends from a Foundry keystore instead, and asks you to type yes.

• Before either, the terminal shows the destination, the value, what it does and the estimated cost.
• No private key ever passes through these tools.
• Every send is logged in tools/mock-tx-service/live.json (gitignored).

Rung 1: the local fork

• A real Safe 1.4.1 on a fork of Base, the Family Safe at its pinned address, funded with ETH and USDC
• The chip’s signature through the signer proxy, checked with isValidSignature, and the transaction executes (e2e, about 110k gas with the precompile)
• Refusals still hold on a real chain: the tampered transaction is never signed
• The live tools rehearsed against it: live enroll, live rehearse, and live exec through the wallet page
• The real Pico, 2026-09-25 (with you at the board):
  1. tools/quorum up. It prints the QUORUM_URL line.
  2. Put that line in the board’s secrets.py, then tools/emu ship quorum.
  3. The Pico announces, and its signer proxy becomes an owner.
  4. tools/quorum demo, then approve #0 on the Pico. The Safe executes on the fork.
  5. Write it up in the buildlog.

Rung 2: Base Sepolia

Before you start:

• A browser wallet (MetaMask, Rabby…) with some Base Sepolia ETH, from the Superchain faucet (console.optimism.io/faucet), Coinbase’s CDP faucet, or Sepolia ETH bridged over.
• A Safe API key from developer.safe.global:
  • For the tools: SAFE_API_KEY= in the repo’s .env, which is gitignored (copy .env.example; tools/quorum doctor says whether it’s set without showing it). Paste it in with your editor, not on the command line, so it doesn’t land in your shell history.
  • For the Pico: QUORUM_API_KEY in the board’s own secrets.py, set at the switch to this rung. The board’s copy isn’t the same file as firmware/secrets.py, so add the line; don’t copy the laptop’s file over it.
  • Never in the repo or a chat. Without a key the service allows 2 requests a second and 5,000 a month.

Rehearsal: the emulator’s throwaway key. No hardware, and it settles the biggest unknown, whether api.safe.global takes the console’s confirmation.

• tools/quorum live key --emu
• tools/quorum live enroll --chain basesep
• Create a Safe in app.safe.global on Base Sepolia:
  • owners: your wallet, and the signer address live key printed
  • threshold 2
• tools/quorum live status --chain basesep --safe 0x…. Then send the Safe 0.001 ETH.
• In the web app, propose sending 0.0001 ETH somewhere, and sign it with your wallet.
• tools/quorum live rehearse --chain basesep: the service holds the emulator’s confirmation.
• tools/quorum live exec --chain basesep <nonce>, sent from your wallet. Record the explorer link.

The real Pico (with you at the board). Its own key needs its own Safe, or it has to be added to the rehearsal Safe as an owner.

• tools/quorum live key --usb. Check the address against the Pico’s owners page (B, This key).
• live enroll, then a Safe with your wallet and the Pico’s signer.
• On the board, in secrets.py:
  • QUORUM_URL = "https://api.safe.global/tx-service/basesep"
  • QUORUM_SAFE = {…}, QUORUM_API_KEY, QUORUM_POLL_S = 20
  • Then tools/emu ship quorum.
• Propose in the web app, approve on the Pico, live exec. Record the link in the buildlog.
• Measure the Pico’s free heap after HTTPS and a real queue response. Real responses carry dataDecoded, so lower the limit if it doesn’t fit.

Rung 3: Base, a few dollars

Same steps as rung 2 with --chain base and QUORUM_URL = ".../tx-service/base". The plan (2026-09-25):

1. The signer. tools/quorum live enroll --chain base for the sealed slot 0 key, owner 0x2843…5E53. The deploy is paid from MetaMask, about $0.002: tx.
2. The Safe. Jason creates it in app.safe.global on Base:
   • owners: MetaMask 0x61D2…637F, the Pico 0x2843…5E53, and his other wallet 0x1289…f2DA
   • threshold 2
   • Not the emulator’s key, which is public. The Safe: 0xDebDE58b3ed0867d19285f6C8B0d81AdBC326Da9. Its owners are MetaMask, the Pico and 0xb78e…AdBD8 (an EOA, not the 0x1289… in the plan; confirmed Jason’s on 2026-10-06).
3. The check (2026-09-25): Safe 1.5.0 L2, whose singleton and handler match safe-deployments for 8453. 2 of 3, nonce 0, no guard, no modules. live status --chain base --safe 0x…, plus the version, owners, threshold, modules and guard read onchain, and the singleton and handler matched against safe-deployments.
4. Funding. A small amount of ETH to the Safe, about $1.
5. The Pico switches to Base: tools/quorum live pico --chain base, or --chain basesep,base to keep watching the Sepolia Safe too (QUORUM_SAFES; each chain’s service comes from quorum_cfg.py, so QUORUM_URL goes). The same API key.
6. One approval:
   • Propose a small send and sign it with MetaMask: in the web app, or in the PicoQuorum app (docs/app/, New transaction).
   • The Pico approves over HTTPS.
   • Try Execute in the web app. Expect GS021, and capture it for upstream: a screenshot, the simulation link, the app version.
   • Then live exec --chain base.
7. The milestone: the same with the Pico on another Wi-Fi (a phone hotspot will do).

Costs. About $5 of ETH on Base in your wallet is plenty. Each of these is a fraction of a cent: signer 110k gas, a Safe 310k, an execution 110k.

Before any real money, on the board (and the chip: LOCKING.md):

• The production image, tools/fw push console. It boots straight into the console, and nothing else on the board can sign or touch the chip. tools/fw verify should be all green, and the build id shows on Device (X). Build 20464b0, 2026-09-26.
• A backup from tools/fw backup, copied somewhere outside the repo (it holds secrets.py). Taken 2026-09-26 (backups/025997e61befcde3/); the copy outside the repo is still to do.
• The pin, tools/fw pin: the chip’s serial, slot 0 locked, owner 0x2843…5E53. The console signs nothing else.
• TLS verified: Device (X) says verified. On the board, the compiled image from a mount passed 8 of 8 verified polls, and badssl.com’s four bad certificates were refused on the certificate itself (buildlog 2026-09-26).
• The watchdog tested once: the board resets itself on a hang, and log.txt says so. Interrupts off for 12 s: it reset, and the console came back by itself.
• ENABLE_NETWORK_CONSOLE = False. The network console is a passwordless REPL, and it can sign (the production image ignores it anyway).
• ALLOW_GENKEY = False and ALLOW_LOCK = False (ignored by the production image too).
• Don’t make a new key in slot 0 while it owns a Safe. The owner address comes from the key, so a new key is a new owner, and the old one is gone. The plan is to lock slot 0 (only) once rung 2 has proven it: LOCKING.md.
• The Safe keeps a second owner that isn’t the chip: your wallet. Losing the Pico must not lose the funds.

Milestone:

• A remote approval: the Pico on a different Wi-Fi, the proposal from your wallet.

Rung 4: Ethereum mainnet, a few dollars

Same steps with --chain eth. The console can watch it alongside Base: live pico --chain base,eth.

• Checked onchain: the passkey factory has the same code as on Base, and the Daimo verifier, the P-256 precompile (Fusaka, EIP-7951), Safe 1.4.1 and api.safe.global/tx-service/eth are all there.
• The console’s config for chain 1 (2026-09-26). quorum_cfg.py lists are per chain now, with Ethereum’s USDC, and MultiSendCallOnly 1.4.1/1.3.0 and Permit2 under "*". All of them have code on mainnet. node tools/vectors/webauthn.mjs --chain eth passes every vector: getSigner gives the same owners as on Base Sepolia, isValidSignatureForSigner accepts them, and the precompile at 0x100 is live. Nothing was sent.
• live enroll --chain eth, then a Safe on Ethereum (real gas: say yes first).
• At 0.05 gwei an execution is about 5.5e-6 ETH. Check cast base-fee first: L1 gas moves more than Base’s.
• The same checklist as rung 3, then one approval.

The Trust M rung

The same ladder for the OPTIGA Trust M (TRUSTM.md). The shareable docs are in mainnet/.

• TM1 sealed on the device (T7, 2026-09-29). Owner 0x47c0998C6a7A1955794071b9f4058e7814178f35.
• Base Sepolia (2026-09-30):
  • TM1’s signer is deployed.
  • It is an owner of the 3-of-5 0x5617…DC41, via swapOwner.
  • Its first approval executed: 0xeae9…6e2f.
• The ceremony record mainnet/attest/attest-0a091b5c000b0062006c.json (2026-10-01). tools/quorum verify --chain basesep,base,eth passes: getSigner agrees on all three chains.
• T9 on silicon, the sacrificial chip TM2 (2026-10-01): all 23 spares frozen, and every refusal confirmed (TRUSTM.md, “TM2”).
• T9 on TM1.
• The mainnet chip:
  • A fresh chip (TM3), with the F1D2 decision made first.
  • Its ceremony and record.
  • Every co-signer runs verify.
• Mainnet gas, after an explicit yes: live enroll --chain eth, the 3-of-5 Safe, one approval (rung 4’s checklist).

Known issues

• The Safe web app can’t execute these. With a threshold of 2 or more, it drops a contract signature’s data and the Safe reverts with GS021. Propose and sign there, then execute with tools/quorum live exec.
• The signer proxy must be deployed before the console confirms. The service checks the signature with an eth_call to it. live enroll does the deploy.
• Service quota. 50,000 requests a month with an API key, 5,000 without. With several Safes the console asks about one per poll, in turn, so the rate stays the same.
  • Over HTTPS with a key, the console polls every 20 s, then every 600 s after 10 quiet minutes. Without a key it is 60 s / 1800 s. QUORUM_POLL_S and QUORUM_IDLE_POLL_S override these.
  • A poll is one request: the Safe’s owners and nonce are fetched every 5th poll, when the queue changes, and after a confirmation.
  • That comes to about 12,000 a month with an hour of active use a day. Device (X) counts the requests since boot.
• Rejecting on the console doesn’t reject on the Safe. Y only hides the transaction on that console, and the queue stays blocked at that nonce until someone replaces it. The app’s Propose a rejection proposes that replacement (a zero-value self-call at the same nonce).
• Anvil’s public test accounts are booby-trapped on real chains. On Base mainnet each carries an EIP-7702 sweeper. The fork wipes it; never send anything to them for real.
• OP Sepolia has no hosted Safe service. OP mainnet does (oeth), if we want it later.
• Later: Safe’s main branch adds native P-256 owners (unreleased and unaudited). They would replace the proxy and the WebAuthn wrapper. All of that lives in firmware/webauthn.py.

Open questions

• Should Y also offer to propose the Safe’s own rejection (a zero-value self-call at the same nonce)?
• Which slot, and when to lock it? Slot 0, sealed (LOCKING.md). Fresh chips get quorum v1 and its ceremony (PROVISIONING.md).
• Owner, threshold and module changes stay signable with the 3 s red hold; the chip swap needs swapOwner. Refuse them on the Pico instead, or ask for the 4-hex verify code?
• The console reads the Safe’s owners and threshold from the service. Should it check them onchain over an RPC too? It would need its own pinned certificate.
• Is a browser-wallet executor enough for rung 3 and up, or does the console want to execute too (it would need gas money on a hot key)?