[droplister]

What changes

Add an opt-in Casa Tookan adapter and wallet descriptor for mainnet Legacy, Native SegWit and BIP-86 Taproot. Sites can connect, restore/revoke sessions, obtain verified message proofs, sign selected inputs in shared PSBTs, and sign up to 20 PSBTs in one approval. Raw compose signing uses the existing PSBT fallback.

The adapter verifies input ownership against the active account, checks returned signatures against the original transaction and prevouts, retains existing signatures and proprietary metadata, rejects account changes and overlapping approvals, and validates the complete batch before returning any result. Legacy inputs require full parents. Each PSBT is capped at 64 KiB to avoid a reproduced dev-wallet preparation overflow.

Casa reports intentValidation: none. Application intents remain the site's responsibility; no wallet-validated marketplace bundles, paired-address grants, nested SegWit, multisig or script-path/commit-reveal support is advertised. Taproot messages declare ECDSA-BIP86 explicitly. Detection requires Casa's marker, so ordinary Unisat is not misidentified.

Confirmed custom-output boundary

Direct provider calls in the real dev wallet refuse untweaked and tweaked Taproot script paths, tree-bearing key-path recovery, nested SegWit and 1-of-1 P2WSH. The Bitcoin-provider alternative also refuses the script path. Each rejected engine fixture independently signs/finalizes with its known key; ordinary BIP86 signs successfully in Casa.

The adapter now reports taprootTreeKeyPath: false. Sites must not fund custom outputs whose recovery requires that capability. DigiRare's dependent PR blocks policy-offer creation while retaining acceptance and on-chain invalidation of original standard funding coins. XCP.fun gates new inscriptions before upload. These are upstream ownership restrictions, not simply unimplemented adapter options.

The alternative account API also returns incorrect address-type labels for the selected Taproot account, and its event methods are stubs. The current Unisat bridge remains the supported integration path. See docs/qa/casatookan-custom-scripts-2026-10-20.json and the updated development contract.

Validation

• 481 unit tests pass; TypeScript, targeted Biome checks and production build pass.
• Real official dev wallet 2.1.0 (bfbcddd-dirty): expanded adapter verified Taproot message proof, shared PSBT v2 with a preserved foreign signature and successful finalization, reusable 131-sighash authorization, and an ordered 20-transaction mixed-sighash batch.
• Prior research: 28 provider/UI scenarios, 69 exact-engine probes and selected-input preservation checks. docs/casatookan-dev-spec.md separates observed provider behavior from engine-only results.
• All signing fixtures used unfunded disposable keys and synthetic prevouts. No broadcast. Native iOS/Android lifecycle and funded settlement remain unverified.

Evidence: docs/qa/casatookan-adapter-2026-10-20.json, docs/qa/casatookan-2026-10-20.json, and docs/casatookan.md.

Site PRs: XCP/exchange#32, XCP/marketplace#454, XCP/launchpad#65, XCP/landing#1, XCP/xcpfolio.com#4. Explorer metadata is XCP/explorer#36. All site integrations remain build-time opt-in pending installed-device QA.

[ShabanShaame]

Thanks a lot for this, Dan: the report is precise and every point checked out on our side. Here is where each one stands.

Fixed, live on the web dev wallet now (https://devapp.casatookan.com, version.json → commit a9fdf17, built 2026-11-02):

• autoFinalized: window.unisat.signPsbt / signPsbts now read Unisat's autoFinalized (autoFinalize is still honoured). Either one set to false returns the PSBT partially signed.
• CasaTookanBitcoinProvider events: no longer stubs. addListener / on return their unsubscribe function; accountChange (no addresses, re-read them with getAddresses) and accountsChanged (the Bitcoin addresses, as window.unisat sends them) fire when the site is moved to another casa.

Already fixed before your test, on devapp since 2026-10-25 (your run was on the 2.1.0 bfbcddd build):

• Large PSBTs: the Maximum call stack size exceeded in PSBT preparation is fixed (base64 conversion in 32 KB chunks). A 262 KB PSBT goes through.
• Taproot labels: with Taproot selected, getAddresses labels the payment / counterparty entries p2tr with an x-only key, no longer p2pkh.

Not changed:

• Taproot script paths, tree-bearing key-path outputs, nested SegWit and P2WSH stay unsupported. taprootTreeKeyPath: false and the DigiRare / xcp.fun gates are the right call for now.
• intent metadata is still not validated by Casa; intentValidation: "none" is accurate.

⚠️ Important for the mobile apps: the iOS / Android version already approved by the App Store and Google Play, about to be released (2.1.1), does not contain the two fixes above (autoFinalized and provider events). They will ship in the next store version. The large-PSBT and Taproot-label fixes are in 2.1.1. Until the next release, on phones, keep sending autoFinalize: false (as your adapter already does) and keep relying on the Unisat bridge for account changes.

To re-test on the web: open devapp, check https://devapp.casatookan.com/version.json shows a9fdf17 or later, and re-run your size and event cases. The 64 KiB cap can be raised there; on phones keep it until you have tested on an installed device.