Phase 3: on-device Cashu wallet with mbedTLS secp256k1 + SPIFFS persistence + PSRAM

- wallet.c/h: secp256k1 ECP primitives (hash_to_curve, scalar_mul, point_add)
- wallet_persist.c/h: SPIFFS persistence with threshold-based write protection
- Fee accounting for swap (input_fee_ppk from /v1/keysets)
- Keyset fetch via /v1/keysets (586 bytes vs 21KB for /v1/keys)
- Wallet API: GET /wallet, POST /wallet/swap, POST /wallet/send
- Payment proofs auto-stored to wallet + persisted on SPIFFS
- PSRAM enabled for large allocations (ESP32-S3 has 8MB)
- Wallet init deferred to dedicated task (avoids sys_evt stack overflow)
- Cashu proof ID buffer size fixed (66 hex chars, not 16)
- HTTP client: added fetch_headers() call for proper response handling
- persist_threshold_sats config parameter (default: 1 sat)

1 files changed, 73 insertions, 23 deletions

diff --git a/PLAN.md b/PLAN.md
index d43344b..2af8a39 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -2,12 +2,12 @@
 
 ## Overview
 
-Build a TollGate firmware for two ESP32 devices, following the [TollGate protocol spec](https://github.com/OpenTollGate/tollgate) (TIP-01, TIP-02, HTTP-01/02/03). The implementation uses ESP-IDF (C/C++) and integrates the nucula Cashu wallet.
+Build a TollGate firmware for two ESP32 devices, following the [TollGate protocol spec](https://github.com/OpenTollGate/tollgate) (TIP-01, TIP-02, HTTP-01/02/03). The implementation uses ESP-IDF (C/C++) with an on-device Cashu wallet using mbedTLS secp256k1.
 
 ## Architecture Decision: C/C++ (ESP-IDF)
 
 - Existing working captive portal is in C (ESP-IDF)
-- Nucula Cashu wallet is in C/C++ (ESP-IDF)
+- On-device Cashu wallet uses mbedTLS secp256k1 (hardware RNG, software ECP)
 - ESP-IDF is already installed at `~/esp/esp-idf`
 - No Rust/ESP32 toolchain installed
 
@@ -16,11 +16,12 @@ Build a TollGate firmware for two ESP32 devices, following the [TollGate protoco
 | Layer | Technology |
 |-------|-----------|
 | Framework | ESP-IDF v5.4.1 (C/C++) |
-| Cashu wallet | nucula `Wallet` class (Phase 3) |
-| HTTP server | `esp_http_server` (port 80 captive portal, port 2121 TollGate API) |
+| Cashu wallet | Custom mbedTLS secp256k1 wallet (hash_to_curve, blind signing, swap, send) |
+| HTTP server | `esp_http_server` (port 80 captive portal, port 2121 TollGate API + wallet) |
 | DNS | Custom UDP task (hijack unauthenticated, forward authenticated) |
 | NAT | lwIP NAPT |
-| Testing | Playwright + curl + pyserial |
+| Persistence | SPIFFS (960K partition) with threshold-based write protection |
+| Testing | Playwright + curl + nutshell CLI |
 | Build | Makefile |
 
 ## Four-Phase Plan
@@ -52,7 +53,7 @@ Build a TollGate firmware for two ESP32 devices, following the [TollGate protoco
 | 13 | Reset auth | GET /reset_authentication | 200 | PASS |
 | 14 | Internet blocked after reset | ping 8.8.8.8 | Fails | PASS |
 
-### Phase 2: E-Cash Payments — IN PROGRESS
+### Phase 2: E-Cash Payments — COMPLETE
 
 **Goal:** Replace free access with Cashu payment. ESP32 parses token, checks proof state via mint API, grants time-based session.
 
@@ -79,29 +80,78 @@ Build a TollGate firmware for two ESP32 devices, following the [TollGate protoco
 | 26 | Client isolation | Only payer gets internet | Non-payer blocked | Phase 3 |
 | 27 | Full e2e: portal→pay→browse | Playwright | Complete flow | Phase 3 |
 
-**Captive Portal Fix:** Added DoT reject server on port 853 (TCP RST forces DNS-over-TLS fallback to plain DNS), DNS hijack returns NXDOMAIN for all non-A query types, explicit 302 redirect handlers for all captive detection URIs. Needs verification with actual GrapheneOS phone.
+**Captive Portal Detection:** DoT reject server on port 853, NXDOMAIN for non-A queries, 302 redirects for captive URIs. Verified working on GrapheneOS (commit `236b61d`).
 
-### Phase 3: nucula Wallet + ESP32-to-ESP32 Payments — NOT STARTED
+### Phase 3: On-Device Wallet + ESP32-to-ESP32 Payments — IN PROGRESS
 
-**Goal:** Integrate nucula's full Cashu wallet. ESP32 holds balance, can be a reseller. ESP32-to-ESP32 direct payments.
+**Goal:** On-device Cashu wallet using mbedTLS secp256k1. ESP32 holds balance, can swap proofs, create tokens for P2P payments. Proof persistence via SPIFFS with threshold-based write protection.
 
-**11 Additional Test Cases:**
-| # | Test | Method | Pass Criteria |
-|---|------|--------|---------------|
-| 28 | Wallet boot | Serial | Keysets loaded |
-| 29 | Receive via wallet | POST :2121/ | Balance incremented |
-| 30 | Balance persists | Reboot | Same balance |
-| 31 | Payout routine | Wait + serial | Tokens melted to LN |
-| 32 | Reseller discover | Serial | Upstream TollGate found |
-| 33 | Reseller pay | Serial + API | Token POSTed upstream |
-| 34 | Multi-hop internet | Ping from laptop | laptop→A→B→internet |
-| 35 | P2PK receive | Post P2PK token | Auto-signed, accepted |
-| 36 | DLEQ verified | Post token with DLEQ | Verified, accepted |
-| 37 | 5 consecutive payments | Loop | All authenticated |
-| 38 | Stress: rapid pay/expire | Loop with short sessions | No crash/leak |
+#### Wallet Architecture
+
+- **Crypto**: mbedTLS secp256k1 (software ECP, hardware RNG via `esp_fill_random`)
+- **Blind signing**: `hash_to_curve()` (SHA256 try-and-increment), `scalar_mul()`, `point_add()`
+- **Unblinding**: `C = C_ + (order - r) * G` — avoids needing mint's public key K, avoids point negation
+- **Proof storage**: In-memory array (50 max), persisted to SPIFFS JSON
+- **Persistence**: SPIFFS `/spiffs/wallet.json`, only written when `balance >= persist_threshold_sats`
+- **Keyset fetch**: GET /v1/keys from mint on boot
+- **Swap**: POST /v1/swap — reissues proofs with new secrets
+- **Token creation**: Encode proofs as `cashuA` base64url token
+
+#### Wallet Endpoints (on :2121)
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | /wallet | Balance, proof count, keyset count |
+| POST | /wallet/swap | Swap all proofs for fresh ones via mint |
+| POST | /wallet/send | Create cashuA token for given amount (body = sat count) |
+
+#### Payment Integration
+
+Received payment proofs are automatically added to wallet after session creation in `tollgate_api.c`.
+
+#### Persistence Threshold
+
+Config parameter `persist_threshold_sats` (default: 1) controls when wallet state is written to flash:
+- `balance >= persist_threshold_sats` → write wallet.json
+- `balance < threshold` → skip write (or delete existing file)
+- Rationale: flash has finite write cycles (~100K erase per sector); only persist when e-cash value justifies the wear cost
+- SPIFFS wear-leveling spreads writes across the 960K partition
+
+#### Test Cases
+
+| # | Test | Method | Pass Criteria | Status |
+|---|------|--------|---------------|--------|
+| 28 | Wallet boot | Serial | Keysets loaded | TODO |
+| 29 | Receive via wallet | POST :2121/ | Balance incremented | TODO |
+| 30 | Wallet swap | POST /wallet/swap | Same balance, new proofs | TODO |
+| 31 | Wallet send | POST /wallet/send | Valid cashuA token returned | TODO |
+| 32 | Persistence survives reboot | Reboot + GET /wallet | Same balance | TODO |
+| 33 | Cross-board payment | B sends → A receives | A balance increases | TODO |
+| 34 | Two clients pay independently | Two POSTs | Both authenticated | TODO |
+| 35 | Client isolation | Only payer gets internet | Non-payer blocked | TODO |
+| 36 | Full e2e: portal→pay→browse | Playwright | Complete flow | TODO |
+| 37 | 5 consecutive payments | Loop | All authenticated | TODO |
+| 38 | Stress: rapid pay/expire | Loop with short sessions | No crash/leak | TODO |
 
 ### Phase 4: ESP32-to-OpenWRT TollGate Interop — NOT STARTED
 
 **Goal:** ESP32 can pay OpenWRT TollGate using Cashu tokens. Full interoperability with existing OpenWRT-based TollGate infrastructure.
 
 ## Total: 38 Tests across 4 phases
+
+## Key Technical Notes
+
+### mbedTLS 3.x Compatibility
+- `mbedtls_ecp_point` is opaque — cannot access `.X`, `.Y`, `.Z` directly
+- Use `mbedtls_ecp_muladd`, `mbedtls_ecp_mul`, `mbedtls_ecp_point_read/write_binary`
+- No point negation needed with `C = C_ + (order - r) * G` unblinding approach
+
+### Board Configuration
+- Board A: `/dev/ttyACM0`, MAC `94:a9:90:2e:37:7c`, SSID `TollGate-377C`, AP IP `10.55.85.1`
+- Board B: `/dev/ttyACM1`, MAC `fc:01:2c:c5:50:50`, unique SSID/IP derived from MAC
+- Both boards run identical firmware, unique config derived at boot from factory MAC
+
+### Test Mint
+- `testnut.cashu.space` — auto-pays lightning invoices for testing
+- `cashu -h https://testnut.cashu.space invoice <amount>` → auto-paid
+- `cashu -h https://testnut.cashu.space send --legacy <amount>` → generates cashuA token