# Tezos X Developer Toolbox v19 — Production Wallet Integration

## Scope

Wired a production-grade, unified wallet layer onto the **multisignature.io
essay page** (`24-multisignature-publication/site-snapshot/`), building on the
provided foundational UI. Two rails behind one connect surface:

- **Tezos L1 — octez.connect (TZIP-10).** Replaces the deprecated
  `@airgap/beacon-sdk` CDN bundle the page previously loaded. Drives the signed
  comments, the wallet-gated annex, and the proof flow (tz1/tz2/tz3).
- **Etherlink EVM — WalletConnect v2 via Reown AppKit.** For the EVM rail of
  Tezos X / Etherlink. `personal_sign` for EVM-side proofs.

Both rails share one session model and one event bus, exposed as
`window.MSIG_WALLET`.

## What changed

### New — `js/tezos-wallet.js` (the unified adapter)
The single wallet surface for the whole page. Every other module talks to it,
never to a wallet SDK directly. API: `connect(rail)`, `disconnect()`,
`signTezos(msg)`, `signEvm(msg)`, `getAccount()`, `isConnected()`,
`packMicheline()`, and an `on/off` event bus (`change|connect|disconnect|error`).
SDKs are **lazy-loaded on first connect** (pinned esm.sh URLs, overridable in
config), so the page is always deployable as a static file and degrades
gracefully when a rail is unconfigured.

### Refactored — `js/comments.js`
Now consumes `window.MSIG_WALLET` instead of instantiating Beacon's
`DAppClient`. The entire UI, modal, storage fallback, and — crucially — the
**nonce-bound signed-message format** are preserved unchanged, so signatures
still verify against the existing forge-proof backend and replay protection
still holds.

### New — `js/gate.js` (wallet-gated annex)
Connect → fetch one-time nonce → sign an address+nonce-bound challenge → POST to
the backend, which re-verifies, checks the allowlist, burns the nonce, and
returns the annex HTML. The gated material never ships in page source.

### New — `js/proof.js` (proof of publication)
Recomputes a SHA-256 fingerprint over the normalised essay text and compares it
to the author's configured on-chain attestation, rendering the proof badge
(authenticated / mismatch / live-fingerprint-only). No wallet required.

### New — `js/muhkoo.js` (the Reading Room)
The end-to-end-encrypted companion discussion (@muhkoo/connect), lazy-loaded and
gracefully disabled when unconfigured.

### Page — `index.html`
Rebuilt on the foundational UI: externalised CSS to `styles.css`, added the
`MSIG_CONFIG.wallet` block (Tezos rail + WalletConnect/Etherlink rail), added the
proof badge, the wallet-gated annex, and the Reading Room, marked the essay body
`data-essay-content` for fingerprinting, and replaced the Beacon CDN tag with the
production script tail (adapter first, then consumers).

## Validation (run, not asserted)
- **End-to-end signing contract (real Tezos signatures): 6/6.** A comment signed
  through the adapter verifies against the real backend; replay with a fresh
  nonce, tampered comment, and spoofed address are all rejected; the annex
  challenge verifies and is replay-protected.
- **Headless DOM smoke (jsdom): pass, no script errors.** The page parses, config
  loads, the adapter exposes its full API, and all feature modules initialise
  against the real DOM; the gate and proof start correctly hidden.
- **Toolbox smoke: 57 tests, 52 pass, 5 skip, 0 fail** offline; **55 pass / 2
  skip** with crypto deps. A new dependency-free regression test asserts the
  production wiring (no Beacon CDN tag, adapter loads before consumers, every
  referenced script exists, every bound id present, nonce binding preserved).
- `engine doctor` 11/11; `46-toolbox-doctor` verdict **pass**; release-integrity
  regenerated; no duplicate prefixes; no stray files.

## Deployer checklist (the only things to set)
1. `MSIG_CONFIG.api` → deployed signed-response/annex Worker URL (enables the
   shared comment wall + annex; empty keeps local-only demo + locked annex).
2. `MSIG_CONFIG.wallet.walletConnectProjectId` → your Reown project id (enables
   the Etherlink EVM rail; free at dashboard.reown.com).
3. `MSIG_CONFIG.proof` → the essay's on-chain attestation (from `tools/anchor.mjs`).
4. `MSIG_CONFIG.muhkoo.apiKey` / `baseUrl` → to enable the Reading Room.

## Verify-before-production
- The Etherlink chain id (42793) and any Tezos X unified-EVM previewnet values
  are carried as defaults and must be confirmed against the live network before
  production.
- octez.connect / Reown AppKit ESM URLs are pinned to major ranges on esm.sh; a
  deployer who vendors the SDKs can point the config at local URLs.