1b719e1fd7
Clean successor to V3 (forge: lilith/atlilith). Seeded from local Mac working tree at ~/Code/@projects/@cocottetech/. node_modules and build artifacts excluded via .gitignore. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
19 KiB
@hardware — Ideas
Capture log for hardware-product ideas in the cocottetech lineage. Newest first. Status values: captured · exploring · committed · dropped.
membership-wallet — bundled hardware wallet with global radio SIM
- Date: 2026-05-18
- Status: captured
Pitch
A hardware wallet included as a standard-tier membership benefit. Built-in global radio-network SIM gives it independent connectivity (no phone tether, no wifi). Form factor and interaction model are calculator-like — physical keypad, small display, deliberate haptic UX.
Physical concept (credit-card form factor)
┌──────────────────────────────────────────┐
│ ◉ cocotte ▒▒ SIM │ <- radio status LED + eSIM mark
│ ┌────────────────────────────────────┐ │
│ │ 0.0421 ₿ → @lou │ │ <- e-ink display
│ │ balance peer / amount │ │
│ └────────────────────────────────────┘ │
│ │
│ ┌───┐ ┌───┐ ┌───┐ ┌─────┐ │
│ │ 7 │ │ 8 │ │ 9 │ │ ÷ │ │
│ ├───┤ ├───┤ ├───┤ ├─────┤ │
│ │ 4 │ │ 5 │ │ 6 │ │ × │ │
│ ├───┤ ├───┤ ├───┤ ├─────┤ │
│ │ 1 │ │ 2 │ │ 3 │ │ − │ │
│ ├───┤ ├───┤ ├───┤ ├─────┤ │
│ │ . │ │ 0 │ │ ⌫ │ │ + │ │
│ └───┘ └───┘ └───┘ └─────┘ │
│ │
│ [ MENU ] [ ◉ SEND ] [ = / CONFIRM ]│
└──────────────────────────────────────────┘
~ credit-card footprint, ~3–4 mm thick
~ e-ink for battery life + sunlight readability
~ tactile keypad (no touchscreen — plausible-deniability calculator vibe)
~ NFC patch on the back for tap-to-pair peer transfers
~ eSIM + LTE-M / NB-IoT modem inside; antenna ringing the perimeter
~ universal Qi wireless charging (works on any iPhone/Android pad,
any café dock — NO proprietary puck). Wired data port is
optional / recovery-only; see Open questions.
Edge / back view:
front: [ display + keypad — looks like a pocket calculator ]
back: [ NFC tap zone ] [ ◡ smooth pogo indent ] [ serial ]
(recovery QR window etched flush)
edge: (no port) status LED
charging is wireless — universal Qi, any pad
optional pogo pads for factory recovery only
Function
- Retrieval surface for E2EE + crypto. Holds the keys / recovery material needed to decrypt member content and authorize crypto operations. Framed as retrieval, not deep cold-storage.
- Peer-to-peer instant transfers. Two members with wallets can transact directly, calculator-to-calculator — punch in an amount, confirm, done. Settlement rides the radio mesh, not the member's phone or local network.
Why it matters (membership angle)
- Standard-tier inclusion (not an add-on) makes it a defining benefit of joining, not a SKU. Hardware-in-the-box anchors membership identity.
- Independent radio = works in venues / tours / travel where phones are off, dead, or locked down.
- Calculator UI is plausibly deniable: looks like a calculator at a glance. Useful in environments where a "crypto device" would be a tell.
Decided
- Recovery model: the platform holds a recovery share. Member loses the wallet → platform-held share + member identity proof restores access. Explicitly trades some sovereignty for member-friendly recovery, consistent with membership framing.
- Pairing transport: NFC. Tap-to-pair is the only introduction mechanism (no QR, no BLE-discover-in-the-air). Session channel that follows the NFC handshake is still TBD (BLE vs radio-mesh).
- Charging: universal Qi primary + bundled ultracompact USB-C→pogo
adapter. Two paths, both common:
- Primary — universal Qi (WPC). Any random pad works: iPhone MagSafe, Android Qi, hotel nightstand, café dock, friend's charger. No proprietary inductive puck — Apple-Watch-style chargers are explicitly rejected (loseable, uncommon, hostile UX for a membership-grade device).
- Bundled accessory — ultracompact USB-C → pogo adapter. Tiny first-party clip (think keyring-sized) that takes any USB-C cable on one end and lands magnetic pogo pins on the wallet's back pads on the other. Lets a member top up from any laptop / phone charger / power bank without needing a wireless pad. The same pads double as the factory-recovery contact (single hardware surface, two roles). Members never need to carry a wallet-specific cable — they bring their existing USB-C cable + the matchbook-sized adapter, or just drop the wallet on any wireless pad.
- Brand: ships under cocottetech (Cocotte public umbrella — see brand-family memory). Not Demimonde-branded, not co-branded with Sansonnet.
Peer pairing + direction (calculator-to-calculator)
The core interaction: two members want to move crypto. How do their wallets find each other, and how does each side know who's sending vs who's receiving?
Pair (proximity, ~seconds):
[A] ─── tap backs together ─── [B]
NFC handshake (UID exchange)
│
▼
BLE / radio-mesh secure channel opens
ephemeral session key derived
NFC is the introduction (intentional, physical, can't happen by accident in a crowd). BLE / the radio mesh carries the actual session — NFC's range is too short to hold the channel through the rest of the UX.
Declare direction (hardware toggle — three positions):
A physical slide / rocker switch on the edge of the card with three detents. The switch position is the wallet's mode — there's no software state to be spoofed, and a glance tells you what the device will do next.
┌──────────────────────────────────────┐
│ ◀── [ LOCK | SEND | RECV ] ──▶ │
│ ▲ ▲ ▲ │
│ │ │ └─ accepts incoming transfer
│ │ └──────── will push out a transfer
│ └─────────────── default; radio + screen idle, no tx
└──────────────────────────────────────┘
- LOCK — default resting state. Radio off (or beacon-only), display shows balance, no transfer can occur. You carry it like this.
- SEND — wallet is armed to push. Amount entered on the keypad is
treated as outgoing. Press
=to commit (after peer pair + short-code match). - RECV — wallet is armed to pull / accept. Will only accept an incoming transfer matching the amount shown.
Light language (active-state visualization):
When the wallet is active, two independent light surfaces communicate state:
- Toggle pulse — a soft, slow pulse directly under the slide switch. Always present while the wallet is awake. Colour matches the switch position. This is the "what mode am I in" indicator — readable in a pocket-glance.
- Full perimeter LED strip — a thin RGB strip ringing the edge of the card. Used for handshake / transfer state: scans toward the peer on pair, fills as confirmation progresses, flashes on commit, dims to the toggle colour at idle.
Both surfaces share the same colour grammar:
LOCK → white ── soft idle pulse, no radio activity
SEND → red ── armed to push; ramps when amount is entered
RECV → green ── armed to accept; ramps when amount is shown
PAIR → amber sweep around perimeter, both ends → meeting point
MATCH → short-code-coloured sparkle (deterministic from session key)
COMMIT → full-strip flash in the sender's red / receiver's green
FAIL → perimeter blinks red 3x, toggle returns to white
The toggle pulse is independent of the perimeter strip — if the perimeter is doing a handshake animation, the toggle keeps pulsing its mode colour underneath, so the member can always see what their own device thinks it's doing even mid-transfer.
ASCII intent:
┌─◉─◉─◉─◉─◉─◉─◉─◉─◉─◉─◉─◉─◉─┐ ← perimeter RGB strip
◉ ◉ (handshake / transfer state)
◉ display + keypad ◉
◉ ◉
◉ [ LOCK · SEND · RECV ] ◉ ← slide switch, with its OWN
◉ ░░░░░ (pulse) ◉ soft-pulse light under the
◉ ◉ current detent
└─◉─◉─◉─◉─◉─◉─◉─◉─◉─◉─◉─◉─◉─┘
For a transfer to happen, one wallet must be on SEND and the other on RECV — same position on both = no-op. This makes direction physical, mutual, and impossible to fat-finger: if both members aren't actively agreeing on roles, nothing moves.
Both sides must still press = within ~10s, and both screens show a
matching short code (4-digit, derived from the session key); mismatch
aborts. Returning the switch to LOCK at any point kills the session.
Why not "scan a QR"? QR works but it requires one side to be the "merchant" and the other the "customer" — asymmetric, terminal-ish, and needs a camera. Tap-to-pair keeps both wallets peers: either side can start, both confirm, no roles.
Open questions
- SIM/radio provider strategy (MVNO vs. satellite IoT vs. LoRa-style mesh)?
- Relationship to existing standards (Ledger/Trezor seed compat? FIDO2? custom?).
- Session channel after the NFC introduction — BLE for nearby peers, in-band over the radio mesh for distant peers, or both? (Pairing transport itself is decided: NFC.)
- Pogo-pad layout + adapter form factor. Charging is decided
(Qi primary + bundled USB-C→pogo adapter using the same back-pad
contacts that also serve factory recovery). The contact area is a
perfectly smooth, shallow indent milled into the card's back
face — the pads sit flush at the bottom of the indent, magnets ring
it, and the adapter clicks in self-aligning. No raised hardware on
the card surface (snags in a pocket, ruins the calculator illusion).
Remaining design work:
- Indent depth + diameter — deep enough for positive tactile registration with the adapter, shallow enough not to weaken the card or interfere with the NFC patch and recovery QR window on the same back face.
- Number / pitch / position of the pogo pads inside the indent (must survive pocket wear, accept magnetic alignment).
- Adapter form factor — keyring fob, flat tab, magnetic disk? Must be small enough that members actually carry it and cheap enough to replace if lost.
- Whether the same pads carry data (firmware OTA fallback, bricked-device recovery) or are power-only with all data going over the radio.
Feasibility (web research, 2026-05-18)
Quick scan of what already ships vs. what's still hard. Component-by-component verdict on whether the concept is buildable in 2026 with off-the-shelf parts.
Card-form factor with display + secure element — SOLVED.
- Tangem ships a card-thin NFC wallet at EAL6+ secure element (no display, no battery, no radio). Arculus the same.
- Ledger Stax ships an e-ink + wireless-charging crypto wallet at credit-card footprint (~3 mm class, not card-thin) with curved e-ink, EAL6+ secure element, designed by Tony Fadell. Direct proof that e-ink + Qi + crypto works in this size class.
- ERA Wallet (open-source) puts e-ink + touch in a 5.5 mm card.
- Muxcard (experimental) puts e-ink + NFC + microcomputer in a 1 mm card — proves the upper bound. Sources:
Skepticism worth naming. Stacker News post "Don't bother with hardware wallets in card format" — the Bitcoin-maximalist hardware-wallet community already pushes back on card wallets (durability, single-point-of-failure, no air-gap). The cocottetech wallet is positioned as a retrieval + peer-transfer surface, not deep cold storage, which deflects most of that critique — but worth being explicit about the framing. - https://stacker.news/items/84506
eSIM + LTE-M radio — SOLVED at module level.
- Kigen MFF4 eSIM is 2 mm × 2 mm (production-grade). Standard MFF2 is 5×6 mm. Plenty thin enough for a 3 mm card.
- iSIM (eUICC integrated into the cellular SoC) is emerging — eliminates a whole component for a custom design.
- "Any SIM purchased in 2026 must support LTE-M, NB-IoT, or 4G LTE at minimum" — LTE-M is a default, not a special order. Sources:
Qi wireless charging at card thickness — FEASIBLE but the edge case.
- Standard Qi struggles with a 2 mm plastic gap (some chargers won't even start). Qi v2.1 explicitly supports 2 mm air gap + magnetic alignment — this is the standard to target, not v1.x.
- The coil must be tuned to the card's exact stackup. Off-the-shelf card-format Qi coils exist but their performance on arbitrary third-party pads is non-uniform. Risk: a member's iPhone MagSafe pad charges it fine, the hotel pad doesn't. Source:
Power budget — the actual hard problem.
- A card-thin Li-Po cell is on the order of 100–200 mAh. Cellular LTE-M
transmit bursts pull 100 mA+. The wallet must be mostly asleep:
- Radio idle in LOCK (beacon-only or fully off).
- Radio wakes only on toggle change, NFC tap, or scheduled push.
- Display is e-ink so retention is free. This is a design constraint, not a blocker — IoT cellular trackers achieve months of life at this duty cycle.
Overall feasibility verdict — buildable with 2026 parts.
- No single component requires invention. Every piece ships somewhere.
- The integration challenge is real: cellular + Qi v2.1 coil + e-ink + EAL6+ secure element + battery + perimeter LED + hardware switch, all in a ≤3–4 mm card, with reasonable yield. This is a hard industrial-design problem, not a research problem.
- Realistic path is partner with an existing card-wallet ODM (the same supply chain that builds Tangem / Arculus / Ledger Stax) rather than greenfield. ODM relationship + custom firmware + cocottetech brand layer is the shape of the project.
Prior art — is anyone already doing this? (2026-05-18)
Short answer: every ingredient ships somewhere; the exact combination does not. The defining mix — standalone cellular radio + calculator-keypad UI + peer-to-peer crypto transfers between same-brand wallets + bundled as a membership benefit — is unclaimed in the market as of May 2026.
Ingredient-by-ingredient prior art:
-
Card-form NFC wallet (Tangem, Arculus, Cryptnox, Ellipal X, Satochip, Keycard, CoolWallet, BitLox). Mature category. All EAL6+ secure-element cards. None have their own radio — they all piggyback on a host phone's NFC. Some (Tangem) support card-to-card key transfer over E2EE NFC, but that's for backup, not for sending value between two members.
-
Hardware wallet with built-in cellular — does NOT exist as a standalone product. Vaulttel ships a wallet that fits into a phone's SIM tray — opposite shape: it uses the phone's radio, not its own. There are research proposals ("SIM as hardware wallet" EIP, Nadcab Labs) but no shipping card-form wallet with its own cellular modem. This is the clearest greenfield slot in the design.
-
Peer-to-peer offline transfer between wallets. COLDCARD Q has "Key Teleport" (NFC/QR for moving sensitive data between two COLDCARD Q units). Tangem cards talk card-to-card for key backup. Neither frames the interaction as "two members punch in amounts and send crypto to each other in seconds" — both are still vault-operator-to-vault-operator workflows. The calculator-style consumer P2P framing is unclaimed.
-
Keypad on a crypto device. SecuX W20 and BitLox Ultimate have keypads, but only for PIN entry, not as the primary transaction UI. Calculator metaphor (amount-on-keypad,
=to send) is not used by anyone shipping. -
Membership-bundled hardware. NFT-as-membership exists, and Ledger sells limited-edition bundles (Monopoly x Ledger Flex), but no consumer brand bundles a hardware wallet as a tier benefit the way cocottetech proposes. The closest analogues are AmEx Centurion's physical metal card or Brilliant Earth's club hardware — neither is a wallet.
Conclusion. The wallet sits at the intersection of four mature categories (card NFC wallets, cellular IoT, P2P offline payment research, membership-as-product) where no one has put all four together. The radio + calculator-UI + same-product P2P combination is the actual novel claim. Card-form crypto-wallet is the well-worn substrate everyone else competes on; the differentiation is what the radio enables (instant transfers, push notifications, no-phone dependency).
Stance
- Regulatory posture: explicitly not a design constraint. The member's work already lives in gray-area space and has been unjustly punished by regulatory systems. This product is built on a liberty-first / sovereignty-of-the-member axiom; compliance questions are downstream operational concerns, not gating design inputs. Documented so future contributors don't smuggle the inverted priority back in.
Related
- brand-family memory — ships under cocottetech (Cocotte public umbrella).
- Membership tier definitions — "standard" tier needs to be defined before this idea is committed.