v31.1-roots.1 · Commit 6: [PATCH 06/17] feat(wallet): preserve Roots signing and spend controls on v31
doc/wallet-privacy.md
Before: doc/wallet-privacy.md · After: doc/wallet-privacy.md
File metadata
index 9af45bffb31d1d1c57d6df4b005fbbed903fcb2d..8c31fce29567685b96ce0868798432252169bd39 100644
Download original patch · Release notes
Diff rows 1–67 of 67. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.
doc/wallet-privacy.md
CHANGED
|
@@ -1,15 +1,10 @@
|
|
| 1 |
-
# Advanced wallet privacy preservation contract
|
| 2 |
-
**v31 candidate status: deferred to the wallet theme.** The sweep and enhanced
|
| 3 |
-
coin-control behavior below is the accepted 30.3 source contract, not an
|
| 4 |
-
available v31 feature. Code/test references and example verification commands
|
| 5 |
-
refer to pinned source `10d772eb7f4b00b5193428a0dde4c06558d6c297`.
|
| 6 |
-
[The port review](roots-v31-port-review.md) records implementation ownership.
|
| 7 |
|
| 8 |
-
This guide describes the advanced wallet tools intended for the
|
| 9 |
-
`v30.3-roots.1` candidate. This is candidate documentation, not a release
|
| 10 |
-
announcement; the tools are not part of the published `v29.4-roots.2` release.
|
| 11 |
-
Bitcoin Core v30.3 is the direct upstream base; selected Bitcoin Knots
|
| 12 |
-
history is lineage only, not an upstream dependency or product specification.
|
| 13 |
|
| 14 |
## Sweep an external private key
|
| 15 |
|
|
@@ -27,11 +22,18 @@ external key, not routine wallet import or consolidation.
|
|
| 27 |
watch-only, private-key-disabled, and external-signer configurations are not
|
| 28 |
eligible destinations. Legacy wallets must be migrated to descriptor wallets;
|
| 29 |
this port does not restore a Berkeley DB build option.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 30 |
- `broadcast=false` is the default and returns a signed preview with its input
|
| 31 |
total, fee, input count, transaction ID, and hex. It does not submit a
|
| 32 |
transaction. Review the destination, net amount, and fee; decode the preview
|
| 33 |
when inspecting its fee rate and RBF state before using `broadcast=true`.
|
| 34 |
-
- Fees use the current wallet fee settings and chain state. A fresh broadcast
|
|
|
|
|
|
|
| 35 |
can fail because an input was spent, relay or mempool policy changed, or the
|
| 36 |
fee is no longer sufficient. Recreate and review a preview after such a
|
| 37 |
failure; do not assume a previous preview is still valid.
|
|
@@ -67,7 +69,9 @@ anonymous.
|
|
| 67 |
selected. Unsafe and immature outputs are not added merely to show a status;
|
| 68 |
outputs excluded by those normal availability filters are absent until their
|
| 69 |
state changes. “Not spendable” is metadata for a displayed output, not an
|
| 70 |
-
inventory of unavailable outputs.
|
|
|
|
|
|
|
| 71 |
- Explicit input selections are honored for the prepared send. A material wallet
|
| 72 |
change, including a competing spend or reorganization, clears the selection
|
| 73 |
so the operator must review current inputs again.
|
|
@@ -84,9 +88,9 @@ private-key export, a transaction-history product, or any anonymity guarantee.
|
|
| 84 |
## Candidate verification
|
| 85 |
|
| 86 |
The candidate behavior is exercised by
|
| 87 |
-
`wallet_sweepprivkeys.py` (`test/functional/wallet_sweepprivkeys.py`, source reference),
|
| 88 |
-
`wallet_send.py` (`test/functional/wallet_send.py`, source reference), wallet unit tests, and
|
| 89 |
-
`src/qt/test/wallettests.cpp` (`src/qt/test/wallettests.cpp`, source reference). Before operating
|
| 90 |
on funds, compare the intended command with the built binary and inspect a
|
| 91 |
non-broadcast preview:
|
| 92 |
|
|
@@ -99,4 +103,4 @@ python3 ci/test/test_wallet_privacy_contract.py
|
|
| 99 |
`bitcoin-cli help sweepprivkeys` and the final transaction preview are the
|
| 100 |
authority for a particular binary and transaction. Verify the executable's
|
| 101 |
identity separately with `bitcoin-cli --version`; the intended
|
| 102 |
-
`v30.3-roots.1` candidate label in this guide does not replace that check.
|
|
|
|
| 1 |
+
# Advanced wallet privacy tools (v31 candidate)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 2 |
|
| 3 |
+
The local v31 candidate implements this contract. It is based on Bitcoin Core
|
| 4 |
+
v31.1 and the pinned Roots 30.3 source; this is candidate documentation, not a
|
| 5 |
+
release announcement. See [the port review](roots-v31-port-review.md) for
|
| 6 |
+
implementation and verification provenance. Selected Bitcoin Knots history is
|
| 7 |
+
lineage only, not a product specification.
|
| 8 |
|
| 9 |
## Sweep an external private key
|
| 10 |
|
|
|
|
| 22 |
watch-only, private-key-disabled, and external-signer configurations are not
|
| 23 |
eligible destinations. Legacy wallets must be migrated to descriptor wallets;
|
| 24 |
this port does not restore a Berkeley DB build option.
|
| 25 |
+
Local keys must satisfy a native signing path: an incomplete 2-of-2 multisig
|
| 26 |
+
destination is rejected, while 2-of-3 with two local keys is eligible. This
|
| 27 |
+
check also recognizes encrypted keys without unlocking or exporting them.
|
| 28 |
+
Signing capability does not guarantee present timelock maturity or future
|
| 29 |
+
network acceptance.
|
| 30 |
- `broadcast=false` is the default and returns a signed preview with its input
|
| 31 |
total, fee, input count, transaction ID, and hex. It does not submit a
|
| 32 |
transaction. Review the destination, net amount, and fee; decode the preview
|
| 33 |
when inspecting its fee rate and RBF state before using `broadcast=true`.
|
| 34 |
+
- Fees use the current wallet fee settings and chain state. v31 removed
|
| 35 |
+
`settxfee`/`paytxfee`; sweep uses native fee estimation and its configured
|
| 36 |
+
fallback, with one locked fee snapshot per transaction. A fresh broadcast
|
| 37 |
can fail because an input was spent, relay or mempool policy changed, or the
|
| 38 |
fee is no longer sufficient. Recreate and review a preview after such a
|
| 39 |
failure; do not assume a previous preview is still valid.
|
|
|
|
| 69 |
selected. Unsafe and immature outputs are not added merely to show a status;
|
| 70 |
outputs excluded by those normal availability filters are absent until their
|
| 71 |
state changes. “Not spendable” is metadata for a displayed output, not an
|
| 72 |
+
inventory of unavailable outputs. Descriptor-owned watch-only coins can be
|
| 73 |
+
selected for PSBT preparation; their status describes missing signing material,
|
| 74 |
+
and does not promise that the wallet can complete every required signature.
|
| 75 |
- Explicit input selections are honored for the prepared send. A material wallet
|
| 76 |
change, including a competing spend or reorganization, clears the selection
|
| 77 |
so the operator must review current inputs again.
|
|
|
|
| 88 |
## Candidate verification
|
| 89 |
|
| 90 |
The candidate behavior is exercised by
|
| 91 |
+
`wallet_sweepprivkeys.py` (`test/functional/wallet_sweepprivkeys.py`),
|
| 92 |
+
`wallet_send.py` (`test/functional/wallet_send.py`), wallet unit tests, and
|
| 93 |
+
`src/qt/test/wallettests.cpp` (`src/qt/test/wallettests.cpp`). Before operating
|
| 94 |
on funds, compare the intended command with the built binary and inspect a
|
| 95 |
non-broadcast preview:
|
| 96 |
|
|
|
|
| 103 |
`bitcoin-cli help sweepprivkeys` and the final transaction preview are the
|
| 104 |
authority for a particular binary and transaction. Verify the executable's
|
| 105 |
identity separately with `bitcoin-cli --version`; the intended
|
| 106 |
+
v31 candidate label in this guide does not replace that check.
|