diff --git a/.circleci/config.yml b/.circleci/config.yml
new file mode 100644
index 00000000..95f8a880
--- /dev/null
+++ b/.circleci/config.yml
@@ -0,0 +1,27 @@
+version: 2.1
+
+# The authoritative multi-release emulator matrix lives in GitHub Actions.
+# Keep this smoke job while the legacy CircleCI project remains connected so
+# its required status verifies the checkout instead of failing at config load.
+jobs:
+  canonical-smoke:
+    docker:
+      - image: cimg/python:3.11
+    steps:
+      - run:
+          name: Checkout current branch over HTTPS
+          command: |
+            git clone --depth 1 -b "$CIRCLE_BRANCH" \
+              https://github.com/keepkey/python-keepkey.git .
+            git submodule update --init --recursive
+      - run:
+          name: Validate canonical Python and EOS vector contracts
+          command: |
+            python -m py_compile keepkeylib/*.py tests/test_msg_solana_signtx.py
+            python -m pip install --quiet pytest requests
+            python -m pytest -q tests/unit/test_eos_updateauth_vector.py
+
+workflows:
+  canonical:
+    jobs:
+      - canonical-smoke
diff --git a/tests/test_msg_solana_signtx.py b/tests/test_msg_solana_signtx.py
index 1839eecf..b1b998c8 100644
--- a/tests/test_msg_solana_signtx.py
+++ b/tests/test_msg_solana_signtx.py
@@ -143,6 +143,10 @@ def test_solana_sign_message_blocked_without_advanced_mode(self):
         self.requires_firmware("7.14.0")
         self.requires_fullFeature()
         self.requires_message("SolanaSignMessage")
+        # AdvancedMode belongs to the live wallet session. Start this negative
+        # policy proof from factory state rather than relying on test order or
+        # on apply_policy(False) to revoke an already-authorized session.
+        self.client.wipe_device()
         self.setup_mnemonic_allallall()
         self.client.apply_policy('AdvancedMode', False)
 
@@ -158,9 +162,10 @@ def test_solana_sign_plain_text_message_without_advanced_mode(self):
         AdvancedMode. Printable text that never contains the signer's key
         cannot authorize a transaction: a tx signature only verifies when the
         signer's key is in the message's account keys."""
-        self.requires_firmware("7.16.0")
+        self.requires_firmware("7.15.0")
         self.requires_fullFeature()
         self.requires_message("SolanaSignMessage")
+        self.client.wipe_device()
         self.setup_mnemonic_allallall()
         self.client.apply_policy('AdvancedMode', False)