feat(platform-wallet): manifest integrity checksum (Risk-6/R12.5 follow-up)

packages/rs-platform-wallet-ffi/src/manager.rs

@@ -189,6 +189,10 @@ pub const LOAD_SKIP_REASON_DECODE_ERROR: u32 = 102;
 /// persisted row (wallet_id/network differ, or its account set diverges
 /// from the row's account manifest) — a wrong-row snapshot.
 pub const LOAD_SKIP_REASON_SNAPSHOT_IDENTITY_MISMATCH: u32 = 103;
+/// `reason_code`: a persisted account-manifest row failed its integrity
+/// checksum (`SHA-256(wallet_id ‖ account_xpub_bytes)` mismatch — a row
+/// bound to the wrong wallet or a blob mutated in place).
+pub const LOAD_SKIP_REASON_MANIFEST_INTEGRITY_MISMATCH: u32 = 104;
 /// `reason_code`: an unrecognized `CorruptKind` — forward-compat
 /// fallback until this crate maps a newly added corrupt-row family.
 pub const LOAD_SKIP_REASON_CORRUPT_OTHER: u32 = 199;
@@ -214,6 +218,7 @@ pub struct SkippedWalletFFI {
     /// [`LOAD_SKIP_REASON_MALFORMED_XPUB`] (101),
     /// [`LOAD_SKIP_REASON_DECODE_ERROR`] (102),
     /// [`LOAD_SKIP_REASON_SNAPSHOT_IDENTITY_MISMATCH`] (103),
+    /// [`LOAD_SKIP_REASON_MANIFEST_INTEGRITY_MISMATCH`] (104),
     /// [`LOAD_SKIP_REASON_CORRUPT_OTHER`] (199),
     /// [`LOAD_SKIP_REASON_OTHER`] (200), or
     /// [`LOAD_SKIP_REASON_ALREADY_REGISTERED`] (300). No secret material
@@ -252,6 +257,7 @@ fn skip_reason_code(reason: &platform_wallet::SkipReason) -> u32 {
             CorruptKind::MalformedXpub => LOAD_SKIP_REASON_MALFORMED_XPUB,
             CorruptKind::SnapshotIdentityMismatch => LOAD_SKIP_REASON_SNAPSHOT_IDENTITY_MISMATCH,
             CorruptKind::DecodeError(_) => LOAD_SKIP_REASON_DECODE_ERROR,
+            CorruptKind::ManifestIntegrityMismatch => LOAD_SKIP_REASON_MANIFEST_INTEGRITY_MISMATCH,
             // `CorruptKind` is #[non_exhaustive]; a future variant maps to a
             // generic corrupt-row code until this mapping is extended.
             _ => LOAD_SKIP_REASON_CORRUPT_OTHER,
@@ -604,6 +610,7 @@ mod tests {
         assert_eq!(LOAD_SKIP_REASON_MALFORMED_XPUB, 101);
         assert_eq!(LOAD_SKIP_REASON_DECODE_ERROR, 102);
         assert_eq!(LOAD_SKIP_REASON_SNAPSHOT_IDENTITY_MISMATCH, 103);
+        assert_eq!(LOAD_SKIP_REASON_MANIFEST_INTEGRITY_MISMATCH, 104);
         assert_eq!(LOAD_SKIP_REASON_CORRUPT_OTHER, 199);
         assert_eq!(LOAD_SKIP_REASON_OTHER, 200);
     }
@@ -630,6 +637,10 @@ mod tests {
             skip_reason_code(&corrupt(CorruptKind::DecodeError("boom".into()))),
             LOAD_SKIP_REASON_DECODE_ERROR
         );
+        assert_eq!(
+            skip_reason_code(&corrupt(CorruptKind::ManifestIntegrityMismatch)),
+            LOAD_SKIP_REASON_MANIFEST_INTEGRITY_MISMATCH
+        );
     }
 
     #[test]

packages/rs-platform-wallet-storage/migrations/V004__manifest_checksum.rs

@@ -0,0 +1,18 @@
+//! Additive V004 migration: per-row manifest integrity checksum (#3968).
+//!
+//! Adds a nullable `checksum BLOB` to `account_registrations`. Each row's
+//! checksum is `SHA-256(wallet_id ‖ account_xpub_bytes)`, bound by the writer
+//! and by a one-time app-side backfill in `SqlitePersister::open`. SQLite has
+//! no SHA-256 builtin (and no constant-literal default can carry a per-row
+//! digest), so the column is added nullable at DDL time and made effectively
+//! non-null at rest by that backfill; verify-at-load treats a surviving NULL
+//! on a V004+ store as tamper-evidence.
+//!
+//! Additive-only: V001/V002/V003 stay byte-identical so refinery's
+//! applied-migration checksum chain for versions 1, 2, and 3 never diverges on
+//! an existing store. `max_supported_version()` lifts 3 to 4 automatically (the
+//! value is derived from the embedded list's `MAX(version)`).
+
+pub fn migration() -> String {
+    "ALTER TABLE account_registrations ADD COLUMN checksum BLOB;\n".to_string()
+}

packages/rs-platform-wallet-storage/src/sqlite/error.rs

@@ -205,6 +205,16 @@ pub enum WalletStorageError {
     )]
     AccountRegistrationEntryMismatch,
 
+    /// An `account_registrations` row's stored `checksum` did not match a
+    /// recompute of `SHA-256(wallet_id ‖ account_xpub_bytes)` — or was NULL on
+    /// a V004+ store, which the `open()` backfill guarantees never survives.
+    /// Tamper-evidence for the Risk-6 class (a manifest row bound to the wrong
+    /// `wallet_id`, or a blob mutated in place). Unlike the other
+    /// mismatch variants this is caught at `load` and converted to a per-wallet
+    /// skip rather than aborting the batch.
+    #[error("account_registrations manifest integrity checksum mismatch")]
+    ManifestIntegrityMismatch,
+
     /// An `asset_locks` row's typed-column `(outpoint, account_index)`
     /// disagreed with the lifecycle blob's. Rejected at decode time rather
     /// than mis-bucketing the lock under the wrong account.
@@ -375,6 +385,7 @@ impl WalletStorageError {
             | Self::IdentityKeyEntryMismatch
             | Self::IdentityEntryIdMismatch
             | Self::AccountRegistrationEntryMismatch
+            | Self::ManifestIntegrityMismatch
             | Self::AssetLockEntryMismatch { .. }
             | Self::BlobTooLarge { .. }
             | Self::IntegerOverflow { .. } => false,
@@ -452,6 +463,7 @@ impl WalletStorageError {
             Self::IdentityKeyEntryMismatch => "identity_key_entry_mismatch",
             Self::IdentityEntryIdMismatch => "identity_entry_id_mismatch",
             Self::AccountRegistrationEntryMismatch => "account_registration_entry_mismatch",
+            Self::ManifestIntegrityMismatch => "manifest_integrity_mismatch",
             Self::AssetLockEntryMismatch { .. } => "asset_lock_entry_mismatch",
             Self::BlobTooLarge { .. } => "blob_too_large",
             Self::IntegerOverflow { .. } => "integer_overflow",

packages/rs-platform-wallet-storage/src/sqlite/persister.rs

@@ -9,6 +9,7 @@ use rusqlite::{Connection, OptionalExtension};
 use platform_wallet::changeset::{
     ClientStartState, PersistenceError, PlatformWalletChangeSet, PlatformWalletPersistence,
 };
+use platform_wallet::manager::load_outcome::{CorruptKind, SkipReason};
 use platform_wallet::wallet::platform_wallet::WalletId;
 
 use crate::sqlite::backup::{self, BackupKind};
@@ -234,6 +235,12 @@ impl SqlitePersister {
 
         let _report = crate::sqlite::migrations::run_for_open(&mut conn)?;
 
+        // SQLite cannot compute the per-row SHA-256 manifest checksum in pure
+        // SQL, so V004's column lands nullable and any row a forward migration
+        // left without one is filled here — once, before load() ever verifies
+        // it. Idempotent; a no-op on a store whose rows already carry one.
+        schema::accounts::backfill_missing_checksums(&mut conn)?;
+
         // Claim the path LAST so a failed open leaves no stale claim;
         // canonicalize so symlinks / `.`-segments key the same as a
         // sibling open would.
@@ -928,6 +935,23 @@ impl PlatformWalletPersistence for SqlitePersister {
                 ))
             })?;
 
+            // Manifest integrity is a per-wallet SKIP, not a batch abort: a
+            // tampered / mis-bound row fails this one wallet and records it in
+            // `skipped`, while every other read error below stays fail-hard.
+            match schema::accounts::verify_manifest_checksums(&conn, &wallet_id) {
+                Ok(()) => {}
+                Err(WalletStorageError::ManifestIntegrityMismatch) => {
+                    state.skipped.push((
+                        wallet_id,
+                        SkipReason::CorruptPersistedRow {
+                            kind: CorruptKind::ManifestIntegrityMismatch,
+                        },
+                    ));
+                    continue;
+                }
+                Err(other) => return Err(PersistenceError::from(other)),
+            }
+
             let account_manifest =
                 schema::accounts::load_state(&conn, &wallet_id).map_err(PersistenceError::from)?;
             let core_state = schema::core_state::load_state(&conn, &wallet_id, network)