#35370 rpc: add key-origin modes to PSBT processing RPCs

• Allow PSBT processing RPCs to strip existing key-origin data and global xpubs
• Prevent leaking derivation paths to co-signers in collaborative setups

Extends the `bip32derivs` parameter of `walletprocesspsbt` and `descriptorprocesspsbt` to accept string modes ("add", "preserve", "strip") alongside legacy booleans. In "strip" mode, the RPC removes global xpubs and legacy/Taproot BIP32 key origin fields from PSBT inputs and outputs while preserving unknown and proprietary fields.

Problem: Setting `bip32derivs=false` prevents new derivation fields from being added by the node, but does not purge key-origin data already present in an input PSBT, leaking derivation paths and xpubs to co-signers in collaborative workflows.

P3 · new feature

• P3 because it expands bip32derivs options with string modes while maintaining backward compatibility
• Gives users fine-grained control over PSBT derivation metadata via existing RPCs

Expands RPC options smoothly by accepting 'add', 'preserve', or 'strip' on `bip32derivs` while keeping backward compatibility with existing boolean parameters.

Membership: Modifies the parameter signature and parsing logic for RPC commands `walletprocesspsbt` and `descriptorprocesspsbt`.

Factors: security/stability 0, bug 1, performance 0, user value 2, leverage 0

P3 · bug fix

• P3 because it prevents key derivation and xpub metadata leaks during multiparty signing sessions
• Provides a clean method to sanitize PSBT key-origin fields in collaborative workflows

Addresses issue #30294, providing a clean method to prevent key derivation and xpub metadata leaks during multiparty signing sessions.

Membership: Changes PSBT manipulation logic in `src/psbt.cpp` and spend RPCs in `src/wallet/rpc/spend.cpp` to sanitize key origin information.

Factors: security/stability 1, bug 1, performance 0, user value 2, leverage 0

• Code is ready to review with all previous feedback addressed
• Author has been silent for 69 days

Author has been inactive for 69 days, exceeding the 60-day stale threshold, though all previous review comments were addressed in the last push.

Author status: silent since 2026-07-10

Resolved concerns:

• achow101 and rkrux suggested turning `bip32derivs` into an enum argument instead of adding a separate boolean flag; author refactored to support "add", "preserve", and "strip" with boolean aliases.
• maflcko pointed out naming conventions and redundant PR description text resulting from LLM tooling; author acknowledged the AI policy, reviewed the patch, and squashed commits.

• Approach approval for stripping metadata in PSBT processing RPCs (willcl-ark)
• Concept approval for stripping bip32 derivation data on demand (rkrux)
• Design suggestion to use an enum argument was adopted (achow101, rkrux)

Strong: willcl-ark and rkrux support the approach, and achow101's argument design suggestion was adopted.

Reviewers agreed that stripping key-origin metadata belongs in the PSBT processing RPCs rather than a separate combiner tool, and the requested argument cleanup was implemented.

• willcl-ark: 'Approach ACK. This looks like the correct approach (in contrast to #30341), putting strip functionality in walletprocesspsbt (and also descriptorprocesspsbt).'
• achow101 suggested converting `bip32derivs` into an enum/choices argument rather than adding another bool.
• rkrux: 'Concept ACK... for stripping away the bip32 derivations data if the user intends so' and agreed with converting the parameter into an enum.

Review verdicts (DrahtBot): 0

• Approach ACK: willcl-ark
• Concept ACK: rkrux

248 lines under test/bench/ci.

• test/functional/rpc_psbt.py +245/-3
• src/rpc/rawtransaction_util.cpp +21/-0
• src/rpc/rawtransaction.cpp +13/-3
• src/psbt.cpp +15/-0
• src/wallet/rpc/spend.cpp +13/-2
• doc/release-notes-35370.md +11/-0
• src/rpc/rawtransaction_util.h +8/-0
• src/rpc/client.cpp +2/-2
• src/psbt.h +3/-0

PR 35370 adds 'strip', 'preserve', and 'add' modes to the bip32derivs argument in walletprocesspsbt and descriptorprocesspsbt, retaining boolean compatibility. This resolves issue #30294 by enabling users in collaborative PSBT setups to strip derivation paths and global xpubs for privacy before sharing PSBTs with counter-parties. The PR has Concept ACK and Approach ACK from reviewers who favored this over earlier proposals, and earlier API design comments from achow101 were resolved. Although technically reviewable, the author has been silent for 69 days.