v31.1-roots.1 · Commit 6: [PATCH 06/17] feat(wallet): preserve Roots signing and spend controls on v31
doc/wallet-privacy.md
Before: doc/wallet-privacy.md · After: doc/wallet-privacy.md
File metadata
index 9af45bffb31d1d1c57d6df4b005fbbed903fcb2d..8c31fce29567685b96ce0868798432252169bd39 100644
Download original patch · Release notes
Diff rows 1–67 of 67. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
doc/wallet-privacy.md
CHANGED
|
@@ -1,15 +1,10 @@
|
|
|
1
|
-
# Advanced wallet privacy preservation contract
|
|
2
|
-
**v31 candidate status: deferred to the wallet theme.** The sweep and enhanced
|
|
3
|
-
coin-control behavior below is the accepted 30.3 source contract, not an
|
|
4
|
-
available v31 feature. Code/test references and example verification commands
|
|
5
|
-
refer to pinned source `10d772eb7f4b00b5193428a0dde4c06558d6c297`.
|
|
6
|
-
[The port review](roots-v31-port-review.md) records implementation ownership.
|
|
1
|
+
# Advanced wallet privacy tools (v31 candidate)
|
|
7
2
|
|
|
8
|
-
This guide describes the advanced wallet tools intended for the
|
|
9
|
-
`v30.3-roots.1` candidate. This is candidate documentation, not a release
|
|
10
|
-
announcement; the tools are not part of the published `v29.4-roots.2` release.
|
|
11
|
-
Bitcoin Core v30.3 is the direct upstream base; selected Bitcoin Knots
|
|
12
|
-
history is lineage only, not an upstream dependency or product specification.
|
|
3
|
+
The local v31 candidate implements this contract. It is based on Bitcoin Core
|
|
4
|
+
v31.1 and the pinned Roots 30.3 source; this is candidate documentation, not a
|
|
5
|
+
release announcement. See [the port review](roots-v31-port-review.md) for
|
|
6
|
+
implementation and verification provenance. Selected Bitcoin Knots history is
|
|
7
|
+
lineage only, not a product specification.
|
|
13
8
|
|
|
14
9
|
## Sweep an external private key
|
|
15
10
|
|
|
@@ -27,11 +22,18 @@ external key, not routine wallet import or consolidation.
|
|
|
27
22
|
watch-only, private-key-disabled, and external-signer configurations are not
|
|
28
23
|
eligible destinations. Legacy wallets must be migrated to descriptor wallets;
|
|
29
24
|
this port does not restore a Berkeley DB build option.
|
|
25
|
+
Local keys must satisfy a native signing path: an incomplete 2-of-2 multisig
|
|
26
|
+
destination is rejected, while 2-of-3 with two local keys is eligible. This
|
|
27
|
+
check also recognizes encrypted keys without unlocking or exporting them.
|
|
28
|
+
Signing capability does not guarantee present timelock maturity or future
|
|
29
|
+
network acceptance.
|
|
30
30
|
- `broadcast=false` is the default and returns a signed preview with its input
|
|
31
31
|
total, fee, input count, transaction ID, and hex. It does not submit a
|
|
32
32
|
transaction. Review the destination, net amount, and fee; decode the preview
|
|
33
33
|
when inspecting its fee rate and RBF state before using `broadcast=true`.
|
|
34
|
-
- Fees use the current wallet fee settings and chain state. A fresh broadcast
|
|
34
|
+
- Fees use the current wallet fee settings and chain state. v31 removed
|
|
35
|
+
`settxfee`/`paytxfee`; sweep uses native fee estimation and its configured
|
|
36
|
+
fallback, with one locked fee snapshot per transaction. A fresh broadcast
|
|
35
37
|
can fail because an input was spent, relay or mempool policy changed, or the
|
|
36
38
|
fee is no longer sufficient. Recreate and review a preview after such a
|
|
37
39
|
failure; do not assume a previous preview is still valid.
|
|
@@ -67,7 +69,9 @@ anonymous.
|
|
|
67
69
|
selected. Unsafe and immature outputs are not added merely to show a status;
|
|
68
70
|
outputs excluded by those normal availability filters are absent until their
|
|
69
71
|
state changes. “Not spendable” is metadata for a displayed output, not an
|
|
70
|
-
inventory of unavailable outputs.
|
|
72
|
+
inventory of unavailable outputs. Descriptor-owned watch-only coins can be
|
|
73
|
+
selected for PSBT preparation; their status describes missing signing material,
|
|
74
|
+
and does not promise that the wallet can complete every required signature.
|
|
71
75
|
- Explicit input selections are honored for the prepared send. A material wallet
|
|
72
76
|
change, including a competing spend or reorganization, clears the selection
|
|
73
77
|
so the operator must review current inputs again.
|
|
@@ -84,9 +88,9 @@ private-key export, a transaction-history product, or any anonymity guarantee.
|
|
|
84
88
|
## Candidate verification
|
|
85
89
|
|
|
86
90
|
The candidate behavior is exercised by
|
|
87
|
-
`wallet_sweepprivkeys.py` (`test/functional/wallet_sweepprivkeys.py`, source reference),
|
|
88
|
-
`wallet_send.py` (`test/functional/wallet_send.py`, source reference), wallet unit tests, and
|
|
89
|
-
`src/qt/test/wallettests.cpp` (`src/qt/test/wallettests.cpp`, source reference). Before operating
|
|
91
|
+
`wallet_sweepprivkeys.py` (`test/functional/wallet_sweepprivkeys.py`),
|
|
92
|
+
`wallet_send.py` (`test/functional/wallet_send.py`), wallet unit tests, and
|
|
93
|
+
`src/qt/test/wallettests.cpp` (`src/qt/test/wallettests.cpp`). Before operating
|
|
90
94
|
on funds, compare the intended command with the built binary and inspect a
|
|
91
95
|
non-broadcast preview:
|
|
92
96
|
|
|
@@ -99,4 +103,4 @@ python3 ci/test/test_wallet_privacy_contract.py
|
|
|
99
103
|
`bitcoin-cli help sweepprivkeys` and the final transaction preview are the
|
|
100
104
|
authority for a particular binary and transaction. Verify the executable's
|
|
101
105
|
identity separately with `bitcoin-cli --version`; the intended
|
|
102
|
-
`v30.3-roots.1` candidate label in this guide does not replace that check.
|
|
106
|
+
v31 candidate label in this guide does not replace that check.
|