Skip to content
Bitcoin Roots

v31.1-roots.1 · Commit 6: [PATCH 06/17] feat(wallet): preserve Roots signing and spend controls on v31

doc/roots-features.md

Before: doc/roots-features.md · After: doc/roots-features.md

File metadata
index eb9921dfd7bf10781d8ba03c50b4168803b3b418..034b40905ff5cfa2c68a21a108d3e33fa56fc728 100644

Download original patch · Release notes

Diff rows 1–99 of 99. Line numbers refer to the original before/after files.

+ Added− RemovedUnmarked lines are context.

Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.

doc/roots-features.md CHANGED
@@ -20,7 +20,12 @@ Priority/template
20
  mining to L9; peer controls/health to L10; sweep, coin-control and per-send
21
  RBF extensions to L11; read/write config, effective-policy RPC, resource support
22
  and dormant statistics to L12; identity/desktop and maintenance integration to
23
- L13. The narrow monotonic `uptime` RPC sub-aspect has reviewed upstream
 
 
 
 
 
24
  equivalence; this does not retire the remaining operator-stats contract.
25
 
26
  MiniUPnPc dependency discovery is retained, but its UPnP runtime and depends
@@ -307,37 +312,48 @@ mining. Explicitly supplied staged options warn that they are not enforced.
307
  are inherited Core foundations. Roots rejects unwritable database directories,
308
  avoids recursively scanning node database directories and symlink/reparse
309
  points, and closes unrelated child descriptors for signer commands. Preserve
310
- normal wallet locking and error reporting; do not introduce another database,
311
- backup/flush promise or Berkeley DB build option. See database (`src/wallet/db.cpp`, source reference),
312
- SQLite (`src/wallet/sqlite.cpp`, source reference), filesystem helpers (`src/util/fs_helpers.cpp`, source reference)
313
- and signer child invocation (`src/common/run_command.cpp`, source reference). Acceptance:
314
- wallet_multiwallet.py (`test/functional/wallet_multiwallet.py`, source reference),
315
- wallet_signer.py (`test/functional/wallet_signer.py`, source reference) and
316
- wallet_tests.cpp (`src/wallet/test/wallet_tests.cpp`, source reference). Gap: platform-specific
317
- reparse-point/permission cases and external signer availability in each build.
 
 
 
 
 
 
 
 
318
  - **wallet-rbf:** the per-send GUI choice starts from the wallet's `walletrbf`
319
  preference (Core default true), explicitly overrides it for the prepared
320
  transaction, and shows its resulting signaling in confirmation and saved
321
  PSBT. It is a signaling choice, not a guarantee of network replacement. See
322
- Send dialog (`src/qt/sendcoinsdialog.cpp`, source reference) and
323
- wallet model (`src/qt/walletmodel.cpp`, source reference). Acceptance:
324
- wallettests.cpp (`src/qt/test/wallettests.cpp`, source reference) `walletTests` explicit on/off
325
- override and decoded PSBT sequence assertions. Gap: visual confirmation/font
326
- scale matrix, not established by a headless build.
327
  - **wallet-sweep:** only documented WIF/script forms, local-key descriptor
328
  destination in the selected wallet, no key import, preview by default and
329
- final authorization before broadcast. Fee state is snapshotted under wallet
 
 
 
330
  locking; cancellation/invalidation can stop scanning or preview, while accepted
331
  broadcast submission completes. Reduce secret lifetime using secure storage,
332
  cleansing and console redaction without claiming complete host/toolkit erasure.
333
- The full operational contract is [wallet-privacy.md](/doc/wallet-privacy.md).
334
- See RPC (`src/wallet/rpc/spend.cpp`, source reference), construction (`src/wallet/spend.cpp`, source reference)
335
- and dialog (`src/qt/sweepdialog.cpp`, source reference). Acceptance:
336
- wallet_sweepprivkeys.py (`test/functional/wallet_sweepprivkeys.py`, source reference) `run_test`
337
  covers supported script forms, destination rejection, no import, stale/conflicting
338
- previews and broadcast; wallettests.cpp (`src/qt/test/wallettests.cpp`, source reference)
339
  `walletTests` covers secure cache and preview invalidation;
340
- test_wallet_privacy_contract.py (`ci/test/test_wallet_privacy_contract.py`, source reference)
341
  checks source structure of authorization/redaction boundaries. Gap: that static
342
  check is not a race proof; cancellation/authorization concurrency and GUI
343
  confirmation need runtime and visual evidence.
@@ -346,12 +362,12 @@ mining. Explicitly supplied staged options warn that they are not enforced.
346
  visible but unselectable; ordinary availability filters still exclude unsafe
347
  and immature outputs. Material wallet changes clear explicit selection.
348
  Conspicuously validate custom change; do not add automatic consolidation or
349
- anonymity claims. See [wallet-privacy.md](/doc/wallet-privacy.md),
350
- coin control (`src/qt/coincontroldialog.cpp`, source reference) and
351
- wallet facts (`src/wallet/rpc/wallet.cpp`, source reference). Acceptance:
352
- wallettests.cpp (`src/qt/test/wallettests.cpp`, source reference) `walletTests` selected/locked
353
- and invalidation cases, wallet_send.py (`test/functional/wallet_send.py`, source reference) and
354
- test_wallet_privacy_contract.py (`ci/test/test_wallet_privacy_contract.py`, source reference)
355
  row-filter assertions. Gap: populated GUI and custom-change visual matrix.
356
 
357
  ### Runtime, configuration, portability and identity
 
20
  mining to L9; peer controls/health to L10; sweep, coin-control and per-send
21
  RBF extensions to L11; read/write config, effective-policy RPC, resource support
22
  and dormant statistics to L12; identity/desktop and maintenance integration to
23
+ L13. L11.1 adds database-discovery/write-access safeguards, Unix signer descriptor
24
+ closure, wallet-derived per-send RBF defaults and prepared-transaction/PSBT
25
+ signaling. L11.2 adds transient-key sweep with cancellation/final authorization,
26
+ shared UTXO scanning and wallet-derived coin-control facts.
27
+
28
+ The narrow monotonic `uptime` RPC sub-aspect has reviewed upstream
29
  equivalence; this does not retire the remaining operator-stats contract.
30
 
31
  MiniUPnPc dependency discovery is retained, but its UPnP runtime and depends
 
312
  are inherited Core foundations. Roots rejects unwritable database directories,
313
  avoids recursively scanning node database directories and symlink/reparse
314
  points, and closes unrelated child descriptors for signer commands. Preserve
315
+ normal wallet locking and error reporting; automatic anti-fee-sniping
316
+ locktimes avoid the CAT21 marker reserved by local policy. Do not introduce another database,
317
+ backup/flush promise or Berkeley DB build option. [See database](../src/wallet/db.cpp),
318
+ [SQLite](../src/wallet/sqlite.cpp), [filesystem helpers](../src/util/fs_helpers.cpp)
319
+ and signer [child invocation](../src/common/run_command.cpp). Acceptance:
320
+ [wallet_multiwallet.py](../test/functional/wallet_multiwallet.py),
321
+ [wallet_signer.py](../test/functional/wallet_signer.py) and
322
+ [wallet_tests.cpp](../src/wallet/test/wallet_tests.cpp). Candidate evidence also
323
+ checks inherited Unix descriptors, directory write
324
+ probes, skipped node databases and symlink traversal. Unix signer closure keeps
325
+ standard streams and the exec-error pipe, closes actual inherited descriptors
326
+ even above a lowered soft limit, and fails before exec if safe closure fails.
327
+ Linux uses `close_range` or raw `/proc/self/fd` enumeration; other Unix builds
328
+ use native `closefrom` when available. Gap: non-Linux fallback runtime, Windows
329
+ reparse-point/permission cases and inherited handle closure; the Unix
330
+ close-descriptor implementation does not prove Windows handle isolation.
331
  - **wallet-rbf:** the per-send GUI choice starts from the wallet's `walletrbf`
332
  preference (Core default true), explicitly overrides it for the prepared
333
  transaction, and shows its resulting signaling in confirmation and saved
334
  PSBT. It is a signaling choice, not a guarantee of network replacement. See
335
+ [Send dialog](../src/qt/sendcoinsdialog.cpp) and
336
+ [wallet model](../src/qt/walletmodel.cpp). Acceptance:
337
+ [wallettests.cpp](../src/qt/test/wallettests.cpp) `walletTests` explicit on/off
338
+ override and decoded PSBT sequence assertions. Rendering evidence is recorded
339
+ in the wallet theme port review.
340
  - **wallet-sweep:** only documented WIF/script forms, local-key descriptor
341
  destination in the selected wallet, no key import, preview by default and
342
+ final authorization before broadcast. Destination eligibility requires native
343
+ script satisfaction with available local keys, including encrypted keys:
344
+ incomplete multisig is rejected, while a sufficient subset is accepted.
345
+ Fee state is snapshotted under wallet
346
  locking; cancellation/invalidation can stop scanning or preview, while accepted
347
  broadcast submission completes. Reduce secret lifetime using secure storage,
348
  cleansing and console redaction without claiming complete host/toolkit erasure.
349
+ The full operational contract is [wallet-privacy.md](wallet-privacy.md).
350
+ See [RPC](../src/wallet/rpc/spend.cpp),
351
+ [construction](../src/wallet/spend.cpp) and [dialog](../src/qt/sweepdialog.cpp). Acceptance:
352
+ [wallet_sweepprivkeys.py](../test/functional/wallet_sweepprivkeys.py) `run_test`
353
  covers supported script forms, destination rejection, no import, stale/conflicting
354
+ previews and broadcast; [wallettests.cpp](../src/qt/test/wallettests.cpp)
355
  `walletTests` covers secure cache and preview invalidation;
356
+ [test_wallet_privacy_contract.py](../ci/test/test_wallet_privacy_contract.py)
357
  checks source structure of authorization/redaction boundaries. Gap: that static
358
  check is not a race proof; cancellation/authorization concurrency and GUI
359
  confirmation need runtime and visual evidence.
 
362
  visible but unselectable; ordinary availability filters still exclude unsafe
363
  and immature outputs. Material wallet changes clear explicit selection.
364
  Conspicuously validate custom change; do not add automatic consolidation or
365
+ anonymity claims. See [wallet-privacy.md](wallet-privacy.md),
366
+ [coin control](../src/qt/coincontroldialog.cpp) and
367
+ [wallet facts](../src/wallet/interfaces.cpp). Acceptance:
368
+ [wallettests.cpp](../src/qt/test/wallettests.cpp) `walletTests` selected/locked
369
+ and invalidation cases, [wallet_send.py](../test/functional/wallet_send.py) and
370
+ [test_wallet_privacy_contract.py](../ci/test/test_wallet_privacy_contract.py)
371
  row-filter assertions. Gap: populated GUI and custom-change visual matrix.
372
 
373
  ### Runtime, configuration, portability and identity