Reference

The repository's docs/ directory carries the deep technical record. These are the ones most people need, with the key facts inline.

Using the device

identity.md — what the device claims to be: AAGUID 66617069636F3200…0002, USB FA20:0002, and the PC/SC allowlist step Linux/macOS need before OpenPGP and OATH work.
backup-seed.md — the vendor seed's full record: scope, wire notes, the CLI's failure statuses, and what the tests prove.
bootsel.md — flashing over BOOTSEL, recovery paths, and why re-enumeration can take a minute.
capacity.md — hardware-verified ceilings: 848 FIDO2 resident credentials measured to refusal on hardware (8 slots of the original range are the Nostr reservation), 68 OATH slots reserved.
hardware-matrix.md — the acceptance matrix: USB IDs, algorithms, per-applet results against real clients.

secureboot.md — the RP2350 signed secure boot procedure: opt-in, burned once, irreversible.
debug-access-risk.md — the accepted-risk record for the open debug port until the first -release tag.
supply-chain.md — dependency vetting, SBOM and accepted RustSec advisories, CI-gated.
SECURITY.md — how to report a vulnerability privately.

Security assessments — three red-team assessments published in full: round 2 (the deep record), round 3 (the same-day report), and the round-3 remediation record marking every finding FIXED, accepted or open, with the hardware evidence.
secure-storage-comparison.md — the adversarial comparison of the key-at-rest design against per-record flash stores.
ADRs — architecture decision records: provisioning policy, TrustZone, and the ECC/RSA baseline.

ctap2-hid-framing.md — the CTAPHID wire format, for driving CTAP2 by hand.
client-compatibility.md — client-side quirks no firmware change can fix, and which side has to absorb each one.

Projects in this space worth knowing: