Smart-wallet guide routes new readers to legacy Passkey Kit and a discontinued LaunchTube

[kalepail]

Finding

Two live defects on main currently have no tracker of their own, because the
only thing carrying them is PR #2367.

1. The smart-wallet guide routes greenfield readers to a legacy, unaudited SDK.
The current guide sends new builders to Passkey Kit. Passkey Kit's own repository
now calls itself the legacy precursor to Smart Account Kit, labels its code
unaudited demo material, and warns against using it to secure real value. None of
that warning, and no pointer to the successor, reaches the reader of the guide.

2. The Guestbook passkey prerequisites require a discontinued service.
The OpenZeppelin Relayer page states LaunchTube is discontinued and replaced for
transaction submission, while the still-published Guestbook prerequisites page
instructs readers to obtain and configure a LaunchTube JWT with no legacy or
migration warning.

These pages also leave a replacement boundary implicit: OpenZeppelin replaces
LaunchTube's submission and fee-sponsorship role, not Mercury/Zephyr's indexing
and reverse-lookup role. A reader migrating the submitter can incorrectly remove
the indexer too.

Evidence

• https://developers.stellar.org/docs/build/guides/contract-accounts/smart-wallets
• https://github.com/kalepail/passkey-kit — self-describes as the legacy
  precursor, unaudited demo material, not for real value
• https://github.com/kalepail/smart-account-kit — the maintained successor
• https://docs.openzeppelin.com/stellar-contracts/accounts/smart-account
• The Guestbook passkey prerequisites page still requires a LaunchTube JWT while
  the OpenZeppelin Relayer page calls LaunchTube discontinued.
• Archived LaunchTube source and current Zephyr/Mercury sources confirm that
  submission and indexing are separate roles.

Why this is a separate issue. Both defects would be resolved by PR #2367
(docs/modernize-smart-wallet-references), which we reviewed and supported on
2026-07-14 when its checks were green. As of 2026-07-27 that PR shows merge
conflicts and has had no activity since 2026-07-14. We would rather these
defects have a tracker that does not depend on one contributor's branch staying
mergeable. Happy to see this closed the moment #2367 lands.

Recommendation

Land #2367, or apply the two minimal edits directly:

1. In the smart-wallet guide, route new projects to Smart Account Kit plus the
   relevant versioned OpenZeppelin Stellar account contracts, and reproduce
   Passkey Kit's own unaudited-demo / no-real-value warning wherever the legacy
   path remains for historical users.
2. Add a legacy or migration banner to the Guestbook LaunchTube prerequisite, or
   update it to a maintained submitter.

A small role table — client-side passkey signing, transaction submission and fee
sponsorship, indexing and reverse lookup — cross-linked from both the Guestbook
and OpenZeppelin Relayer pages would prevent the boundary confusion. State audit
scope per exact artifact and release rather than implying a whole stack inherits
an OpenZeppelin audit.

Source Record

This was found by the downstream Raven eval/improvements loop and recorded as two
findings: sd-034 (smart-wallet guide routing, discovered 2026-07-11) and
sd-027 (LaunchTube/Guestbook drift, discovered 2026-07-11).

Public source records:

• improvements/stellar-docs/sd-034-smart-wallet-passkey-kit-legacy-routing.md
• improvements/stellar-docs/sd-027-launchtube-passkey-migration-drift.md

Immutable source snapshots at 773857262d46:

• sd-034
• sd-027

Resolution Handoff

When a fix is deployed, please link the resolving issue or PR to the source
records above and notify Raven through:

https://github.com/kalepail/stellar-raven/issues/new?template=upstream-improvement-ready.yml&title=%5Bupstream-ready%5D%20sd-034%2Fsd-027%3A%20

Include the finding id, resolving issue/PR, deployed version or timestamp, and
the smallest live recheck. Raven independently verifies the upstream surface
before changing a finding to fixed-upstream; issue closure or a merged PR
alone is not treated as proof.

[kalepail]

Correction to this issue's premise after a 2026-08-05 recheck: the current canonical repositories are https://github.com/stellar/passkey-kit and https://github.com/stellar/smart-account-kit. They are maintained, non-drop-in siblings. Passkey Kit uses a flat Signatures model; Smart Account Kit uses OpenZeppelin context rules, an auth digest, signers, and policies. Please keep the model-selection documentation ask, link both canonical repositories instead of the archived kalepail/passkey-kit move pointer currently linked by the guide, and scope review or audit language to each exact artifact and release. The original legacy/successor premise is stale. Raven's corrected source record is https://github.com/stellar-experimental/stellar-raven/blob/aaef9b7ad7ba465630759de89fd3d84910e8dafe/improvements/stellar-docs/sd-034-smart-wallet-passkey-kit-legacy-routing.md