wallet: Require the recorded fingerprint before import

[BenWestgate]

Fixes #30. Library/CLI half of #26; GUI half is tracked separately.

This adds the restore-time wallet identity gate before Bitcoin Core mutation.

• BitcoinCore.initialize() accepts an expected fingerprint and checks it before wallet selection, unlock, creation or import.
• ms32 wallet requires the fingerprint from the wallet record; mismatch retries without changing Core.
• the recovered fingerprint is not shown before that typed-record gate, including during correction; choosing the no-record fallback is an explicit disclosure path, and declining it ends that restore attempt rather than returning to record-based verification;
• ms32 create --existing uses the same restore gate, including after re-sharing, and does not expose the recovered fingerprint through correction or rendering before the independent record/no-record decision;
• with no wallet record, the CLI shows the recovered fingerprint, backup identifier and codex32/Bails/Bails-alpha identifier-origin result, then requires the warning/confirmation path;
• fresh ms32 create only records the new fingerprint; it has no pre-existing wallet identity to authenticate;
• parse_fingerprint() accepts 8 hex digits in any case or spacing.

#43 tracks checksummed wallet-record fields; #55 tracks the separately planned encrypted full-descriptor backup; #56 tracks identifier-assisted correction ranking. The current release gate is accident safety, not malicious-share-tampering resistance.

Current head 3f42e85 is one human-authored commit stacked directly on #45 (794f898), which is stacked on #42. All inline review threads are resolved.

Exact-head security re-verification:

• BitcoinCore.initialize() calls verify_identity() before _select() or any wallet RPC/mutation;
• test_identity_mismatch_stops_before_any_wallet_call passes and asserts the RPC call log stays empty on mismatch;
• test_no_record_is_the_operators_choice_and_checks_nothing passes, preserving the explicit fallback contract;
• CLI source keeps the recovered fingerprint hidden until the independent record/no-record decision for both ms32 wallet and ms32 create --existing.

Validation:

• prior full validation included the normal and optimized suites, wallet differential verification, Ruff/format, strict mypy and git diff --check;
• exact-head GitHub Python-package run 435: success.

Human review order is #42 → #45 → #57 → #46.

The repository-wide review budget is the maintainer-authorized <5200.

AI assistance on review follow-ups is disclosed by commit authorship.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5eaf535bb7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenWestgate]

Contract clarification applied in b50321a: ms32 create no longer treats the new fingerprint as authentication evidence or asks the user to type it back. It only requires acknowledging that the fingerprint was written on the wallet record. ms32 wallet retains the fingerprint/no-record restore gate. 886 normal + 886 optimized tests pass.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6da1f2a416

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenWestgate]

AI-generated review (Claude), posted at the maintainer's request. I wrote 5eaf535, so this is partly self-review.

Not ACKing 6da1f2a.

• 6da1f2a removes identifier_origin/identifier_note, which the no-record path was built to show. If that's intended, invariants.md:16-18 and model.md:232 still promise it (agree with the Codex P2). If not, revert it. Either way #57 now differs from #28, which keeps them.
• Policy: 6da1f2a is authored by Codex Preflight <codex-preflight@localhost>, and AI_POLICY.md forbids agent authors. Its message also contains a literal \n\n and has no area prefix. 5eaf535 has a Co-Authored-By: Claude trailer, which the same policy forbids. Squash-merge or reword.
• Q: create --existing imports an existing seed (timestamp 0) with restore=False, so it skips the fingerprint gate. Should it pass restore=True? The Enter-if-none path keeps it usable.

[BenWestgate]

AI-generated review, posted at the maintainer's request.

Concept ACK 70a188a. The no-record identifier evidence is restored and matches #28 again.

One correctness item remains: ms32 create --existing supplies an existing seed but still reaches _initialize_wallet(..., restore=False), so it can import without the wallet-record gate. Treat --existing as a restore for wallet initialization.

[BenWestgate]

AI-generated review, posted at the maintainer's request.

ACK 795ccdd. Existing-seed initialization now uses the same restore gate before import, including after re-sharing; identifier evidence remains aligned with #28. Full Python package matrix is green.

[BenWestgate]

Release-gate verification at current head 795ccdd: the authoritative Core boundary calls verify_identity(secret, expected_fingerprint) before _select(), so mismatch occurs before wallet listing/selection, unlock, creation, or descriptor import. The focused regression test_identity_mismatch_stops_before_any_wallet_call asserts the mismatch and rpc.calls == []. The current Python package workflow run 36284182340 completed successfully. This satisfies the verify-before-mutate accident-safety finding for the CLI/library subset; #55 remains the separate malicious-tampering/descriptor-backup design.

[BenWestgate]

One non-code release-gate item still remains despite the code ACK: the current PR history still contains 5eaf535 with a Co-Authored-By: Claude trailer and 6da1f2a authored/committed by Codex Preflight. docs/developer/AI_POLICY.md says not to include agents as authors or co-authors. Before merge, squash/reword/rebase this branch under the responsible human author while preserving the current 795ccdd tree, then rerun the green package workflow on the rewritten head.

[BenWestgate]

Release-gate history check: the functional fix is ACKed at 795ccdd, but the commit-policy condition from the earlier review still remains. The branch history still contains 5eaf535 with a Co-Authored-By: Claude ... trailer and 6da1f2a authored by Codex Preflight <codex-preflight@localhost> (later behavior commits correct the code, but do not remove those history records). Before merge, rewrite/squash so the retained release commit is authored by the responsible human and follows AI_POLICY.md. Functionally, the verify-before-mutate boundary and existing-seed restore gate are green.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[BenWestgate]

Release-gate history follow-up: the earlier commit-policy blocker is now resolved. Current head dcc0d41 is a single commit directly on cf1a599, authored and committed by Ben Westgate, with no agent author/co-author history retained. The fresh Python package run 36291219348 on dcc0d41 completed successfully. Functionally this preserves the ACKed 795ccdd recovery-gate tree, so #57 is ready for human review on the CLI/library accident-safety scope.

[BenWestgate]

Security fix-verification refresh at current head dcc0d41: fixed for the CLI/library verify-before-mutate finding. I re-ran the exact current PR archive: test_identity_mismatch_stops_before_any_wallet_call and test_no_record_is_the_operators_choice_and_checks_nothing both pass, and static inspection confirms BitcoinCore.initialize() calls verify_identity(secret, expected_fingerprint) before _select(), so a mismatch precedes wallet selection/listing, unlock, creation, or descriptor import. The no-record legitimate fallback remains functional. This verifies the accident-safety boundary only; #55 remains the separate malicious-tampering/descriptor-backup design.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e59ac573d2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 688d1c080e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cbbfc39c1a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[BenWestgate]

Sequencing note: current head eff541c0 is security-verified and green, but final human review should follow #7. A fresh integration preflight shows #12/#13/#59/#7/#51 plus #42/#45 compose cleanly, then #57 has exactly one mechanical conflict in tools/bitcoin_core_regtest.py. The refresh must keep #7’s loop verifying every frozen Core fingerprint and #57’s recovered-secret fingerprint passed as expected_fingerprint before each initialize call. Refresh once after #7 lands; the library/CLI security boundary itself needs no redesign.