CommitWatch RSS
BC
← All projectsBitcoin Core

Hardware Wallet Interface

Python library and command-line interface for Bitcoin hardware-wallet communication.

BitcoinHardware integrationSoftware walletsNormal
Source repository ↗
Repository coverage

79 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

29security candidates8second-pass queue56AI analyses
2commits · 30 days
58commits · 60 days
73commits · 180 days
78commits · 365 days
Backfill bands
Aug 5 → Feb 63 seen1 candidatesComplete
Feb 6 → Jun 63 seen0 candidatesComplete
Jun 6 → Jul 61 seen0 candidatesComplete
Jul 6 → Aug 522 seen1 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
23Strong · 80–100
28Adequate · 60–79
22Thin · 40–59
6Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Sjors Provoost552238066
Ava Chow20714069
Salvatore Ingala202057
andreasgriffin101018
Rohit Yadav101050
Analysis record

Published AI watches

Last scanned 0 minutes ago

Low 29 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#792: Optionally pass BIP388 policy to signtx

This commit adds an optional feature to the HWI tool that lets users pass previously registered Bitcoin wallet policies (BIP388) when signing transactions. It is a feature addition, not a fix for a known vulnerability. The change extends t…

New CLI argument `--registration` is appended to `signtx` and deserialized before being passed to hardware wallet clientsSeveral backends now accept and use `registered_descriptors` during PSBT signingBackends without BIP388 support raise `UnavailableActionError` when registrations are supplied
e63a0af2by Ava Chow+572−19119 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 81 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#853: psbt: enable type checking

This is a code-quality and type-safety patch. It adds the psbt.py file to the project's automated type-checking workflow and fixes two small logic issues where a value was assigned to an object field before being validated. The changes mak…

Validation moved before state mutation (defensive coding)Type annotations added to public methodsFile added to CI type-check coverage
390d9f84by Ava Chow+9−62 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 35 · Opaque
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: enable type checking

This commit turns on automated type checking for one more source file (hwilib/psbt.py) and makes small code changes so the file passes the type checker. The actual code changes move two integer assignments slightly later so validation happ…

Type checking enabled for PSBT moduleValidation ordering tightened for locktime fieldsExplicit type annotations added to PSBT methods
37643bd8by Sjors Provoost+9−62 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: extract PSBT helpers

This commit is a simple code cleanup in the test suite. It pulls out two small blocks of test code into reusable helper functions for signing and finalizing PSBTs, and for setting global xpubs in PSBTs. There is no change to production cod…

adc8ccb3by Sjors Provoost+25−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

coldcard: extract transaction signing helpers

This commit simply reorganizes the Coldcard hardware wallet signing code in HWI by moving existing logic into two new helper methods. There is no change to what the code actually does; it is a pure refactoring (code cleanup) with no securi…

826a2ac5by Sjors Provoost+76−641 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: detect keys and signatures by fingerprint

This commit adds two helper methods to the PSBT (Partially Signed Bitcoin Transaction) handling code that let the library check whether a specific hardware wallet's fingerprint appears in a transaction input, and whether that fingerprint h…

Adds fingerprint-based key/signature detection in PSBT input parsingIncludes unit tests covering legacy BIP32, Taproot key path, and Taproot script path casesNo caller or usage of new methods shown in the diff
3cc34937by Sjors Provoost+74−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

ledger: support BIP388 policy signing

This commit updates the Ledger hardware wallet support in HWI so that newer Ledger devices can sign Bitcoin transactions using registered BIP388 wallet policies. Previously, any attempt to use registered descriptors with a Ledger was block…

Change removes an explicit error path for registered descriptors, increasing supported functionalityAdds reconstruction of registered wallet policies and propagation of registration HMACs during PSBT signingTouches hardware-wallet signing path where incorrect policy handling could lead to signing unintended transactions
ac80a37bby Sjors Provoost+21−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#849: coldcard: bump firmware, add edge, display taproot address, restore test_signtx (ex. multisig)

This is a routine feature-and-testing update for the Coldcard hardware wallet support in Bitcoin Core's HWI tool. It adds support for Coldcard's 'Edge' experimental firmware, lets users display single-signature Taproot addresses on Edge, a…

PSBT version downgrade logic moved from per-pass to once-per-signing; intended to preserve v2 when supported and downgrade when notNew firmware version parsing heuristic treats Q/X suffixes and Edge/simulator as PSBTv2 capableTaproot singlesig address display enabled only for Coldcard Edge firmware
8593a755by Ava Chow+220−8819 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#842: Add `registerdescriptors` command for registering a descriptor with a device

This commit adds a new command called `registerdescriptor` to the HWI tool, which lets users register Bitcoin output descriptors with supported hardware wallets (Ledger, BitBox02, Jade, Coldcard). It also rewrites how descriptors are parse…

New command registers user-supplied descriptors with hardware walletsHWI explicitly does not validate descriptors before passing them to the device; device errors are propagatedDescriptor parser changed from string-based derivation paths to structured list-of-lists, affecting all descriptor handling
d928dae5by Ava Chow+709−12320 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#839: psbt: misc fixes and add remaining BIP 174 and BIP 370 test vectors

This commit tightens how the Bitcoin hardware wallet interface library reads PSBT files. It now rejects PSBTv0 files that contain fields only allowed in the newer PSBTv2 format, enforces sensible locktime ranges, and fixes several bugs whe…

Strict PSBT version field validationNew locktime bound enforcementWitness-stripped unsigned tx parsing
695c731bby Ava Chow+122−134 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

bitbox02: support BIP388 policy signing

This commit adds support for signing Bitcoin transactions with registered wallet policies (BIP388) on the BitBox02 hardware wallet. Previously this feature was rejected with an error. The change translates a registered wallet descriptor in…

Removal of an explicit unsupported-action error for BIP388 policy signingNew xpub and fingerprint comparison logic to identify the device's key in a policyNew policy script config construction passed to hardware signing routines
a76f3447by Sjors Provoost+32−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 60 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

jade: support BIP388 policy signing

This change removes an error that previously blocked Bitcoin signing for a specific type of wallet policy (BIP388) on the Blockstream Jade hardware wallet. The device now supports these policies, so the software no longer needs to reject t…

Removal of an explicit unsupported-action errorNo new cryptographic operations introducedNo input validation changes observed
db189db5by Sjors Provoost+1−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

coldcard: support BIP388 policy signing

This commit adds support for signing Bitcoin transactions with named wallet policies (BIP388) on newer Coldcard hardware wallets. It is a feature addition, not a fix for a known security flaw. The change removes an error that previously bl…

Feature addition for BIP388 policy signingRemoval of UnavailableActionError guard for registered_descriptorsNew miniscript_name parameter length-bounded to 1-32 ASCII bytes
7e278f48by Sjors Provoost+54−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

signtx: add BIP388 policy support

This commit adds a new command-line option and API parameter for BIP388 registered descriptor policies to the transaction-signing flow. It does not implement actual signing support in any hardware wallet driver; every device implementation…

New API surface added for BIP388 policy registrationAll device implementations explicitly reject BIP388 policy signing with UnavailableActionErrorNo existing signing path is modified; default behavior unchanged
6f44e489by Sjors Provoost+85−1110 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#819: Drop Python 3.9, use 3.10 for dist, bump Ledger

This is a routine maintenance merge for the Bitcoin Core Hardware Wallet Interface (HWI). It drops support for the end-of-life Python 3.9, switches deterministic builds and CI to Python 3.10, updates Ledger test firmware/simulator versions…

Dependency/toolchain version bump (Python 3.9 EOL removal, Python 3.10 adoption)Ledger firmware/app and Speculos simulator version bump in CI/testsTest automation rules updated for new Ledger UI prompts
2daa5916by Ava Chow+124−15629 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Drop Ledger deny rule from tests

This commit removes an unused test automation rule that automatically pressed a button when a Ledger hardware wallet simulator showed 'Cancel' or 'Reject' on screen. It only affects test data, not the actual wallet interface code users rel…

0379e278by Sjors Provoost+0−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: reenable LedgerX tests

This commit only re-enables automated tests for Ledger Nano X hardware wallets. It removes code that was skipping certain tests, but makes no changes to the actual wallet-interaction code that users rely on. There is no security fix or vul…

d2a5874aby Sjors Provoost+0−201 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Skip archiving hwi-qt on non-x86 platforms

This change adjusts the build script so that the graphical hwi-qt program is only bundled into release archives for 64-bit x86 (Intel/AMD) systems. On other CPU architectures, only the command-line hwi tool is packaged. This is a build/pac…

1b0cbea5by Sjors Provoost+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: increase stdin command timeout

This commit only changes a test timeout from 60 seconds to 120 seconds so that automated tests can complete when a Ledger hardware wallet running newer firmware takes longer to sign a large test transaction. It does not change any producti…

cd8a4317by Sjors Provoost+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Bump Speculos and Ledger Bitcoin app

This commit updates the versions of testing tools and Ledger Bitcoin app used in HWI's automated test environment. It does not change the actual HWI wallet-interaction code that users run. The changes are purely to keep CI/test simulations…

976353edby Sjors Provoost+28−95 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateMerge bitcoin-core/HWI#792: Optionally pass BIP388 policy to signtxby Ava Chow · e63a0af2 · Aug 25, 2026 · 19 filesMessage 91 · StrongLow 29Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#792: Optionally pass BIP388 policy to signtx

97c13f1e99384816518a48095e59a8a1f9468d7a test: navigate Ledger transaction review screens (Sjors Provoost)
4ca5396e7f794fe5bef3e2c65257ceb23dc3df32 test: dismiss Ledger completion screens (Sjors Provoost)
e0b2b836236e7978bcdeb7aa2097ec44791fae5b test: sign with multiple registered descriptors (Sjors Provoost)
5642ebdda3d0d836039c6bca8bd4631774e46993 test: sign with registered descriptors (Sjors Provoost)
adc8ccb3a9644f5b179ee40aafbd273a87fa9142 test: extract PSBT helpers (Sjors Provoost)
a76f344799d659442e5d2ce3ce92f210a0d85408 bitbox02: support BIP388 policy signing (Sjors Provoost)
db189db5271a0fcaee93e36307ff73290efa3ecb jade: support BIP388 policy signing (Sjors Provoost)
7e278f48f82c3276da318cdf16d753b7304e6de9 coldcard: support BIP388 policy signing (Sjors Provoost)
826a2ac5d8d4f9b2b7adb3b98e8a70a393244b59 coldcard: extract transaction signing helpers (Sjors Provoost)
3cc349378aff80936943ddff087b3502eb207346 psbt: detect keys and signatures by fingerprint (Sjors Provoost)
ac80a37b80a0a8160aa1cfe32362abc2b2b39ebd ledger: support BIP388 policy signing (Sjors Provoost)
b8cecf0e4345b73436fc5fcd85331d9f0a0523c8 descriptor: remove unused script expansion (Sjors Provoost)
db15214dd9227f6dbea80ab5a3deb483392445e7 descriptor: add address type helper (Sjors Provoost)
6f44e48980bf610a57195f43a74027f4dc20e385 signtx: add BIP388 policy support (Sjors Provoost)
dc1f9b42cf9ac251ae980b579b20c6f2d2e934d6 Consistently name sign_tx psbt argument (Sjors Provoost)

Pull request description:

Another step toward #785.

This adds optional registered BIP388 descriptor policy information to
`signtx`. Existing `signtx` usage remains unchanged when no registration
is supplied.

`signtx` accepts `--registration`, containing the serialized
`RegisteredDescriptor` returned by the `registerdescriptor` command from
#842. The registration contains the policy name, descriptor, device type,
and any device-specific registration data, so separate `--policy-desc`
and `--policy-name` arguments are not needed.

Example:

```bash
hwi --device-type ledger signtx \
--registration "cmRlc2M..." \
"cHNidP..."

ACKs for top commit:
achow101:
ACK 97c13f1e99384816518a48095e59a8a1f9468d7a

Tree-SHA512: dd1fc192f06016ade895e4f87d35a7f1b22a01a8e562e3a3d2a4ddcf1da6dd36dd2ad80ac414b339affeab99389c8dee0750e63ac93f38f0fe1ffcb1f4c5ffdd

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarysigning or wallet pathparser or protocol pathmerge-commit duplicate discount
AI analysis · Low 29/100

This commit adds an optional feature to the HWI tool that lets users pass previously registered Bitcoin wallet policies (BIP388) when signing transactions. It is a feature addition, not a fix for a known vulnerability. The change extends the command-line interface and several hardware wallet backends to accept an optional `--registration` argument during signing. Existing behavior is preserved when the argument is not provided. There is no direct evidence in the commit that this introduces a security bug, but any code that handles cryptographic signing and parses external data deserves careful review.

Security candidateMerge bitcoin-core/HWI#853: psbt: enable type checkingby Ava Chow · 390d9f84 · Aug 25, 2026 · 2 filesMessage 81 · StrongInformational 18Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#853: psbt: enable type checking

37643bd8e4f86324b75723525149eb945275395c psbt: enable type checking (Sjors Provoost)

Pull request description:

ACKs for top commit:
achow101:
ACK 37643bd8e4f86324b75723525149eb945275395c

Tree-SHA512: aa1722f2e3f65c387a3bb5d6631cb666c6aa83f8ccc3b46c6a8f4585eb6ba02462dd78ec8027fc278fca1b2b0fc7d1bb9f6729781c2cb9b82321017919a6aeba

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarysigning or wallet pathmerge-commit duplicate discount
AI analysis · Informational 18/100

This is a code-quality and type-safety patch. It adds the psbt.py file to the project's automated type-checking workflow and fixes two small logic issues where a value was assigned to an object field before being validated. The changes make the code safer and cleaner, but they do not appear to fix an active security vulnerability that could be exploited.

Security candidatepsbt: enable type checkingby Sjors Provoost · 37643bd8 · Aug 24, 2026 · 2 filesMessage 35 · OpaqueInformational 18Details
Commit message · Sjors Provoost

psbt: enable type checking

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 18/100

This commit turns on automated type checking for one more source file (hwilib/psbt.py) and makes small code changes so the file passes the type checker. The actual code changes move two integer assignments slightly later so validation happens before storing the value, and add explicit type annotations to two methods. There is no direct evidence this fixes a security vulnerability; it is primarily a code-quality and type-safety improvement.

Security candidatetest: extract PSBT helpersby Sjors Provoost · adc8ccb3 · Aug 21, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Sjors Provoost

test: extract PSBT helpers

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit is a simple code cleanup in the test suite. It pulls out two small blocks of test code into reusable helper functions for signing and finalizing PSBTs, and for setting global xpubs in PSBTs. There is no change to production code, no security fix, and no behavior change.

Security candidatecoldcard: extract transaction signing helpersby Sjors Provoost · 826a2ac5 · Aug 21, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Sjors Provoost

coldcard: extract transaction signing helpers

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit simply reorganizes the Coldcard hardware wallet signing code in HWI by moving existing logic into two new helper methods. There is no change to what the code actually does; it is a pure refactoring (code cleanup) with no security-relevant behavior change visible in the diff.

Security candidatepsbt: detect keys and signatures by fingerprintby Sjors Provoost · 3cc34937 · Aug 21, 2026 · 2 filesMessage 45 · ThinInformational 24Details
Commit message · Sjors Provoost

psbt: detect keys and signatures by fingerprint

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 24/100

This commit adds two helper methods to the PSBT (Partially Signed Bitcoin Transaction) handling code that let the library check whether a specific hardware wallet's fingerprint appears in a transaction input, and whether that fingerprint has already provided a signature. The change is purely additive and includes tests. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a defensive or feature-oriented improvement to support better transaction signing workflows.

Security candidateledger: support BIP388 policy signingby Sjors Provoost · ac80a37b · Aug 21, 2026 · 1 fileMessage 68 · AdequateLow 31Details
Commit message · Sjors Provoost

ledger: support BIP388 policy signing

Reconstruct each registered wallet policy and pass its registration HMAC
when signing the PSBT. Inferred policies continue to be signed alongside
registered policies.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Low 31/100

This commit updates the Ledger hardware wallet support in HWI so that newer Ledger devices can sign Bitcoin transactions using registered BIP388 wallet policies. Previously, any attempt to use registered descriptors with a Ledger was blocked with an error. The change removes that blanket block for modern Ledger apps and adds logic to reconstruct each registered wallet policy and include its registration proof when signing. Inferred policies still work as before. This is a feature addition, not a fix for an active vulnerability, but it touches security-sensitive signing code.

Security candidateMerge bitcoin-core/HWI#849: coldcard: bump firmware, add edge, display taproot address, restore test_signtx (ex. multisig)by Ava Chow · 8593a755 · Aug 20, 2026 · 19 filesMessage 91 · StrongLow 25Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#849: coldcard: bump firmware, add edge, display taproot address, restore test_signtx (ex. multisig)

aa3e73359c9d49140015f1e55ec61241ed39e313 ci: add finite APT connection timeouts/retries (Sjors Provoost)
90b7b0a6d498641704acefc920bbe1a772bdf799 ci: bump GitHub Actions versions (Sjors Provoost)
f8bd2942aae917f17c453308888bfe96aa7996e7 coldcard: preserve PSBTv2 when supported (Sjors Provoost)
e5aa9ccba5c93ad567a29f6e64b466dba202e8e5 coldcard: display singlesig taproot address on EDGE (Sjors Provoost)
534468cf1f79523d736dae1718116cb5933a8cdf ci: run Coldcard Edge simulator tests (Sjors Provoost)
454e36e3b32816c4bd0ad6269b03a2e3947d16f3 ci: parameterize device test matrix (Sjors Provoost)
2cda52a024e304be4b6db88c7d8bf946ffcd09c8 test: support Coldcard Edge in device tests (Sjors Provoost)
8dc9a6f796f58728a05c24b5c6218af700d386aa ci: build Coldcard Edge simulator (Sjors Provoost)
57b062ee12a5bdf3773a509a203d58aa95c287ae test: factor out Coldcard firmware setup (Sjors Provoost)
9b420ea7240bc11a720bdea0b2a20a842cea5899 test: limit Coldcard simulator checkout (Sjors Provoost)
893818a3f6421a2125260f0c81c68702b79e9ae0 test: bump Coldcard firmware to 5.6.0 (Sjors Provoost)
257e1ae1c8fb7aa099ce9a98e52a4c6606832398 test: reenable Coldcard singlesig transaction signing (Sjors Provoost)

Pull request description:

The Edge firmware supports displaying taproot single sig addresses, and more importantly MuSig2.

Rather than blowing up the CI matrix, this PR only adds it for Python 3.14. It can be easily be dropped again if all Edge features we care about land in their regular firmware.

The first commit re-enables `test_signtx`, which was already possible. It achieves this by dropping multisig for ColdCard in that these. This can be re-introduced by #792.

The multisig patch is adjusted or Edge. Alternatively after #847 it could be dropped entirely. It builds, but CI won't cover it until #792. I did test it locally.

- fixes #799
- fixes #703
- superseedes #833
- superseedes #725

ACKs for top commit:
achow101:
ACK aa3e73359c9d49140015f1e55ec61241ed39e313

Tree-SHA512: e67745bdea35c9d6d6515d83daecbb2f750bf925f403e03b102e4996b9a56194b4b7a4316d44565ab2a1768a2bb6b0a19068e7bfe2cedca829c6d39006329c66

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarymerge-commit duplicate discount
AI analysis · Low 25/100

This is a routine feature-and-testing update for the Coldcard hardware wallet support in Bitcoin Core's HWI tool. It adds support for Coldcard's 'Edge' experimental firmware, lets users display single-signature Taproot addresses on Edge, and re-enables transaction-signing tests by dropping multisig cases for Coldcard. It also changes how PSBT version 2 is handled: newer Coldcard firmware keeps PSBTv2, while older firmware is downgraded to PSBTv0 before signing. There is no obvious security bug in the diff, but the PSBT version handling and new firmware support are worth a careful look because mistakes there could affect transaction validity or compatibility.

Security candidateMerge bitcoin-core/HWI#842: Add `registerdescriptors` command for registering a descriptor with a deviceby Ava Chow · d928dae5 · Aug 18, 2026 · 20 filesMessage 91 · StrongLow 32Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#842: Add `registerdescriptors` command for registering a descriptor with a device

50f5781e70552cca094cba23d0d301f46d364306 test: Add basic test for register_descriptor (Ava Chow)
8fc30319af2fc7f20417be594164f73c596723ad jade: Implement register_descriptor (Ava Chow)
3fc07a6ced1aa1c43d8265ef245c303b5cd385b9 coldcard: Implement register_descriptor (Ava Chow)
9f91e1a61c10ed13782407eac7a0bfb67933d2e2 bitbox02: Implement register_descriptor (Ava Chow)
1d6361bb32332eabcc78862bbcdc0de8e7c504e5 ledger: Implement register_descriptor (Ava Chow)
24ca3c64536b5ff71639b6dab614803edf4c8432 Implement register_descriptors for devices that don't support it (Ava Chow)
da7aa3f32178b1028069d71dfbc45fb070ded063 CLI command and boilerplate for registerdescriptor (Ava Chow)
875d7b6ee4142d9b57c90417ef768b0b80f1b934 descriptor: Add RegisteredDescriptor for holding registration data (Ava Chow)
50a6e78dd6e5dc39bbf964fa52f22f07f9c24ba4 descriptor: Add functions for making BIP 388 wallet policies (Ava Chow)
3cfc210e6fb2f28b37eaad527d96f1932f9da9ab descriptor: Parse multipath path specifiers (Ava Chow)
e2bd86e88c736e51dc36b6ad7c1de2baae37e78e descriptors: Actually parse the derivation path (Ava Chow)
1f5d85a4f3b520983cf1d646b2481bf82d3a80cf descriptor: Track key expression index (Ava Chow)
447991ffcbdeb05762ae81a2e20d204ec0d0c72d descriptor: Don't sort PubkeyProviders in sortedmulti (Ava Chow)

Pull request description:

The Ledger, BitBox02, Jade, and Coldcard all support registering descriptors with the device to enable signing txs involving complex scripts. This PR adds a `registerdescriptor` command which takes a name and the descriptor to register. The command returns a `registration` which may contain data that must be provided to the device at a later time to remind it of the registered descriptor.

For the BiBox02, Jade, and Coldcard, this command returns an empty string for the registration as these devices store the registration and do not need a reminder.

For the Ledger, the `registration` is the HMAC that the device returns.

Some devices take a descriptor, others take a BIP 388 policy that is stuffed into their protocol. The `Descriptor` and `PubkeyProvider` classes are modified to allow produce BIP 388 compatible strings that can be provided as needed.

Each device does different validation of the descriptor it is provided. We will not do any validation - the user may provide a descriptor that a device refuses to register and any such registration errors will be propagated from the device.

The test case includes a descriptor that should work on all devices.

ACKs for top commit:
Sjors:
re-ACK 50f5781e70552cca094cba23d0d301f46d364306

Tree-SHA512: d4b15c7a94f4045d66c9604e1eaa9a2f94514322a0014ec32b60d8beddb7b2269d639cfddc6c1db28304d384b9f06e66e6e8dd6a3a546810b673e3f37c8bcf4a

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarymerge-commit duplicate discount
AI analysis · Low 32/100

This commit adds a new command called `registerdescriptor` to the HWI tool, which lets users register Bitcoin output descriptors with supported hardware wallets (Ledger, BitBox02, Jade, Coldcard). It also rewrites how descriptors are parsed and stored internally to support newer multi-path descriptor formats and to convert descriptors into BIP 388 wallet policies where needed. The change is a feature addition, not a bug fix, and the commit message and code do not describe any security vulnerability. The main security-relevant aspect is that the tool now passes user-supplied descriptors directly to the device without extra validation, relying on each device's own checks.

Security candidateMerge bitcoin-core/HWI#839: psbt: misc fixes and add remaining BIP 174 and BIP 370 test vectorsby Ava Chow · 695c731b · Aug 10, 2026 · 4 filesMessage 91 · StrongModerate 60Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#839: psbt: misc fixes and add remaining BIP 174 and BIP 370 test vectors

df8c3f5d4b7e6c6b4856af8bde50c6fc9cf7431c test: add remaining BIP 174 and BIP 370 test vectors (Sjors Provoost)
1ff27e0262f1bffe969ebd68038903930955b20e test: add BIP 370 timelock determination vectors (Sjors Provoost)
498e85a7b31237b57eb110620f62e6bef64fb52e psbt: enforce required locktime bounds (Sjors Provoost)
2a431b8819652473893b0e5dba7feb58ad08a5a5 psbt: reject PSBTv2 input and output fields in PSBTv0 (Sjors Provoost)
8a4052300772adefaf034e498375bd0ccfa18708 psbt: track whether an unsigned tx key was seen (Sjors Provoost)
b34f94a6d5648cf9f4dbce73bfe385fc076cd322 psbt: parse the global unsigned tx without witness data (Sjors Provoost)
f0520e7e813a4a93a617456a82ae39f0e52213d4 psbt: assume final sequence when PSBT_IN_SEQUENCE is omitted (Sjors Provoost)
2db24a2a0839218843db65b0deeb858676c2a186 psbt: set locktime on the transaction, not the PSBT (Sjors Provoost)

Pull request description:

Each fix / hardening commit introduces the test vectors that cover it.

Mostly straight-forward, but `psbt: parse the global unsigned tx without witness data` is worth a closer look. IIUC it catches up with https://github.com/bitcoin/bips/pull/1099.

ACKs for top commit:
achow101:
ACK df8c3f5d4b7e6c6b4856af8bde50c6fc9cf7431c

Tree-SHA512: 1fedaca5eeceb9c3c5df8ef87041d0ba97be87b876ebe8eadf4173f19e93d370438edb1e8d98a7363e661228bea6f3f094fc91e13e6975a5dfabce475e285303

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarydefensive validationfuzzing or regression evidencesigning or wallet pathmerge-commit duplicate discount
AI analysis · Moderate 60/100

This commit tightens how the Bitcoin hardware wallet interface library reads PSBT files. It now rejects PSBTv0 files that contain fields only allowed in the newer PSBTv2 format, enforces sensible locktime ranges, and fixes several bugs where the library could build a transaction with the wrong sequence number or locktime. These are defensive correctness fixes rather than a single obvious remote exploit, but they close paths where a malformed or malicious PSBT could confuse a hardware wallet or downstream software.

Security candidatebitbox02: support BIP388 policy signingby Sjors Provoost · a76f3447 · Aug 6, 2026 · 1 fileMessage 68 · AdequateLow 32Details
Commit message · Sjors Provoost

bitbox02: support BIP388 policy signing

Translate the registered descriptor into the policy script
configuration and use it for transaction inputs and change outputs.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Low 32/100

This commit adds support for signing Bitcoin transactions with registered wallet policies (BIP388) on the BitBox02 hardware wallet. Previously this feature was rejected with an error. The change translates a registered wallet descriptor into a format the BitBox02 understands and uses it when signing transaction inputs and change outputs. It is a feature addition rather than a fix for a known vulnerability, but it touches security-critical signing logic.

Security candidatejade: support BIP388 policy signingby Sjors Provoost · db189db5 · Aug 6, 2026 · 1 fileMessage 60 · AdequateInformational 22Details
Commit message · Sjors Provoost

jade: support BIP388 policy signing

Sign with the existing PSBT flow after registerdescriptor has stored the
policy on the device.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing boundary
AI analysis · Informational 22/100

This change removes an error that previously blocked Bitcoin signing for a specific type of wallet policy (BIP388) on the Blockstream Jade hardware wallet. The device now supports these policies, so the software no longer needs to reject them. There is no obvious security bug being fixed; it appears to be a feature-enablement patch.

Security candidatecoldcard: support BIP388 policy signingby Sjors Provoost · 7e278f48 · Aug 6, 2026 · 2 filesMessage 68 · AdequateInformational 19Details
Commit message · Sjors Provoost

coldcard: support BIP388 policy signing

Pass each registered policy name to Edge in a separate signing request.
Use a final unnamed request for inputs outside the registered policies.

Older Coldcards still infer a stored multisig policy from the PSBT.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundaryparser or protocol path
AI analysis · Informational 19/100

This commit adds support for signing Bitcoin transactions with named wallet policies (BIP388) on newer Coldcard hardware wallets. It is a feature addition, not a fix for a known security flaw. The change removes an error that previously blocked this feature and sends each registered policy name to the device in separate signing requests. There is no indication in the commit that this addresses a security vulnerability.

Security candidatesigntx: add BIP388 policy supportby Sjors Provoost · 6f44e489 · Aug 6, 2026 · 10 filesMessage 68 · AdequateInformational 17Details
Commit message · Sjors Provoost

signtx: add BIP388 policy support

Accept registered descriptor policies throughout the signing API. Device
implementations reject registrations until support is added in
subsequent commits.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Informational 17/100

This commit adds a new command-line option and API parameter for BIP388 registered descriptor policies to the transaction-signing flow. It does not implement actual signing support in any hardware wallet driver; every device implementation explicitly rejects the new option with an error message. There is no security vulnerability here—it's a feature plumbing change that prepares the codebase for future per-device support.

Security candidateMerge bitcoin-core/HWI#819: Drop Python 3.9, use 3.10 for dist, bump Ledgerby Ava Chow · 2daa5916 · Aug 5, 2026 · 29 filesMessage 91 · StrongInformational 21Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#819: Drop Python 3.9, use 3.10 for dist, bump Ledger

d27d196def0b24b9f0a1a1c15cad755907583221 test: disambiguate Ledger warning automation (Sjors Provoost)
0379e278589999c51d50a4e8714d8a66d22ec47c Drop Ledger deny rule from tests (Sjors Provoost)
1b0cbea5023fc712e764db488d8df6e0142860a6 Skip archiving hwi-qt on non-x86 platforms (Sjors Provoost)
d2a5874ac9cc36a1c5e058472d86df5e583046a8 test: reenable LedgerX tests (Sjors Provoost)
cd8a43174fc806d3c53f5dd9feeef5708339f1c4 test: increase stdin command timeout (Sjors Provoost)
976353eded87c8c37a56f67be3b2e3d65368b105 Bump Speculos and Ledger Bitcoin app (Sjors Provoost)
eab5bad366c580a386c765670f9ce8bd1ce76836 test: make device signing cases more granular (Sjors Provoost)
edfeace84c614d4a80143eb3412b9f20d204ecc5 Drop Python 3.9 support (Sjors Provoost)
45de0be7d14e4c5a754b76f8b0bd4f953b236251 build: deterministic builds use Python 3.10 (Sjors Provoost)
5c9d86d9364123f997b772326e7fa323752af5a5 build: use Podman friendly syntax (Sjors Provoost)
68c51cf90495821e34d3fd0907657c4baeea57ab build: add docker / container ignore files (Sjors Provoost)
8603233a6d399e2aa39bc412f9b5d217d41b0853 build: generate UI before building distributions (Sjors Provoost)

Pull request description:

This PR first switches the deterministic builds to Python 3.10. It then drops the end-of-life 3.9.

Then it bumps Speculos and Ledger and enables the tests that were previously disabled.

There's also a few minor cleanup commits, plus changes to make the Docker containers Podman friendly so I can easily run them locally.

ACKs for top commit:
achow101:
ACK d27d196def0b24b9f0a1a1c15cad755907583221

Tree-SHA512: d1b0605097e5dc4621c8ad9d16ba8a2f4f8c7b211ac7d8887d15fc74e97ab463d92cd2d0a34e97b454044409f6163fc4cba98d45888237f92c8008fb6e69188b

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarymerge-commit duplicate discount
AI analysis · Informational 21/100

This is a routine maintenance merge for the Bitcoin Core Hardware Wallet Interface (HWI). It drops support for the end-of-life Python 3.9, switches deterministic builds and CI to Python 3.10, updates Ledger test firmware/simulator versions, re-enables some Ledger tests, and makes small build/test cleanups. There is no direct evidence in the commit of a security vulnerability being fixed or introduced.

Security candidatetest: make device signing cases more granularby Sjors Provoost · eab5bad3 · Aug 4, 2026 · 7 filesMessage 90 · StrongInformational 15Details
Commit message · Sjors Provoost

test: make device signing cases more granular

Most device simulators accept arbitrary keypool paths, so keep testing
that behavior by default.

Some devices enforce their own derivation path policies. Let those
emulators opt out of the arbitrary-path portion while still running the
remaining keypool checks.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit only changes test code. It makes the automated test suite more flexible by letting device simulators opt out of one specific test case involving unusual key derivation paths, while still running the rest of the tests. There is no change to the actual wallet software that users run, and no security fix or vulnerability is present in the diff.

Security candidateledger: have sign_psbt return SignPsbtYieldedObjectby Sjors Provoost · e86440ae · Jul 31, 2026 · 4 filesMessage 65 · AdequateInformational 15Details
Commit message · Sjors Provoost

ledger: have sign_psbt return SignPsbtYieldedObject

Taken from LedgerHQ/app-bitcoin-new at 2.4.1

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit is a straightforward internal code refactor for Ledger hardware wallet support. It changes the data structure returned when signing a Bitcoin transaction from a simple tuple of raw bytes to a more descriptive object that can carry extra context for newer Taproot-style signatures. There is no indication this fixes a security bug or introduces a vulnerability; it is a compatibility and maintainability update taken from Ledger's own upstream code.

Security candidateledger: handle script path signaturesby Sjors Provoost · fc206450 · Jul 31, 2026 · 1 fileMessage 45 · ThinLow 40Details
Commit message · Sjors Provoost

ledger: handle script path signatures

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundary
AI analysis · Low 40/100

This commit updates the Ledger hardware wallet driver in HWI so it can correctly store Taproot script-path signatures in a PSBT, not just key-path signatures. Previously, the code had a placeholder that always treated any Taproot signature as a key-path signature. For users spending via a Taproot script path (for example, a multisig or timelock branch), the signature would have been placed in the wrong field, likely causing the PSBT to be invalid or incomplete. There is no direct evidence in the commit of an exploitable vulnerability; it appears to be a correctness/functional fix for an unimplemented feature.

Security candidatepsbt: don't overwrite PSBTv2 tx version and fallback locktimeby Sjors Provoost · ca2caf04 · Jul 10, 2026 · 3 filesMessage 88 · StrongModerate 61Details
Commit message · Sjors Provoost

psbt: don't overwrite PSBTv2 tx version and fallback locktime

self.tx is never None, for PSBTv2 it's an empty placeholder. Its
defaults would overwrite the deserialized tx version and fallback
locktime, invalidating any existing signature. Check the PSBT
version instead, here and in get_unsigned_tx().

Without this fix all BIP 370 valid test vectors, now added, fail
the serialization round-trip.

88/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryfuzzing or regression evidencesigning or wallet path
AI analysis · Moderate 61/100

This commit fixes a bug in how the HWI library handles a newer Bitcoin transaction format called PSBTv2. Previously, when converting or setting up a PSBTv2 object, the code would accidentally overwrite the transaction's version number and locktime with default values. That could silently invalidate digital signatures that were already created for the transaction. The fix checks the PSBT version before touching those fields, and adds official BIP 370 test vectors to prevent the bug from returning.

Security candidatepsbt: assume final sequence when PSBT_IN_SEQUENCE is omittedby Sjors Provoost · f0520e7e · Jul 10, 2026 · 2 filesMessage 75 · AdequateLow 35Details
Commit message · Sjors Provoost

psbt: assume final sequence when PSBT_IN_SEQUENCE is omitted

get_unsigned_tx() asserted that every input has a sequence number,
crashing on the minimal BIP 370 test vector.

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing boundaryfuzzing or regression evidencesigning or wallet path
AI analysis · Low 35/100

This commit fixes a crash in the PSBT (Partially Signed Bitcoin Transaction) handling code. When a transaction input did not specify a sequence number, the software would crash with an assertion failure instead of assuming the standard default value (0xffffffff). The fix makes the code follow the BIP 370 specification correctly, allowing it to handle minimal PSBTv2 files without crashing.

Security candidatepsbt: set locktime on the transaction, not the PSBTby Sjors Provoost · 2db24a2a · Jul 10, 2026 · 2 filesMessage 73 · AdequateModerate 60Details
Commit message · Sjors Provoost

psbt: set locktime on the transaction, not the PSBT

get_unsigned_tx() assigned the computed locktime to a stray
attribute on the PSBT, so the constructed transaction kept
locktime 0.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Moderate 60/100

This commit fixes a bug where a transaction's locktime (a time-based or block-height-based restriction on when a Bitcoin transaction can be mined) was being set on the wrong object. Instead of assigning it to the actual transaction, the code accidentally assigned it to the PSBT wrapper object, so the transaction kept a locktime of 0. This could cause transactions with intended time locks to become immediately spendable, potentially breaking security assumptions in wallets or contracts that rely on locktime.

Security candidatepsbt: enforce required locktime boundsby Sjors Provoost · 498e85a7 · Jul 10, 2026 · 2 filesMessage 45 · ThinLow 47Details
Commit message · Sjors Provoost

psbt: enforce required locktime bounds

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 47/100

This change makes the hardware-wallet interface library stricter when reading PSBT (Partially Signed Bitcoin Transaction) files. It now rejects locktime values that don't follow Bitcoin's rules: a time-based locktime must be at least 500,000,000, and a block-height-based locktime must be greater than 0 and less than 500,000,000. Without these checks, a malformed or malicious PSBT could confuse a hardware wallet about when a transaction is allowed to be mined, potentially leading to signing something the user didn't expect.

Security candidatepsbt: reject PSBTv2 input and output fields in PSBTv0by Sjors Provoost · 2a431b88 · Jul 10, 2026 · 2 filesMessage 65 · AdequateModerate 63Details
Commit message · Sjors Provoost

psbt: reject PSBTv2 input and output fields in PSBTv0

The global PSBTv2 fields were already rejected.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Moderate 63/100

This commit fixes a parsing bug in the way the Hardware Wallet Interface (HWI) reads Bitcoin transaction files called PSBTs. PSBTs come in two versions, v0 and v2, and each version has its own allowed fields. The code was accidentally accepting some v2-only fields inside a v0 PSBT. That could let a specially crafted file change how the transaction is interpreted, potentially tricking a hardware wallet into signing something different from what the user sees. The fix makes the parser reject those v2 fields when the file says it is a v0 PSBT.

Security candidatepsbt: track whether an unsigned tx key was seenby Sjors Provoost · 8a405230 · Jul 10, 2026 · 2 filesMessage 60 · AdequateLow 46Details
Commit message · Sjors Provoost

psbt: track whether an unsigned tx key was seen

A provided unsigned tx with no inputs and outputs is
indistinguishable from the empty placeholder.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 46/100

This change fixes a subtle parsing bug in how the wallet software reads PSBT (Partially Signed Bitcoin Transaction) files. Previously, the code could not tell the difference between a PSBT that genuinely contained an unsigned transaction with zero inputs and outputs, and a PSBT where the unsigned transaction was simply missing. This could allow a malformed or intentionally crafted PSBT to be treated as valid when it should have been rejected, potentially leading to incorrect transaction handling or confusion in hardware wallet workflows.

Security candidatepsbt: parse the global unsigned tx without witness databy Sjors Provoost · b34f94a6 · Jul 10, 2026 · 3 filesMessage 73 · AdequateModerate 59Details
Commit message · Sjors Provoost

psbt: parse the global unsigned tx without witness data

The witness-detecting deserializer accepted witness-serialized
unsigned transactions and misread valid ones with no inputs.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Moderate 59/100

This commit fixes a bug in how the wallet interface reads the unsigned transaction embedded inside a PSBT (Partially Signed Bitcoin Transaction). Previously, the parser tried to auto-detect whether the transaction included witness data, which could misread certain valid transactions that had no inputs. Now it explicitly parses the transaction as a non-witness transaction and rejects any PSBT whose unsigned transaction is not serialized exactly that way. This is a correctness and standards-compliance fix that reduces the chance of a malformed or malicious PSBT being misinterpreted.