[Open Source] Zero-Dependency Air-Gapped BIP-86 Cold Wallet w/ Live SHA-256

1. Introduction & Threat Model
The root problem with conventional Bitcoin self-custody is all the third-party trust required to make it work. Dedicated commercial hardware wallets require users to expose their physical identity and home shipping address to vendor databases, trust targeted hardware supply chains against interdiction, and trust closed-source wallet firmware updates. Meanwhile, conventional mobile and browser software wallets rely on sprawling third-party dependency trees (NPM), expose mnemonics to operating system keyboard and clipboard buffers, and store keys persistently on network-connected disks.

What is needed is a purely client-side, zero-dependency cold storage architecture based on cryptographic proof instead of wallet vendor trust—allowing any user to take an off-the-shelf smartphone they already own, verify the exact plaintext code loaded into local memory, generate keys offline in Airplane Mode, and automatically purge secret material from memory before reconnecting to the network.

We propose a solution to the self-custody trust problem using a static, 6-module plaintext browser enclave hosted on GitHub Pages at nahkahmotors.com. Because the entire implementation consists of just 6 unminified, dependency-free plaintext files (0 NPM) with no build pipeline or external compilers, any developer—or any non-coder pasting the files into an LLM—can inspect and audit the complete codebase from top to bottom in minutes.

2. Zero-Dependency Plaintext Enclave
To accomplish this without a trusted third-party build server or package manager, the system eliminates all external libraries (0 NPM) and compiled binaries. All cryptographic operations are self-contained across 6 static plaintext files.

All secp256k1 elliptic curve arithmetic, SHA-256-locked BIP-39 dictionary lookups, 600,000-round PBKDF2-AES-256-GCM key stretching, and ~3ms Zero-String RAM signing (BIP-340 / RFC-6979) execute 100% locally inside the client browser enclave. Public nodes (nah-core and mempool.space) only ever receive a public address query (GET /address/bc1...) or a pre-signed raw transaction hex (POST /tx); private keys and seeds never leave the local device.

3. In-Browser SHA-256 Self-Audit ("Verify, Don't Trust")
Even when source code is public, a user loading a client-side application must be able to verify that the exact files delivered to local memory are identical to the audited repository.

To solve this without requiring command-line tools, the enclave includes a built-in verification engine powered by the browser's native WebCrypto API (crypto.subtle.digest). Before going offline, the client reads its own loaded source files directly from local memory and computes live SHA-256 hashes for all 6 modules alongside the pinned BIP-39 wordlist. The system is secure against remote code substitution as long as the user confirms that these live digests match the frozen repository state (Deployments 128) prior to enabling Airplane Mode.

4. Air-Gapped Entropy, Zero-Keyboard Entry & Automatic Memory Purge
Once the in-browser checksums are verified and the device is placed in Airplane Mode, key generation occurs across a physical air-gap. Entropy is collected by combining the device's hardware CSPRNG (crypto.getRandomValues) with physical human touch-timing jitter across 10 interactive rolls via SHA-256 conditioning.

In conventional software wallets, typing or copying a recovery phrase exposes the secret to OS-level keyloggers, predictive text caches, and clipboard hooks. To close this vector, the 3-word mnemonic verification step uses a 100% Zero-Keyboard touch interface where the system keyboard and clipboard are never invoked.

Crucially, the state machine enforces an automatic post-verification memory purge: the exact moment the 3-word Zero-Keyboard check passes (or when the user clicks Wipe / Close), the setup module destroys the temporary mnemonic variables in memory and strips the seed DOM elements before deriving the public BIP-86 Taproot (bc1p...) receiving address. Because the mnemonic is already wiped from active memory at the verification boundary—and the audited plaintext modules contain no outbound transmission paths for secret data—the user can safely disable Airplane Mode afterward before closing the browser tab.

5. Immutable Repository State & Live Checksums
The repository is locked at GitHub Pages Deployments 128 (signed with GitHub's verified commit signature). Below are the exact byte sizes and SHA-256 digests computed by the live in-browser verifier:

Code:

GitHub Repository: https://github.com/geminibrc9999/nah-sovereign-diamond
Static Enclave (Deployment #128): https://nahkahmotors.com
Stacker News Technical Thread: https://stacker.news/items/1609795

LIVE IN-BROWSER SOURCE MODULES & SHA-256 HASHES:
1. nah-wallet.js (119,492 B)
SHA-256: 1acd74d363b1b550e0a8a7b7424135748bf4ed77c5013359ee43c1b9b11a13f4
2. nah-wallet-setup.js (50,732 B)
SHA-256: 0324509cbae53842a9ff495e15586eb90db13b5ebcf0839b74f68597d67e8818
3. nah-wallet-vault.js (78,316 B)
SHA-256: 4217249c1a3ff0061959111f235dded213f0ca99de1c0f677cdbc0e0085b9f9b
4. index.html (56,755 B)
SHA-256: 8919eaaa798980aeaaf400a50aa179acd2cb2a0da9e18c682978c69d5a7a55d1
5. nah-style.css (22,581 B)
SHA-256: d27fa7afba7c6aa6c72c933b02bbb553d88cf1fcf4a2bcf33cec59a7be4cfc27
6. nah-explorer.js (47,452 B)
SHA-256: be38ccd9a06bebc2f38c69c0a127a6485a350044d228436e5dde19511dd2fee2

• Official BIP-39 Wordlist SHA-256:
2f5eed53a4727b4bf8880d8f3f199efc90e58503646d9ff8eff3a2ed3b24dbda (Pinned & Frozen)
• Official BIP-84 / BIP-86 Test Vectors: PASSED 100%
• Security Architecture: 100% Zero-Keyboard Seed Entry + Forever Immutable Block Barrier

6. Verification & Execution Steps (Pure Cold Wallet)
The steps to audit and run the air-gapped Pure Cold Wallet are as follows:

1. Inspect the 6 plaintext source files in the GitHub repository (or paste them into an LLM for an independent line-by-line audit) and verify that the repository stands at Deployments 128.
2. Open nahkahmotors.com in a Private Browser Tab, select the "NAH COLD / COOL WALLET" tab, scroll to the bottom, and click "VERIFY, DON'T TRUST".
3. Confirm that the live SHA-256 hashes computed in-browser match the checksum table above for all 6 modules and the BIP-39 wordlist.
4. Enable Airplane Mode to sever all network connections, click "Create Pure Cold Wallet", complete the 10 interactive entropy rolls, and record the 12-word mnemonic on physical paper.
5. Complete the 3-word Zero-Keyboard confirmation (which automatically purges the mnemonic from active memory and derives your public bc1p... Taproot address) or click Wipe / Close—after which you may safely turn Airplane Mode off and close the private tab.

Note on Browser Tabs (Pure Cold Wallet vs. Cool Wallet): For stateless Pure Cold Wallet generation above, we recommend using a Private Browser Tab so the browser records no local browsing history or disk cache. The enclave also includes an optional Cool Wallet mode (which stores a persistent 600,000-round PBKDF2-AES-256-GCM encrypted vault in local browser storage for everyday signing); for Cool Wallet usage, the interface recommends a normal (non-private) browser tab so the encrypted ciphertext is not erased by the browser when the tab closes.

We welcome independent cryptographic review, source code audits, and technical feedback from the community.