Cambium

Cambium is an Android NIP-55 signer that holds no user keys. Cryptographic results come from a paired Heartwood hardware signer over NIP-46 (Nostr relays), با only safe, exact repeats answered from bounded per-identity caches. Amethyst, Primal و most other Amber-compatible Android Nostr clients cannot log in to a remote NIP-46 bunker directly, but they همه پشتیبانی می‌کند از signing in via any installed NIP-55 external signer. Cambium fills that gap: it registers as a signer, but it is not one. It is a thin پروکسی that sends uncached NIP-55 work to شما hardware signer و hands the result back. Security model: - No user secrets ever touch the phone. Cambium stores only the bunker pairing (the paired signer's public key, its relay list, و the per-pairing connection secret) و Cambium's own ephemeral NIP-46 client keypair. Compromising the phone exposes the ability to request signatures — which the hardware signer's policy engine و physical confirmation button still gate — never the identity key itself. - همه pairing state lives in Android Keystore-backed encrypted storage. - Per-برنامه approval is tracked locally, علاوه بر این to whatever the hardware signer's own policy enforces. The signer remains the authority on what actually gets signed. - همه NIP-46 payloads are NIP-44-encrypted. - Phone unlock is the one exception, و it is opt-in: a Heartwood set up to be unlocked from this phone gives it an unlock secret برای that board. It signs nothing, is useless بدون the board's own flash, و is released only by شما screen lock, once per unlock. Features: - Pair by QR scan or pasted bunker:// URI; multiple identities, each fully isolated. - NIP-55 intent handling: get_public_key, sign_event, nip04/nip44 encrypt و decrypt, decrypt_zap_event (private zaps, recipient path), current_user identity selection. - Website NIP-55 support through nostrsigner: links, با explicit one-shot approval و a validated HTTPS callback or clipboard result. مرورگر approval is never remembered. - A silent content-provider path answers already-approved برنامه‌ها بدون any visible popup. - Per-identity bounded priority queues reserve room برای user work. Exact relay-authentication duplicates coalesce و cache briefly; distinct AUTH bursts are admitted one at a time, never retried internally, و paused برای 60 seconds after a transport failure. - Native approvals can be once, برای an hour or day, or indefinite, با operation و signing-kind limits. Review, edit or forget choices in the connected-برنامه‌ها list; denial remains permanent. - Clear request summaries و bounded, temporary request details, با private و encrypted content hidden. - Rename paired identities, check connection سلامت و last مخاطب, و explicitly test or reconnect. Supported signers can securely update their NIP-46 transport relays. - Native NIP-55 signing batches return ordered results و per-request rejections. - Optional keep-warm foreground service so silent signing skips the reconnect penalty. - Phone unlock: a Heartwood that restarts locked after a power cut asks this phone to unlock it. The اعلان names the board, why it restarted و on which network, و warns that anyone holding the board can make it ask. One tap و شما screen lock unlock it. Nothing on the wire names the phone. - Says when a paired signer has gone quiet (a power cut or network problem at the board). - A metadata-only activity log با safe failure categories, timings و برنامه/identity/outcome filters. Review a redacted diagnostic report before explicitly sharing it; no event content, credentials, relay addresses or identifying labels are exported. - Optional biometric or device-credential برنامه lock on the management screen و approval decisions. No Google Play services, no Firebase, no analytics. Runs on any 64-bit Android 8.1+ device, شامل GrapheneOS.