Conversation
Jossec101
marked this pull request as draft
August 19, 2026 10:59
Jossec101
force-pushed
the
docs/internal-wallet-rotation
branch
from
August 24, 2026 14:39
ed2dc96 to
75947b8
Compare
Jossec101
force-pushed
the
docs/internal-wallet-rotation
branch
from
August 26, 2026 16:12
75947b8 to
decc37e
Compare
Jossec101
force-pushed
the
docs/internal-wallet-rotation
branch
from
August 28, 2026 09:22
decc37e to
07dfd02
Compare
Jossec101
force-pushed
the
docs/internal-wallet-rotation
branch
from
August 31, 2026 15:47
07dfd02 to
28734cf
Compare
Jossec101
force-pushed
the
docs/internal-wallet-rotation
branch
from
September 11, 2026 15:14
28734cf to
2979f06
Compare
Paired bump: NBXplorer.Client 5.0.8 targets net10.0 and requires NBitcoin >= 10.0.8. Also NBitcoin.TestFramework 4.0.2 -> 5.0.2. NBitcoin 10 removed the NBitcoin.Scripting OutputDescriptor API; its Miniscript/WalletPolicies replacement only parses BIP388 multipath descriptors (/**), which NodeGuard's watch-only import explicitly rejects (only external-chain /0/* keys are accepted). To preserve the exact accepted grammar and error behavior, WalletParser now parses the small supported descriptor surface directly (wpkh/pkh/multi/sortedmulti/ wsh(multi), origins, checksum validation) and renders export descriptors manually with Miniscript.AddChecksum for the BIP380 checksum. The lexicographical-order test rebuilds the descriptor from the multisig script parameters since OutputDescriptor.InferFromScript is gone. All 389 tests pass, including the pinned descriptor parse/export vectors (checksums, key ordering, error types).
Operations runbook for rotating the NodeGuard internal wallet master seed as proactive hygiene: preflight SQL inventories (incl. the hardened-path STOP gate and the channel close-address long tail), the seed ceremony via the remote signer's seed-ceremony CLI, Lambda env configuration with the snapshot->merge->apply pattern, the InternalWallets INSERT that flips the current wallet, a hot single-sig canary that proves the new seed end to end, wallet recreation + liquidity-rule/funds-destination re-pointing, UI-driven drains, archiving, and the long-tail policy (keep MF_<old> forever, mark it Compromised once old single-sig wallets are empty). Known gaps are documented as caveats (stale add-key modal on old wallets, mixed-fingerprint Lambda throw, silent FKs, global subderivation counter, hardened-path limitation) rather than fixed, per scope decision.
Jossec101
force-pushed
the
docs/internal-wallet-rotation
branch
from
September 14, 2026 13:18
2979f06 to
beb459a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Operations runbook for rotating the NodeGuard internal wallet master seed
as proactive hygiene: preflight SQL inventories (incl. the hardened-path
STOP gate and the channel close-address long tail), the seed ceremony via
the remote signer's seed-ceremony CLI, Lambda env configuration with the
snapshot->merge->apply pattern, the InternalWallets INSERT that flips the
current wallet, a hot single-sig canary that proves the new seed end to
end, wallet recreation + liquidity-rule/funds-destination re-pointing,
UI-driven drains, archiving, and the long-tail policy (keep MF_
forever, mark it Compromised once old single-sig wallets are empty).
Known gaps are documented as caveats (stale add-key modal on old wallets,
mixed-fingerprint Lambda throw, silent FKs, global subderivation counter,
hardened-path limitation) rather than fixed, per scope decision.
Stack created with GitHub Stacks CLI • Give Feedback 💬