#36325 Contrib: add multisig wizard
| Reviewability | Reviews | Agreement | Size | ||||
|---|---|---|---|---|---|---|---|
| #36325 Contrib: add multisig wizard | Ready | 1 -1 | Blocked | 0 + 710 tests | |||
|
|
|
|
| |||
Reviewability: ReadyStalePaused Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs. Size: lines added or modified outside tests, then in tests; greener = smaller. | |||||||
Goal
Adds a standalone Python multisig setup wizard in contrib/multisig and an accompanying functional test. The utility orchestrates the end-to-end setup flow for k-of-n descriptor wallets across coordinators and participants using existing RPCs. It supports BIP 87 key generation, cosigner key validation, and descriptor assembly for both P2WSH sortedmulti and Taproot MuSig2 with sortedmulti_a.
Problem: Setting up multisig descriptor wallets across participants currently requires manual key derivation, descriptor construction, and multiple RPC workarounds, such as substituting private keys to bypass importdescriptors restrictions and wrapping keys in pkh() expressions to validate them. Bitcoin Core lacks high-level tooling or structured RPC workflows to coordinate multisig key collection, descriptor verification, and import.
Evidence of importance:
- Part of tracking issue #35645 (Multisig Wizard tracking issue) and references discussions on #36143.
- PR description notes the tool is intended to demonstrate the setup flow 'so that RPC and interface work is shaped by what that flow actually needs' (author claim).
Scope: Self-contained script in contrib/multisig with functional test coverage; does not modify any C++ node or wallet source files.
Risk of a mistake: low (tooling, tests). Mistakes are confined to an external contrib helper script and a functional test, with no impact on consensus, wallet internals, or release binaries.
Reviewability
Ready
Nothing known that would invalidate a review now.
Waiting on (from the thread read):
- author: respond to pseudoramdom's Concept NACK concerns regarding maintenance and safety in contrib/ 2026-10-23
- author: address BenWestgate's suggestions and review findings on timestamp handling and backup docs 2026-10-29
Agreement
Blocked
objection that needs a change, nobody has replied (pseudoramdom, BenWestgate)
Thread notes: Added BenWestgate's Tested ACK and two new items from c:6488924478 regarding timestamp handling on offline nodes and documenting the backup requirement.
Objections, suggestions, and questions:
| Reviewer | Type | Harm, request, or question | Status | Must be | Author replied | Quote |
|---|---|---|---|---|---|---|
| sedited (member) | suggestion, scope | keep the wizard as an external script rather than adding it to the repository | answered · the author explained the intent as a CLI counterpart to the GUI wizard; BenWestgate argued repo inclusion counters scammers pushing less-reviewed alternatives | answered | yes | 2026-09-25: 'Do we need this in the repository? Seems fine to me if it were just an external script.' Status from: 2026-09-26: rxbryan: 'Aside from being a demonstration of the multisig setup flow, the utility is intended to become a command-line equivalent' |
| kevkevinpal (contributor) | objection, maintenance | adding the script introduces an ongoing maintenance burden for maintainers for a tool that will be obsolete once GUI/wallet work is done | answered · author committed to maintaining the script until RPCs obsolete it; BenWestgate argued it serves as a functional checklist | changed | yes | 2026-10-03: 'It is just another piece of code the Bitcoin Core maintainers will need to worry about forever.' Status from: 2026-10-05: rxbryan: 'Yes. I'll maintain it, we have enough test cases to force a maintenance contract on whoever modifies code touching it.' |
| BenWestgate (contributor) | question, maintenance | whether the author is willing to maintain the script, including bug fixes, until RPCs obsolete it | answered · author confirmed they will maintain the script | answered | yes | 2026-10-05: 'are you willing to maintain this script (including bug fixing) until the RPC obsoletes it?' Status from: 2026-10-05: rxbryan: 'Yes. I'll maintain it, we have enough test cases to force a maintenance contract on whoever modifies code touching it.' |
| pseudoramdom (member) | objection, maintenance | reviewing and maintaining temporary workarounds that will be superseded by core wallet changes diverts resources from implementing the backend items | open | changed | no | 2026-10-23: 'Merging this would mean reviewing ~700 lines (script and functional test) whose job is to work around things we plan to fix. We'd then have to review again each time one of those fixes lands and remov' |
| pseudoramdom (member) | objection, safety | placing the script in contrib/ makes it look like a recommended tool, risking user funds and proving difficult to undo | open | changed | no | 2026-10-23: 'Also putting a script in `contrib/` makes it look like a recommended tool and that's hard to undo once people use it with real funds.' |
| BenWestgate (contributor) | suggestion, scope | reduce the script size as much as possible (e.g. 100-300 lines) to minimize review time and encourage review | open | answered | no | 2026-10-23: 'What's the absolute smallest it could be made to maximize the number of people willing to review it and minimize the time it takes them?' |
| BenWestgate (contributor) | suggestion, approach | modularize the script so each workaround can be deleted and replaced with a new RPC as it lands | open | answered | no | 2026-10-23: 'Could you modularize it so that each time one of our workarounds lands, we just delete a function or module and replace it with the new RPC?' |
| BenWestgate (contributor) | objection, correctness | using "now" as the timestamp in import_descriptor sets the wallet birth time to genesis on an offline node, causing backup restoration on a pruned node to fail | open | changed | no | 2026-10-29: 'In `importdescriptors`, "now" means the best block's time. An offline node has only the genesis block, so the wallet's birth time is genesis. Restoring that wallet's backup on a pruned online node then fails with `Prune: last wallet synchronisation goes beyond pruned data. You need to -reindex`.' |
| BenWestgate (contributor) | suggestion, safety | document the requirement to back up both the key wallet and the descriptor after import_descriptor | open | answered | no | 2026-10-29: 'After `import_descriptor`, each participant has to back up their key wallet and the descriptor. A key wallet alone can't rebuild the multisig. The wizard's docstrings don't mention this. It may belong in the README rather than the code.' |
Support:
- BenWestgate (contributor) (Concept ACK, 2026-09-30): Core having user unfriendly multisig has been exploited by scammers to promote alternative multisig wallets with substantially less scrutiny than this repository
- BenWestgate (contributor) (Tested ACK, 2026-10-29) [both: import_descriptor]: ran all wizard steps on an offline node for 2-of-3 wsh(sortedmulti), created PSBT on restored online watch-only coordinator, signed offline, and verified acceptance via testmempoolaccept
Participants:
- sedited (member, question, 1 statements 2026-09-25 to 2026-09-25): asked whether the wizard belongs in the repository or should be an external script
- BenWestgate (contributor, support, 6 statements 2026-09-29 to 2026-10-29): Concept ACK and Tested ACK; tested offline multisig setup, argued repo inclusion protects users, raised review nits on timestamp handling and backups
- kevkevinpal (contributor, objection, 1 statements 2026-10-03 to 2026-10-03): objected to merging the script due to the maintenance burden of keeping it in the repo when it will become obsolete
- pseudoramdom (member, objection, 1 statements 2026-10-23 to 2026-10-23): leaning Concept NACK due to review/maintenance overhead of temporary workarounds and risk of users trusting contrib with real funds
Dependencies
Enables:
Files
710 lines under test/bench/ci.
- test/functional/tool_multisig_wizard.py +350/-0
- contrib/multisig/wizard.py +348/-0
- contrib/multisig/README.md +11/-0
- test/functional/test_runner.py +1/-0
Card
The short text the ranking pass compares across PRs.
This pull request adds a Python multisig setup utility to contrib/multisig alongside functional test coverage. It guides coordinators and cosigners through wallet creation, BIP 87 key generation, cosigner key collection, descriptor assembly, verification, and descriptor import for both P2WSH and Taproot multisig schemes. Setting up multisig descriptor wallets currently requires manual descriptor assembly and awkward RPC workarounds for key validation and import. The author presents the tool as a working prototype for tracking issue #35645 to help shape downstream RPC and wallet improvements. It is self-contained in contrib and functional tests, carrying no external PR dependencies.
Data
thread read through 2026-10-29 (11 statements), head 2803e1518b
labels: Scripts and tools
Categories
Tools and scripts
P3 · new feature
Adds a standalone CLI wizard to coordinate multisig descriptor wallet setup across participants using existing RPCs. While it addresses a well-known user pain point regarding manual multisig construction and directly touches keys and descriptors, as a contrib helper intended largely to prototype and guide upcoming core wallet RPC workflows (#35645), review is worthwhile but reasonably deferrable.
Membership: Matches the 'Scripts and tools' label and adds a standalone utility script under contrib/multisig/.
Factors: security/stability 0, bug 0, performance 0, user value 2, leverage 1