# iOS Cold Wallet — Plan 10 Face ID Smoke Test

Tests biometric unlock end-to-end. **Requires a real iOS device with
Face ID or Touch ID enrolled** — iOS simulator's biometric simulation
only works in UI test targets, not via interactive use.

## Setup

1. Build for device (`xcodebuild build` or Cmd+R targeting your device).
2. Have at least one encrypted wallet — either created via the Plan 4
   keygen flow with a password, or restored + then encrypted via
   Change password (Plan 6).
3. Confirm iOS Settings → Face ID & Passcode shows a working enrollment.

## Path A: Enroll Face ID

1. Tap into the encrypted wallet. Enter the password to unlock.
2. Tap the gear → Settings. Confirm a new "Security" section appears
   between "Actions" and "Danger zone".
3. Verify the toggle label reads "Enable Face ID" (or "Enable Touch ID"
   on a Touch ID device).
4. Toggle it ON.
5. iOS pops the biometric prompt with body text "Save unlock for this
   wallet". Authenticate.
6. Toggle stays ON. No error appears.
7. Back to Wallets list. Confirm the wallet's row now shows a small
   Face ID / Touch ID icon next to the chevron.

## Path B: Unlock via Face ID

1. From the Wallets list, tap the enrolled wallet row.
2. iOS pops the biometric prompt with body text "Unlock <walletLabel>".
3. Authenticate. App pushes WalletHomeScreen immediately (no password
   alert appears).

## Path C: Fallback when biometric is cancelled

1. From the Wallets list, tap the enrolled wallet row.
2. When the iOS biometric prompt appears, tap Cancel.
3. App falls through to the password alert. Enter the password manually.
4. App pushes WalletHomeScreen. Keychain entry remains intact.
5. Confirm by tapping back to Wallets list and tapping the wallet again
   — Face ID prompt fires normally.

## Path D: Re-enroll on password change

1. Open the enrolled wallet (via Face ID or password). Gear → Settings →
   Change password.
2. Enter current password + a new password + confirm. Tap "Set password".
3. iOS pops a second biometric prompt with body text "Save unlock for
   this wallet" — this is the re-enroll.
4. Authenticate. Screen dismisses to Settings.
5. Pop back to Wallets list. Tap the wallet again. iOS pops the biometric
   prompt for unlock. Authenticate. App opens the wallet (using the new
   password stored in Keychain).

## Path E: Stale Keychain recovery

This path simulates what happens if the wallet password is changed
outside the iOS app (e.g., via the desktop Armory tools sharing the same
wallets dir, or via a manual Wallets directory copy).

1. Enroll Face ID per Path A.
2. From a separate device (or by manually editing the wallet file with
   the password changed via the desktop Armory cold-side CLI), change
   the wallet password.
3. From the Wallets list, tap the wallet. Face ID prompt fires.
4. Authenticate. The retrieved (now-stale) password fails `walletInfo`.
5. App shows the password alert with note "Face ID expired — enter
   password".
6. Enter the new password manually. App opens the wallet.
7. The biometric badge on the Wallets list row is GONE (Keychain entry
   was wiped). Settings → Security toggle is back to OFF.

## Path F: Disable Face ID

1. Open an enrolled wallet. Gear → Settings → Security.
2. Toggle Face ID OFF.
3. No biometric prompt fires (delete doesn't require auth).
4. Pop back to Wallets list. Row no longer shows the biometric badge.
5. Tap the wallet. Password alert fires immediately (no biometric attempt).

## Path G: Delete wallet cleans up Keychain

1. Enroll Face ID per Path A.
2. Open the wallet. Settings → Delete this wallet.
3. Type DELETE + password. Tap Delete forever.
4. Wallet disappears from Wallets list.
5. (If you re-create the wallet from the same seed, returning the same
   fingerprint) — the new wallet's row does NOT show a biometric badge,
   confirming the Keychain entry was deleted.

## Path H: Biometric strictness

This path verifies the `.biometryCurrentSet` rule: changing the device's
biometric enrollment invalidates the Keychain entry.

1. Enroll Face ID per Path A.
2. Quit the app.
3. iOS Settings → Face ID & Passcode → "Reset Face ID", then re-enroll
   Face ID with the same face. (Or add a second face on Touch ID
   devices.)
4. Re-open the Armory Cold app.
5. Tap the wallet row. The Face ID prompt may fire BUT iOS will return
   an error (the Keychain entry was auto-invalidated by iOS).
6. App falls through to the password alert with the "Face ID expired"
   note. Enter password manually.
7. The biometric badge is gone. User can re-enable from Settings.

## Pass criteria

- Face ID enrolls successfully (Path A).
- Face ID unlocks successfully (Path B).
- Cancelling biometric falls back to password without errors (Path C).
- Password change re-enrolls automatically (Path D).
- Stale Keychain recovers gracefully (Path E).
- Disabling Face ID works without prompts (Path F).
- Deleting wallet cleans up Keychain (Path G).
- Re-enrolling iOS biometrics invalidates the entry (Path H).
- No outbound network activity at any point (cold wallet stays
  air-gapped).
