fix: require full wallet unlock for PSBT signing

[PastaPastaPasta]

Issue being fixed or feature implemented

send and sendall can sign transactions while a descriptor wallet is unlocked only for CoinJoin mixing. These RPCs use FillPSBT, whose signing request previously reached the script managers without enforcing the wallet's full-unlock state.

What was done?

Gate PSBT signing on full wallet unlock inside CWallet::FillPSBT, under cs_wallet. Locked and mixing-only wallets can still populate unsigned PSBTs; fully unlocked wallets and unencrypted external signers retain their normal behavior. Preserve the distinction between the number of signatures produced and the capability count requested by sign=false callers. CoinJoin's transaction-signing path is unchanged.

Extend wallet_encryption.py to cover both RPCs with default, psbt=true, and add_to_wallet=false options. Check fully locked and mixing-only states return no signatures or completed transaction and leave the mempool empty; full unlock permits signed transaction creation.

How Has This Been Tested?

• Local macOS arm64 build using prebuilt depends: make -j8.
• ./src/test/test_dash --run_test=psbt_wallet_tests --log_level=message.
• wallet_encryption.py, wallet_send.py, wallet_sendall.py, and rpc_psbt.py, each with descriptor and legacy wallets.
• The new descriptor-wallet regression fails before the fix because the mixing-only wallet returns a completed signed transaction. It passes after the fix, together with locked-wallet PSBT creation and full-unlock signing controls.
• Python syntax/targeted flake8, whitespace/assertion lint, and independent security/code review.

Breaking Changes

Mixing-only unlock no longer authorizes PSBT signing. send/sendall return an incomplete PSBT until the wallet is fully unlocked.

Checklist:

• I have performed a self-review of my own code
• I have added or updated relevant unit/integration/functional/e2e tests

This pull request was created by Codex.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T17:05:43.582845Z	31a82b4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[thepastaclaw]

🕓 Queued for automated review — 52nd in line, estimated start in ~48 h (commit c58379d)
Estimated review time once started: ~1.9 h (two-phase automated review; median of recent runs).

• Request priority review — tick this box and the review moves to the front of the queue.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: d1f34cb0-bd67-48be-927a-1ad395193024

📥 Commits

Reviewing files that changed from the base of the PR and between 31a82b4 and c58379d.

📒 Files selected for processing (2)

• src/wallet/wallet.cpp
• test/functional/rpc_psbt.py

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

Walkthrough

CWallet::FillPSBT now disables signing when the wallet is locked, including after a mixing-only unlock. It clears the signed-input counter in that state and passes the updated signing flag to each ScriptPubKeyMan. The functional PSBT test now verifies that a send remains incomplete after a mixing-only wallet unlock.

Priority: ➖ Normal — Schedule the wallet signing safeguard because mixing-only unlocks must no longer authorize PSBT signing, with functional coverage added for affected send paths.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to c5837

PSBT signing is now withheld for locked and mixing-only wallet states while fully unlocked signing remains available. The supplied coverage confirms incomplete results for mixing-only unlocks, with no remaining merge-readiness risk identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the full-unlock requirement for PSBT signing, the affected RPCs, behavior for locked and mixing-only wallets, testing, and the breaking behavior change.
Title check	✅ Passed	The title clearly and concisely identifies the primary change: requiring a full wallet unlock for PSBT signing.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[knst]

self-tACK c58379d