[brow]

Follow-up to #8654, from Kalvin's review note.

native_toolchain_c's CBuilder registers only the listed C sources (and files under includes) as build-hook dependencies. The buzz_secp256k1 hook lists four sources and no headers, so after an initial build a header-only vendor update (for example src/modules/schnorrsig/main_impl.h) could reuse the old library in incremental app and test builds. The hook now also registers every .h file under the vendored tree. It does not add include paths, so compilation is unchanged.

Validation

• With the change, editing the content of third_party/secp256k1/src/modules/schnorrsig/main_impl.h makes the next dart test rebuild libbuzz_secp256k1.dylib. Without it, the library is reused unchanged.
• The hook output now lists all 62 vendored headers as dependencies.
• Package tests pass (27).

buzz-review-completed (Codex and security review clean; agent verification above; build-only change, no app behavior to test)

🤖 Generated with Claude Code

[brow]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T23:33:48.129882Z	78b0a98	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 4ff02bf03b73b6e07ac45beca833652e0272478a...78b0a986b53bd70d4a7897daa1f3f0947cb27f17
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

The change registers vendored headers as native build dependencies. No concrete security, correctness, or reliability findings were identified in the authorized PR range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only source inspection. Builds and tests were not executed, as instructed.

---

_{Generated by Codex Security Review |
Requested by: @brow |
Workflow run}

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 78b0a986b5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jedwards27]

🤖 :bot: Jude’s code review agent — APPROVE

Reviewed PR #8664 at head 78b0a986b53bd70d4a7897daa1f3f0947cb27f17 against base 4ff02bf03b73b6e07ac45beca833652e0272478a.

No author-actionable defects found.

Why this looks correct:

• The PR is a one-file build-hook change in mobile/packages/buzz_secp256k1/hook/build.dart that adds vendored *.h files under third_party/secp256k1 to output.dependencies after CBuilder.library(...).run(...).
• The change does not alter native sources, compile defines, optimization, include paths, public API, assets, or runtime crypto behavior; it only records dependency inputs for incremental rebuild invalidation.
• The dependency gap is real: native_toolchain_c-0.17.6 records listed sources, includes, forced includes, and Dart build files, and this hook did not pass an includes list, so header-only vendor changes were otherwise outside the hook dependency set.

Regression-shaped evidence reviewed at the same head:

• Hook output recorded 66 dependencies: 4 C sources plus all 62 vendored headers, including public and internal secp256k1 headers.
• Mutating a vendored header caused the next dart test to rerun the native build hook; deleting third_party/secp256k1/src/modules/schnorrsig/main_impl.h caused clang to fail on that missing header instead of silently reusing a stale library.
• Restoring the header left the package tests green (27 tests), with dart analyze also passing.
• dart format --output=none --set-exit-if-changed mobile/packages/buzz_secp256k1/hook/build.dart and just mobile-check passed at the reviewed head.
• GitHub checks were still green for the mobile/native-relevant lanes at final freshness check: Mobile Checks, Mobile Tests 1/3–3/3, Mobile Android, Mobile Swift Native, Mobile Swift Release, Mobile Swift Results, Mobile result, DCO, Semgrep, and zizmor.

Residual risk: I did not require a manual simulator workflow or a full local Android/iOS app build for this build-cache dependency tracking change. CI covers the platform-native lanes, and the local mutation/deletion tests exercised the cache invalidation seam directly.

Author action: none.