feat(platform-wallet-storage): embeddable SQLite persistence backend with seedless rehydration

.cargo/audit.toml

@@ -1,3 +1,30 @@
 [advisories]
-# TODO Remove it from here
-ignore = [ "RUSTSEC-2020-0071"] # advisory IDs to ignore e.g. ["RUSTSEC-2019-0001", ...]
+# Advisory IDs to ignore, e.g. ["RUSTSEC-2019-0001", ...]. Each entry
+# must point at a live advisory in the resolved graph and carry a dated
+# rationale; an entry matching nothing trains reviewers to skim the list.
+#
+# rustsec/audit-check runs from the repo root (.github/workflows/security-audit-rust.yml)
+# and only reads THIS file — a crate-local .cargo/audit.toml is never consulted by CI.
+ignore = [
+    # RUSTSEC-2025-0141 — bincode is unmaintained (informational advisory,
+    # not an exploitable CVE; published 2025-12-16, no patched release).
+    # Acknowledged 2026-06-08.
+    #
+    # Why this is acceptable for now:
+    #   - bincode 2.0.1 is the BLOB-codec trust boundary for every
+    #     persisted column and backup in rs-platform-wallet-storage. The
+    #     known risk class for an unmaintained deserializer is unbounded
+    #     allocation (OOM) on a crafted/corrupt input.
+    #   - In-crate size bounds defang that class: MAX_VALUE_LEN /
+    #     BLOB_SIZE_LIMIT_BYTES (kv/blob), the per-secret SecretTooLarge
+    #     write cap, and the MAX_VAULT_SIZE_BYTES read ceiling all reject
+    #     oversized inputs before bincode ever allocates from them.
+    #   - load() is fail-hard: a malformed/over-large row aborts the call
+    #     with a typed error rather than silently over-allocating.
+    #
+    # Residual risk: a future bincode defect would go unpatched upstream.
+    # Remediation plan: migrate the BLOB codec to a maintained equivalent
+    # (postcard / bitcode candidates) once the wire format is frozen at
+    # release; revisit this ignore at that time.
+    "RUSTSEC-2025-0141",
+]

.gitignore

@@ -103,3 +103,6 @@ __pycache__/
 
 # Security audit reports (local-only, not committed)
 audits/
+
+# Review scratch (grumpy-review / triage output, local-only)
+.review-*/

Cargo.toml

@@ -50,14 +50,17 @@ members = [
 ]
 
 [workspace.dependencies]
-dashcore = { git = "https://github.com/dashpay/rust-dashcore", rev = "647fa9820f3614090e4e5f5f2b709961d68e538b" }
-dash-network-seeds = { git = "https://github.com/dashpay/rust-dashcore", rev = "647fa9820f3614090e4e5f5f2b709961d68e538b" }
-dash-spv = { git = "https://github.com/dashpay/rust-dashcore", rev = "647fa9820f3614090e4e5f5f2b709961d68e538b" }
-key-wallet = { git = "https://github.com/dashpay/rust-dashcore", rev = "647fa9820f3614090e4e5f5f2b709961d68e538b" }
-key-wallet-ffi = { git = "https://github.com/dashpay/rust-dashcore", rev = "647fa9820f3614090e4e5f5f2b709961d68e538b" }
-key-wallet-manager = { git = "https://github.com/dashpay/rust-dashcore", rev = "647fa9820f3614090e4e5f5f2b709961d68e538b" }
-dash-network = { git = "https://github.com/dashpay/rust-dashcore", rev = "647fa9820f3614090e4e5f5f2b709961d68e538b" }
-dashcore-rpc = { git = "https://github.com/dashpay/rust-dashcore", rev = "647fa9820f3614090e4e5f5f2b709961d68e538b" }
+# TODO(pin): tracks dashpay/rust-dashcore#851 (draft) — key-wallet
+# out-of-order UTXO spend fix (#649). Bump to the merged `dev` SHA once
+# that PR lands.
+dashcore = { git = "https://github.com/dashpay/rust-dashcore", rev = "b3fb82445a3a0ac1a9c1ff6f8c18c7201d08c1e5" }
+dash-network-seeds = { git = "https://github.com/dashpay/rust-dashcore", rev = "b3fb82445a3a0ac1a9c1ff6f8c18c7201d08c1e5" }
+dash-spv = { git = "https://github.com/dashpay/rust-dashcore", rev = "b3fb82445a3a0ac1a9c1ff6f8c18c7201d08c1e5" }
+key-wallet = { git = "https://github.com/dashpay/rust-dashcore", rev = "b3fb82445a3a0ac1a9c1ff6f8c18c7201d08c1e5" }
+key-wallet-ffi = { git = "https://github.com/dashpay/rust-dashcore", rev = "b3fb82445a3a0ac1a9c1ff6f8c18c7201d08c1e5" }
+key-wallet-manager = { git = "https://github.com/dashpay/rust-dashcore", rev = "b3fb82445a3a0ac1a9c1ff6f8c18c7201d08c1e5" }
+dash-network = { git = "https://github.com/dashpay/rust-dashcore", rev = "b3fb82445a3a0ac1a9c1ff6f8c18c7201d08c1e5" }
+dashcore-rpc = { git = "https://github.com/dashpay/rust-dashcore", rev = "b3fb82445a3a0ac1a9c1ff6f8c18c7201d08c1e5" }
 
 tokio-metrics = "0.5"
 

packages/rs-platform-wallet-storage/Cargo.toml

@@ -46,6 +46,7 @@ rusqlite = { version = "0.38", features = [
     "backup",
     "blob",
     "hooks",
+    "limits",
     "trace",
 ], optional = true }
 refinery = { version = "0.9", default-features = false, features = [
@@ -61,6 +62,11 @@ chrono = { version = "0.4", default-features = false, features = [
     "clock",
 ], optional = true }
 sha2 = { version = "0.10", optional = true }
+# Opt-in `JsonSchema` for `SecretString` (gated by `secret-schemars`).
+# Reuses the workspace-locked 1.2.1. `default-features = false` drops the
+# `derive` feature (we hand-write the impl), matching the crate's existing
+# derive-free schemars usage so the lock gains no `schemars_derive` entry.
+schemars = { version = "1", optional = true, default-features = false }
 
 # Secret-storage deps (gated by the `secrets` feature). RustSec-clean
 # pins (Smythe §7); `aes-gcm` is deliberately omitted. `keyring`'s
@@ -80,7 +86,14 @@ keyring-core = { version = "=1.0.0", optional = true }
 # was removed from the sqlite arm — those tests grep for `fs2`/`fs4`
 # literals in this crate's source/manifest and would re-trigger on the
 # older crates. `fd-lock` has no such collision.
-fd-lock = { version = "4.0.4", optional = true }
+# LOCAL-FS ONLY: flock/LockFileEx interlock processes only on local
+# filesystems; over NFS/CIFS the lock does not interlock, so a vault file
+# must not be shared across hosts — steer multi-host to the OS-keyring arm.
+# Exact-pinned (`=`) like the rest of the soundness-critical stack: the
+# `VaultLock` unsafe drop-order argument in `secrets/file/mod.rs` is
+# calibrated to fd-lock 4.0.4's guard internals; any bump must re-verify
+# that the guard releases the OS lock before the backing `RwLock` frees.
+fd-lock = { version = "=4.0.4", optional = true }
 
 # CLI deps (gated by the `cli` feature)
 clap = { version = "4", features = ["derive"], optional = true }
@@ -185,6 +198,17 @@ cli = [
 # crate without the crypto graph.
 secrets = [
     "dep:argon2",
+    # Enable argon2's `zeroize` feature so the KDF wipes its sensitive
+    # intermediate state (`initial_hash`/`blockhash`) on drop. In argon2
+    # 0.5.3 this does NOT cover the bulk `Block` matrix — that residual is
+    # documented at `derive_key` in `secrets/file/crypto.rs`. Keep it in
+    # the feature list (not a `default-features = false` rewrite) so
+    # argon2's own default features stay intact.
+    "argon2/zeroize",
+    # bincode is the producer for the Tier-2 envelope wire format and the
+    # three AAD encodings (`Tier2Aad`/`EntryAad`/`VerifyAad`) — see
+    # `secrets/wire/`. `=2.0.1` is the workspace-wide pin.
+    "dep:bincode",
     "dep:chacha20poly1305",
     # secrets uses serde directly (vault format + crypto envelope derive
     # `Serialize`/`Deserialize`); declare the dep here so
@@ -204,6 +228,15 @@ secrets = [
     "dep:apple-native-keyring-store",
     "dep:windows-native-keyring-store",
 ]
+# Opt-in `SecretString` serde/schemars impls. Deliberately DEFAULT-OFF
+# even though `secrets` (and, via it, the `serde` dep) are default-on:
+# these gate the IMPLS, not the dep, so the impls are absent unless a
+# consumer explicitly opts in. `secret-serde` requires `secrets` (the type
+# only exists under it). NO `Serialize` is ever provided. `secret-schemars`
+# implies `secret-serde`. (design §5.4 / GAP-001 names / GAP-002 satisfiable
+# default-off.)
+secret-serde = ["secrets", "dep:serde"]
+secret-schemars = ["secret-serde", "dep:schemars"]
 # Per-object-type key/value metadata API
 # (`platform_wallet_storage::{KvStore, KvError, ObjectId}`) plus the
 # SQLite-backed impl. Requires `sqlite` because the only shipped backend
@@ -217,3 +250,11 @@ kv = ["sqlite"]
 # convention for "MUST NOT enable from downstream" features
 # (https://doc.rust-lang.org/cargo/reference/features.html#feature-resolver-version-2).
 __test-helpers = ["sqlite"]
+# e2e tests that drive the #3692 manager-apply path; enabled in the integrated stack (dash-evo-tool).
+rehydration-apply = []
+# Pass-through to `platform-wallet/shielded` so the feature-gated
+# `PlatformWalletChangeSet::shielded` field is visible to the exhaustive
+# `versions::touched_domains` destructure (the R8 forgotten-domain guard).
+# Storage persists no shielded state itself; this only aligns visibility so
+# an added always-on field stays a compile error.
+shielded = ["platform-wallet/shielded"]