CommitWatch RSS
CK
← All projectsCoinkite

COLDCARD firmware

Open-source firmware for COLDCARD Bitcoin signing devices.

BitcoinHardware walletsActive incident
Source repository ↗
Repository coverage

306 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

70security candidates169second-pass queue20AI analyses
25commits · 30 days
74commits · 60 days
158commits · 180 days
306commits · 365 days
Backfill bands
Aug 5 → Feb 6148 seen2 candidatesComplete
Feb 6 → Jun 684 seen8 candidatesComplete
Jun 6 → Jul 649 seen4 candidatesComplete
Jul 6 → Aug 525 seen4 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

29/100 average clarity
1Strong · 80–100
17Adequate · 60–79
103Thin · 40–59
185Opaque · 0–39
34security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Peter D. Gray146206215
scgbckbone1464814039
Dmitry Monakhov210073
kdmukai110050
tadeubas600051
dependabot[bot]300079
russeree100060
nvk10000
Analysis record

Published AI watches

Last scanned 3 minutes ago

Moderate 66 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: detect RNG_SR_SEIS and RNG_SR_SECS, retry safely, and fail closed on persistent faults

This update fixes how the COLDCARD hardware wallet's random-number generator (RNG) handles rare hardware faults. Previously, the device could silently continue using weak or repeated random numbers if the RNG reported a seed error. Now it …

RNG seed-error flag detection added (RNG_SR_SEIS, RNG_SR_SECS)Bounded retry with recovery sequence instead of silent continuationFail-closed escalation on persistent RNG faults
82ced47aby scgbckbone+117−295 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

rng: discard 12 words after SEIS clear per RM0432 32.3.7

This commit changes how the COLDCARD hardware wallet's random-number generator (RNG) recovers from a rare 'seed error' condition. The manufacturer is now following an STMicroelectronics guideline to throw away the first 12 random numbers a…

RNG recovery routine previously did not discard post-recovery outputNew behavior follows vendor reference-manual recommendation (RM0432 32.3.7)Randomness is used for cryptographic key material in a hardware wallet
43b21392by scgbckbone+33−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 74 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

docs: why RNG clock errors don't invalidate RNG_DR

This commit only adds explanatory comments to two source files about why the COLDCARD firmware ignores certain hardware random-number-generator clock-error flags. It does not change any code behavior. The comments cite ST documentation say…

6e403982by scgbckbone+15−02 files
No security note in commit
Open full analysis →Source commit ↗
Critical 91 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

fixes rng

This commit fixes a critical random-number bug in COLDCARD hardware wallets. The device was accidentally using a weak, software-based fallback random generator instead of its secure hardware one when creating Bitcoin seed phrases. Because …

Weak/fallback PRNG silently linked in place of hardware RNGSeed phrase entropy reduction allowing private-key recoveryBuild-system override of upstream rng.o with empty object
ca724637by Peter D. Gray+60−711 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

limit BIP-322 msg length to 330 chars

This commit adds a 330-character limit to BIP-322 proof-of-reserve messages on the COLDCARD hardware wallet. Without the limit, an attacker could craft a very long message that might be used to mislead the user, overflow display buffers, o…

Input length bound added to user-facing signed messageAssertion failure prevents processing of oversized messagesEmpty message already rejected; documentation now also requires non-empty message
b29d2347by scgbckbone+41−13 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

apply note or pwd as b39 passphrase

This commit adds a new feature to the COLDCARD hardware wallet that lets users apply the text of a Secure Note or the value of a Secure Note password as their BIP-39 wallet passphrase. It also tightens how printable ASCII is checked in a f…

New feature exposes stored Secure Notes / Passwords as BIP-39 passphrasesInput validation relies on length, printable-ASCII, and rstrip of trailing whitespace/tab/newlineRefactored text sanitization changes control-flow for message signing and PSBT message warnings
0ef6413cby scgbckbone+223−289 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

BIP-322 changes after BIP got in to the complete state

This commit updates COLDCARD's BIP-322 (Bitcoin message signing / proof-of-reserves) implementation to match the finalized BIP-322 specification. The main user-visible change is that the message to be signed must now be embedded directly i…

BIP-322 message now embedded in PSBT and verified against reconstructed to_spend, reducing reliance on external/user-supplied message filesBIP-322 PSBTs are explicitly prevented from being finalized into broadcastable transactionsHSM policy now applies message-signing path restrictions to BIP-322 PSBTs
d656f371by scgbckbone+1106−61015 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

docs: index all docs and fix drift vs firmware

This commit is purely a documentation update. It adds missing entries to the docs index, updates outdated examples and menu trees, fixes a broken filename reference in a code comment, and corrects factual details (such as supported models …

8e3bbfdfby scgbckbone+139−8315 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bundle small fixes

This is a large bundle of bug fixes for the COLDCARD hardware wallet firmware. Most changes fix user-interface crashes ('yikes'), incorrect error messages, or policy edge cases rather than a single critical vulnerability. The most security…

HSM mode now disables NFC and Virtual Disk peripherals to reduce USB/NFC attack surfaceSingle-Signer Spending Policy unlock no longer accepts a zero-secret bypass PIN as the 'main PIN'OP_RETURN and non-standard scripts are no longer hidden as 'null-data' during transaction review
c36eac23by scgbckbone+1486−28548 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 48 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: Delta Mode Trick PIN restore from backup

This commit fixes a bug where a special security feature called 'Delta Mode Trick PIN' was not being restored when a user restored their Coldcard wallet from a backup. A Trick PIN is a decoy PIN that can do things like show a fake wallet o…

Functional bug in security feature (Trick PIN restore)Silent failure due to bare exception handlerMismatch between function return value and caller (tuple unpack)
be614dabby scgbckbone+235−1306 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 18 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

new bootloader

This commit adds a new pre-built bootloader release (version 3.3.0) for the COLDCARD Mk4 hardware wallet. It consists of binary firmware files and a hash manifest, plus a disassembly listing. There is no source code change, no vulnerabilit…

02b5a756by Peter D. Gray+34698−05 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Mk hardware

This commit adds support for a new COLDCARD hardware revision, the Mk5. It is a routine product-enablement patch: it teaches the firmware, bootloader, build system, simulator, and signing tools to recognize and run on Mk5 devices. There is…

No security-relevant signals detected in the diff.Change is hardware bring-up / product enablement only.No fixes for memory corruption, authentication bypass, cryptographic flaws, or privilege escalation.
38553d1aby Peter D. Gray+728−27643 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

WIF Store

This commit adds a new 'WIF Store' feature to the COLDCARD firmware. It lets users import external Bitcoin private keys (in WIF format) and use them to sign PSBT transactions and messages, alongside the device's normal seed-derived keys. T…

New feature adds persistent storage of arbitrary private keys in device settingsPSBT signing path now branches on whether a required pubkey is in the WIF storeAddress ownership verification now recognizes WIF-store addresses as 'ours'
9b131b2eby scgbckbone+1243−8222 files
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 38 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

BIP-322 msg verification

This commit adds a new user-facing verification step for BIP-322 'Proof of Reserves' messages on the COLDCARD hardware wallet. Before signing a proof-of-reserves transaction, the device now asks the user to import or type the original huma…

Adds user-verifiable message display before BIP-322 proof-of-reserves signingAdds hash-equality check between supplied message and PSBT embedded message hashIntroduces new untrusted input paths: NFC, QR/BBQR, SD card, virtual disk, and on-device keyboard for BIP-322 messages
ef2f35b1by scgbckbone+218−166 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

BIP-322 Proof of Reserves

This commit adds support for BIP-322 Proof of Reserves signing on COLDCARD hardware wallets. It lets users prove they control certain Bitcoin addresses by signing a special non-spending transaction, without actually moving funds. The chang…

New transaction parsing path accepts nVersion=0 under a specific POR heuristicPOR detection relies on a single zero-amount OP_RETURN output (scriptPubKey == b'\x6a')POR validation parses and constrains the embedded 'to_spend' transaction from the 0th input's non-witness UTXO
5d7d5d88by scgbckbone+816−157 files
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 55 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

test we show BIP-39 passphrase

This commit only adds a single line to a test file. It checks that when a user adds a BIP-39 passphrase to create a temporary seed, the COLDCARD device displays the passphrase back to the user on screen. This is a test-only change and does…

06879c59by Peter D. Gray+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

show BIP-39 passphrase on-screen

This change makes the COLDCARD hardware wallet display the user's BIP-39 passphrase on the device's own screen after it is applied. This is a deliberate UX change, not a hidden bug. It could slightly increase the risk that someone physical…

Sensitive user secret (BIP-39 passphrase) rendered in on-screen UI messageNo input validation, encryption, or access-control changesNo remote or USB-exposed behavior changed
21392bd3by Peter D. Gray+14−61 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

address format matching from PSBT witness/redeem script instead of PSBT_XPUBs derivation paths

This change fixes how COLDCARD figures out the address format for multisig transactions. Previously it guessed based on the derivation path numbers in the PSBT's XPUB records, which can be misleading or attacker-controlled. Now it looks di…

Removed derivation-path-based address-format inference that trusted PSBT_XPUB path dataAdded script-based address-format inference from witness_script / redeem_scriptAdded N == len(self.xpubs) consistency check in multisig script parsing
ef0ba6a5by scgbckbone+154−354 files
No security note in commit
Open full analysis →Source commit ↗
High 80 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

deltamode timing fix

This commit fixes a bug in COLDCARD's 'deltamode' duress feature. Delta mode is meant to let a thief who knows a slightly wrong PIN sign transactions with corrupted signatures that look valid but don't actually protect any bitcoin. The bug…

duress/deltamode bypasspredictable signing digest replaced with transaction-dependent digestprivate-key recovery claimed by independent researchers
fcd848d8by Peter D. Gray+9−91 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

fix SSSP unable to find unlock policy PIN

This is a small bug fix in the COLDCARD hardware wallet's 'trick PIN' feature. Trick PINs let users set up special PINs that do things like wipe the device or unlock specific spending policies. The fix makes the device refresh its trick-PI…

State synchronization bug in security-critical PIN lookupTrick PIN / duress feature correctness fixNo explicit security framing by vendor in commit message
52e7c755by scgbckbone+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedyearby Peter D. Gray · a9c99a9b · Jul 2, 2026 · 1 fileMessage 0 · OpaqueTriage 0Details
Commit message · Peter D. Gray

year

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedSigned for mk release.by Peter D. Gray · e2e5bbe1 · Jul 1, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Peter D. Gray

Signed for mk release.

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI review queuedupdate block heightby Peter D. Gray · 336b8968 · Jul 1, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Peter D. Gray

update block height

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedSigned for q1 release.by Peter D. Gray · 0212955c · Jul 1, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Peter D. Gray

Signed for q1 release.

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI review queuedupdate block heightby Peter D. Gray · 4a4442f1 · Jul 1, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Peter D. Gray

update block height

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queueddate slipby Peter D. Gray · 0c8122f5 · Jul 1, 2026 · 1 fileMessage 0 · OpaqueTriage 0Details
Commit message · Peter D. Gray

date slip

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedupdates for Tahoeby Peter D. Gray · 02e054c8 · Jun 30, 2026 · 2 filesMessage 28 · OpaqueTriage 0Details
Commit message · Peter D. Gray

updates for Tahoe

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedmore editingby Peter D. Gray · 2303b47c · Jun 30, 2026 · 1 fileMessage 18 · OpaqueTriage 0Details
Commit message · Peter D. Gray

more editing

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedupdate block heightby Peter D. Gray · 5081f8cc · Jun 30, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Peter D. Gray

update block height

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedcorrect version!by Peter D. Gray · ec4c4853 · Jun 30, 2026 · 1 fileMessage 18 · OpaqueTriage 7Details
Commit message · Peter D. Gray

correct version!

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI review queuedcleaner/better checkby Peter D. Gray · a4ae6c88 · Jun 30, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Peter D. Gray

cleaner/better check

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedUpdated for todayby Peter D. Gray · 81cbc472 · Jun 30, 2026 · 2 filesMessage 28 · OpaqueTriage 0Details
Commit message · Peter D. Gray

Updated for today

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queueddebug helperby Peter D. Gray · e9552c5f · Jun 30, 2026 · 1 fileMessage 18 · OpaqueTriage 0Details
Commit message · Peter D. Gray

debug helper

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedsymlinks, just in caseby Peter D. Gray · c4977564 · Jun 30, 2026 · 2 filesMessage 28 · OpaqueTriage 0Details
Commit message · Peter D. Gray

symlinks, just in case

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedupdate release notesby Peter D. Gray · fe3b6b27 · Jun 30, 2026 · 5 filesMessage 28 · OpaqueTriage 7Details
Commit message · Peter D. Gray

update release notes

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI review queuedcleanupsby Peter D. Gray · defeda26 · Jun 30, 2026 · 1 fileMessage 0 · OpaqueTriage 0Details
Commit message · Peter D. Gray

cleanups

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
Lower-prioritybump version to 5.5.1 & 1.4.1Qby scgbckbone · 0b21d07c · Jun 30, 2026 · 3 filesMessage 45 · ThinTriage 0Details
Commit message · scgbckbone

bump version to 5.5.1 & 1.4.1Q

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidatelimit BIP-322 msg length to 330 charsby scgbckbone · b29d2347 · Jun 30, 2026 · 3 filesMessage 45 · ThinLow 38Details
Commit message · scgbckbone

limit BIP-322 msg length to 330 chars

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Low 38/100

This commit adds a 330-character limit to BIP-322 proof-of-reserve messages on the COLDCARD hardware wallet. Without the limit, an attacker could craft a very long message that might be used to mislead the user, overflow display buffers, or cause other unexpected behavior during signing. The change rejects oversized or empty messages before the user is asked to sign.

Security candidatestandalone encrypted backups for Secure Notes & Passwordsby scgbckbone · d58fdfd5 · Jun 30, 2026 · 6 filesMessage 50 · ThinTriage 10Details
Commit message · scgbckbone

standalone encrypted backups for Secure Notes & Passwords

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
authentication path
Security candidaterevert SSSP bypass PIN loginby scgbckbone · 542dcd32 · Jun 25, 2026 · 3 filesMessage 45 · ThinTriage 18Details
Commit message · scgbckbone

revert SSSP bypass PIN login

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
access control
Security candidateapply note or pwd as b39 passphraseby scgbckbone · 0ef6413c · Jun 24, 2026 · 9 filesMessage 45 · ThinLow 27Details
Commit message · scgbckbone

apply note or pwd as b39 passphrase

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
access controlseed or entropy pathsigning or wallet pathauthentication path
AI analysis · Low 27/100

This commit adds a new feature to the COLDCARD hardware wallet that lets users apply the text of a Secure Note or the value of a Secure Note password as their BIP-39 wallet passphrase. It also tightens how printable ASCII is checked in a few places. The change is user-facing and requires physical interaction, so it does not look like a remote exploit. However, because passphrases control which wallet is derived, any bug in how note text is sanitized or applied could cause a user to load an unexpected wallet or expose a note's contents as a passphrase.

Security candidateFix BBQr share of Unicode text: encode str to UTF-8 before sizing/splittingby Dmitry Monakhov · 97d86c95 · Jun 24, 2026 · 1 fileMessage 73 · AdequateTriage 20Details
Commit message · Dmitry Monakhov

Fix BBQr share of Unicode text: encode str to UTF-8 before sizing/splitting

For 'U'/'J' payloads data is a str; planning counted codepoints while
b32encode consumes UTF-8 bytes, so multi-byte text (e.g. paper-wallet QR
art) overflowed target_vers and tripped the assert in show_bbqr_codes.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
memory safety
Lower-priorityAdd groups for secure notesby scgbckbone · edae8c1e · Jun 24, 2026 · 3 filesMessage 45 · ThinTriage 0Details
Commit message · scgbckbone

Add groups for secure notes

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityFix QR scanner setup and sleep handlingby scgbckbone · ad2088d2 · Jun 24, 2026 · 3 filesMessage 45 · ThinTriage 0Details
Commit message · scgbckbone

Fix QR scanner setup and sleep handling

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityKeep scanner reinit state instance-localby scgbckbone · 55340577 · Jun 24, 2026 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · scgbckbone

Keep scanner reinit state instance-local

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body