gui: Require the recorded fingerprint before import

[BenWestgate]

Fixes #26.

The library and CLI half is #57, with #81 strengthening ms32 create --existing by moving its independent wallet-record/no-record decision before any new share ceremony. This older GUI branch carries copies of _bitcoin_core.py, cli.py, their tests and Core tools only because its historical gui-reference-v1 base predates that library work; review those files in #57/#81. Here, review only the GUI restore boundary.

Integration note: this branch is reviewed evidence, not the final GUI integration candidate. The clean GUI line is #65 → #66 → #77 → #78. After the library/CLI and remaining foundation/security/API work is integrated into the settled reviewability-v1, rebase that clean GUI stack once and replay/squash only this PR’s reviewed GUI restore-authentication delta onto the resulting tip. Do not preserve this branch's duplicated library snapshot or exploratory Claude co-author history. Resolve #76 from actual rendered Tails evidence, then rerun automated and manual GUI qualification before the fresh adversarial review.

Scope: this PR is the GUI’s accident-safety gate. It prevents a wrong/mixed/miscorrected but checksum-valid recovery from changing Core before the operator identifies the intended wallet. A typed 32-bit fingerprint is not presented as protection against deliberate threshold-share replacement; the seed-keyed encrypted descriptor backup in #55 is the separate first-class malicious-tampering defense.

• Restore: asks for the fingerprint from the wallet record without showing the recovered one. A mismatch stays on the page, says Bitcoin Core wasn’t changed, and lets the user retype.
• Fresh setup: shows the newly created seed’s fingerprint once and requires I wrote it down. It does not authenticate against a pre-existing fingerprint or descriptor because there is no pre-existing wallet identity to prove.
• I have no wallet record: shows the recovered fingerprint, the backup identifier result and the shared warning, then Go back or Restore anyway. This is deliberately a visual accident-safety fallback/authorization, not independent authentication evidence.
• Verify before mutation on restore: before the GUI unlocks an encrypted restore destination, it rechecks the recorded fingerprint. If restore creates a new blank Core destination, the worker rechecks recorded identity immediately before create(). Fresh setup skips that restore-only check.
• The old manual Check again callback on this branch preserved restore mode; gui: Refresh empty wallets automatically #66 removes that manual transition entirely in the final stack and uses serialized in-page polling instead.
• The AST boundary tests distinguish fresh setup from restore and enforce the restore-only verify-before-create path.
• wallet: Add checksummed recovery-record evidence #43 tracks checksummed wallet-record metadata and a canonical single-sig descriptor-checksum option; wallet: Encrypted descriptor backup keyed by the seed #55 tracks the encrypted full descriptor backup.

Validation on the reviewed historical head be8c243: 987 tests pass normally and under -O; focused GUI tests, Ruff, formatting, mypy and git diff --check pass. Final qualification occurs only after replay onto #65/#66/#77/#78 and includes the supported Tails guest-resolution checks.

[BenWestgate]

Looks good, evaluate whether the CLI should require this also.

And whether the user should be asked to type the fingerprint and reject on mismatch (to prevent loading the wrong wallet) or merely verify the displayed recovered fingerprint against the separately stored wallet record.

[BenWestgate]

Superseded: I wrote this before seeing the concept NACK on #31. The current proposal is in #27: a typed fingerprint, enforced once in BitcoinCore.initialize() for both GUI and CLI. #28 should be reworked into that change.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[BenWestgate]

I actually think writing and typing the fingerprint can be avoided by signing and encrypting the descriptor with keys derived from the master root.

The descriptor will only decrypt and signature only validate if the correct master root was recovered. Inside that descriptor will be the descriptor checksum and the fingerprint.

This is far more elegant as we kill two birds with one stone and reduce user burden. The extra dependency is gpg which is installed on Tails and debian by default and bip85 which already has a python reference implementation of which we need a tiny fraction of.

The fingerprint or seedid identifier does no authentication unless we are dealing with shares. Tamperer will just change it to match the seed he controls.

Another time we should be asked for our encrypted descriptor or our fingerprint is when no correction is found due to lack of checksum discrimination, we can push well beyond 13 / 15 erasures when we have a known fingerprint to check against.

[BenWestgate]

@claude review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 819bd468a9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 64e6b96d19

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenWestgate]

Yes—the CLI should enforce the same pre-import safety boundary; stacked PR #31 does so after #29. The user should not be required to retype the 32-bit fingerprint: it is useful diagnostic metadata, but typing it adds friction without making it a strong authentication check. PR #29 instead requires the separately stored 256-bit recovery commitment before wallet mutation.

[BenWestgate]

AI-generated review (Claude), posted at the maintainer's request. I wrote 0cc5437, 819bd46 and 64e6b96, so this is partly self-review.

Concept ACK c5f8993.

• e1180b7..c5f8993 look right: verify now runs before unlock/create in the GUI, and a missing RIPEMD-160 falls through to the SHA-256 rule.
• Same question as #57: create --existing skips the gate (restore=False).
• #57's 6da1f2a removed the identifier check; this PR keeps it. Pick one so the library/CLI halves match.
• 0cc5437, 819bd46 and 64e6b96 have Co-Authored-By: Claude trailers, which AI_POLICY.md forbids. Squash-merge or reword.

[BenWestgate]

AI-generated review, posted at the maintainer's request.

ACK be8c243. Existing-seed creation now uses the same restore gate as wallet recovery, including after re-sharing. The shared CLI blob matches #57 and the full Python package matrix is green.

[BenWestgate]

Release-gate verification at current head be8c243: the GUI restore path re-verifies recorded identity before unlocking an encrypted destination and again immediately before creating a blank restore destination; the corresponding review regressions cover both mutation boundaries. Fresh setup deliberately skips restore authentication because there is no pre-existing wallet identity, and existing-seed initialization now uses the restore gate. Workflow run 36284079882 completed successfully. Review shared Core/CLI code in #57; this PR’s human review can focus on the GUI/window flow.

[BenWestgate]

One non-code release-gate item remains despite the current code ACK: this branch history still contains AI co-author trailers (including 0cc5437, 819bd46, and 64e6b96). docs/developer/AI_POLICY.md requires a human author and says agents must not be authors/co-authors. Before merge, rewrite/squash those commits under the responsible human author while preserving the current be8c243 tree, then rerun the package workflow on the rewritten head.

[BenWestgate]

Release-gate history check: the functional review is now ACKed at be8c243, but the earlier AI_POLICY merge condition still remains in the commit graph. 0cc5437, 819bd46, and 64e6b96 still carry Co-Authored-By: Claude ... trailers. Do not merge this PR with commit-preserving merge/rebase as-is. Either rewrite those commits under the responsible human author before final review, or use a maintainer-authored squash commit when the GUI branch is rebuilt on the integrated reviewability-v1 + #57 line. The latter fits the already-required GUI re-integration and avoids preserving the duplicated shared-library snapshot.

[BenWestgate]

Agent release-gate review of the historical GUI evidence at exact head be8c243: the GUI-specific restore path asks for independent fingerprint evidence before wallet selection, re-verifies it immediately before unlocking an encrypted destination, and re-verifies before creating a new restore destination. The explicit no-record path discloses fingerprint/identifier evidence and requires affirmative restore authorization; fresh creation does not pretend to authenticate a nonexistent prior wallet. Focused tests cover mismatch-before-unlock, and exact-head run 36284079882 succeeded. The GUI behavior is suitable to replay, but this PR itself remains not mergeable as the final candidate: its branch duplicates library/CLI work now owned by #57 and contains historical AI co-author trailers. Replay/squash only the reviewed GUI delta onto #65 → #66 after refreshed #57 is integrated.

[BenWestgate]

GUI replay map for the final clean stack:

• Treat gui: Require the recorded fingerprint before import #28 as reviewed behavioral evidence, not a commit sequence to cherry-pick. Its cumulative GUI-only delta is confined to five files: docs/user/gui.md, src/codex32_gui/pages.py, src/codex32_gui/wallet_setup.py, tests/test_gui_boundaries.py, and tests/test_gui_wallet_setup.py. Do not replay its shared _bitcoin_core.py, CLI, shared tests, or Core tools; those are owned by wallet: Require the recorded fingerprint before import #57/wallet: Distinguish unavailable Bails checks #80/wallet: Check existing seed before sharing #81 on the settled library line.
• Replay the semantics onto the final gui: Add optional graphical interface #65 → gui: Refresh empty wallets automatically #66 → gui: Apply Tails field-test feedback #77 → gui: Let the home window choose its height #78 tip: fresh creation shows the newly derived fingerprint and requires I wrote it down before wallet selection; restore first asks for the separately recorded fingerprint without disclosing the recovered one; mismatch remains on the identity page with no Core mutation; the explicit no-record path shows fingerprint + identifier evidence/warning and requires affirmative restore authorization.
• Thread the resulting expected_fingerprint (or explicit None for the no-record fallback/fresh setup) through the current polling _wallets/_wallet_page flow into unlock/create/import. gui: Refresh empty wallets automatically #66 already removed the historical manual Check again transition; do not reintroduce it. Poll refreshes must preserve both restore mode and the identity evidence.
• Preserve verify-before-mutate at the two GUI-only mutation boundaries: on restore, verify immediately before wallet_setup.create() creates a destination wallet, and verify before an app-supplied passphrase unlocks an encrypted destination. Final BitcoinCore.initialize() must still receive the expected fingerprint so import remains guarded as well.
• Replay the focused GUI regressions with the adapted flow: every restore route reaches the identity decision; restore verifies before destination-wallet creation; a mismatch occurs before walletpassphrase; fresh setup does not pretend to authenticate a pre-existing wallet. Keep gui: Refresh empty wallets automatically #66’s disappearing-wallet/polling regressions intact.

This map is derived from exact historical head be8c243 and current clean GUI tip 38373b3. The historical AI-coauthor/duplicated-library commits remain intentionally excluded. Final replay still waits for #42 → refreshed #57 → #46 → #80 → #81 and the remaining foundation work to settle, then gets one GUI qualification pass on the integrated tip.