docs: Define trusted-computer boundary

[BenWestgate]

What

• define the trusted-computer boundary consistently in SECURITY.md, the security model, invariants, and user guide;
• make invariant 6 distinguish accidental disclosure from commands whose purpose is to display recovery/export material;
• warn that shell command text can be retained even when prompted or redirected stdin keeps secrets out of argv;
• update the shared CLI safety footer and its exact-help regression.

Why

The earlier invariant literally said secrets stay out of ordinary output even though create, secret, share, correct, and xprv intentionally display secret-bearing material. The documentation also used “trusted computer” without one operational definition. This makes the normative contract literal without changing secret-handling channels.

Review stack

Base: #23 (20-security-audit-docs). Current head: ede98a8.

The reviewed policy change was replayed after the restore/security stack settled. One conflict in docs/security/invariants.md was resolved by retaining both current requirements: intentional recovery/export commands may display their intended material, while wallet setup still transfers the master xprv only through child stdin and private descriptors remain only in Python memory/child stdin. The two follow-up commits retain their stable patch IDs. All prior review threads remain resolved.

Validation

• tests/test_generic_hrp.py: 12 passed normally and 12 under python -O;
• full stacked suite: 950 passed normally and 950 under python -O;
• Ruff check and format check passed;
• strict mypy passed for 21 source files;
• workflow YAML parsed successfully;
• git diff --check passed.

Fixes #4.

Disclosure: AI tools assisted with the mechanical restack and conflict analysis; the contribution still requires responsible human review before integration.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[BenWestgate]

AI-generated review (Claude), posted at the maintainer's request.

ACK b06aedb, nits only.

• Invariant 6 now matches what create/secret/share/correct/xprv actually do.
• Nit: the trusted-computer definition is written out three times (SECURITY.md, model.md, guide.md). Consider one definition in model.md and links elsewhere so they can't drift.

[BenWestgate]

On the “trusted computer” duplication nit: keep the short operational definition in all three places. SECURITY.md is the security-policy entry point and must stand alone; docs/security/model.md is the normative design rationale; docs/user/guide.md is the user-facing instruction. Cross-linking only to the model would make the security policy and user guide weaker when read in isolation. The wording is deliberately the same contract in each location; future drift is reviewable as a literal text diff. No code change warranted.

[BenWestgate]

Release-gate sequencing note: review/merge #57 before final review of this docs PR. #57 and #59 both touch docs/security/invariants.md, docs/security/model.md, and docs/user/guide.md; #57 owns the release-critical verify-before-mutate behavior/contract, while #59 is the trusted-computer/output-boundary clarification. After #57 lands, refresh #59 once against the integrated reviewability-v1 text and preserve its already-resolved 80-column CLI-help fix. This is a sequencing dependency, not a new defect in #59.

[BenWestgate]

AI-generated review, posted at the maintainer's request.

ACK 580b8f8.

[BenWestgate]

Agent release-gate review at exact head 580b8f8: the trusted-computer definition, intentional-vs-accidental output boundary, and shell/stdin guidance are consistent across SECURITY.md, the normative model/invariants, user guide, CLI help, and regression text. The repeated short definition is appropriate because each entry point must stand alone. Exact-head run 36471154686 succeeded. No remaining code/documentation blocker found; review after #57 so restore-boundary wording settles first.

[BenWestgate]

Codex current-head re-review: ACK ede98a8.

The security documentation now defines “trusted computer” consistently, distinguishes intentional recovery/export output from accidental secret disclosure, and warns that shell command text can persist even when stdin keeps secrets out of argv. The CLI footer matches that contract and the one prior help-text nit is resolved. Exact-head Python-package run 643 and Bitcoin Core wallet-fixture run 30 succeeded.

No code or security-contract blocker found; ready for human integration review after #23.