test(platform-wallet): cover insert_platform_node_pool_entry and its error paths

.cargo/audit.toml

@@ -1,3 +1,9 @@
 [advisories]
-# TODO Remove it from here
-ignore = [ "RUSTSEC-2020-0071"] # advisory IDs to ignore e.g. ["RUSTSEC-2019-0001", ...]
+# CI reads audit configuration from the workspace root.
+# TODO: enable PR audits once existing workspace advisories are resolved.
+ignore = [
+    # Acknowledged 2026-06-08: bincode is unmaintained; no known exploit in this advisory.
+    # Storage decodes are size-bounded; the FFI asset-lock size gate is tracked in #4585.
+    # Replace the codec with a maintained alternative and revisit this exception.
+    "RUSTSEC-2025-0141",
+]

.github/workflows/tests-rs-wallet.yml

@@ -201,9 +201,16 @@ jobs:
             --locked \
             -- --no-deps -D warnings
 
-      # Mirrors the workspace job's non-shielded step for the wallet crates:
-      # same package subset, same `not test(~shield)` filter (shielded wallet
-      # tests are not run there either).
+      # The shielded-wallet suite (Orchard proving, viewing-key binds, note
+      # scans) is excluded by MODULE PATH, not by the word "shield". A
+      # `test(~shield)` substring match also swept up ~47 pure-logic tests
+      # across the three crates — input selection, FFI error codes, memo
+      # encoding, SQLite viewing-key rows — that cost a tenth of a second and
+      # have no compensating job anywhere.
+      #
+      # `--no-tests fail` is the zero-match guard: a filter that stops
+      # selecting anything must fail the step, not pass green. Pinned rather
+      # than left to nextest's default, which is a default and not a promise.
       - name: Run wallet tests (non-shielded)
         run: |
           cargo nextest run \
@@ -212,7 +219,8 @@ jobs:
             --package platform-wallet-ffi \
             --all-features \
             --locked \
-            -E 'not test(~shield)'
+            --no-tests fail \
+            -E 'not test(~wallet::shielded::)'
         env:
           RUST_MIN_STACK: 4194304
           CARGO_PROFILE_DEV_DEBUG: "0"

Cargo.toml

@@ -112,6 +112,13 @@ opt-level = 3
 opt-level = 3
 [profile.dev.package.grovedb-commitment-tree]
 opt-level = 3
+# Same reasoning for Argon2id: a debug-built KDF is memory-hard by design, so
+# an unoptimized one costs seconds per derivation and dominates any test that
+# unlocks a `platform-wallet-storage` vault. `platform-wallet-storage` is the
+# only workspace member that compiles argon2, so this override touches nothing
+# else here despite the workspace-global syntax.
+[profile.dev.package.argon2]
+opt-level = 3
 
 [profile.test.package.halo2_proofs]
 opt-level = 3
@@ -125,6 +132,8 @@ opt-level = 3
 opt-level = 3
 [profile.test.package.grovedb-commitment-tree]
 opt-level = 3
+[profile.test.package.argon2]
+opt-level = 3
 
 [workspace.package]
 

packages/rs-platform-wallet-storage/Cargo.toml

@@ -28,8 +28,8 @@ hex = "0.4"
 # `dpp` types reach the persister via `IdentityPublicKey` (identity_keys
 # writer), `AssetLockProof` (asset_locks writer) and `Identifier`
 # (dashpay writer). `dash-sdk` is here for the `AddressFunds` re-export
-# in `schema/platform_addrs.rs`. Feature set mirrors sibling
-# `rs-platform-wallet` so the resolver picks identical hashes.
+# in `schema/platform_addrs.rs`. Storage declares only the features it uses
+# directly; `platform-wallet` adds `dash-sdk/wallet` to Cargo's unified set.
 platform-wallet = { path = "../rs-platform-wallet", features = [
     "serde",
 ], optional = true }
@@ -46,11 +46,16 @@ rusqlite = { version = "0.38", features = [
     "backup",
     "blob",
     "hooks",
+    "limits",
     "trace",
 ], optional = true }
-refinery = { version = "0.9", default-features = false, features = [
+refinery = { version = "=0.9.2", default-features = false, features = [
     "rusqlite",
 ], optional = true }
+# The migration adapter uses refinery's supported synchronous driver traits.
+# Match refinery's driver traits and applied-history timestamp types.
+refinery-core = { version = "=0.9.2", default-features = false, optional = true }
+time = { version = "=0.3.49", features = ["parsing"], optional = true }
 # bincode 2 is required directly: we encode `dpp::IdentityPublicKey`
 # (which derives bincode 2 `Encode`/`Decode`) and decode
 # `dpp::AssetLockProof` from the asset-lock blob column. Exact-pinned to
@@ -60,7 +65,17 @@ tempfile = { version = "3", optional = true }
 chrono = { version = "0.4", default-features = false, features = [
     "clock",
 ], optional = true }
+# Backs the migration-set fingerprint helpers in `sqlite::migrations`, which
+# are test-only (`cfg(test)` / `__test-helpers`). Kept optional and pulled in
+# by `__test-helpers` alone, so a shipping build does not compile a hash
+# crate it never calls.
 sha2 = { version = "0.10", optional = true }
+# `JsonSchema` for `SecretString`, enabled by `secrets` (the only feature
+# under which the type exists). Reuses the workspace-locked 1.2.1.
+# `default-features = false` drops the `derive` feature (we hand-write the
+# impl), matching the crate's existing derive-free schemars usage so the
+# lock gains no `schemars_derive` entry.
+schemars = { version = "1", optional = true, default-features = false }
 
 # Secret-storage deps (gated by the `secrets` feature). RustSec-clean
 # pins (Smythe §7); `aes-gcm` is deliberately omitted. `keyring`'s
@@ -73,14 +88,36 @@ subtle = { version = "=2.6.1", optional = true }
 # CSPRNG for AEAD nonces and the vault salt; exact-pinned like the rest
 # of the crypto stack so the random source is not the loose one.
 getrandom = { version = "=0.2.17", optional = true }
+# Guarded allocator for `secrets::SecretString`/`SecretBytes`: every
+# secret gets page-aligned, guard-paged, canary-checked, mlocked memory,
+# so two live secrets can never share a page. Pure Rust (libc /
+# windows-sys), no C toolchain or libsodium. Its `getrandom 0.2` and
+# `windows-sys 0.45` deps are already in the workspace lock, so it adds
+# no transitive crates. Exact-pinned like the rest of the
+# soundness-critical stack: it holds seeds and xprivs, so a version
+# change deserves a human reading the diff, not an automatic pickup.
+memsec = { version = "=0.7.0", optional = true }
+# Safe, cross-platform query for the host's memory page size, so
+# `secrets::guarded` can refuse a host on which `memsec`'s runtime page
+# rounding would blow the crate's locked-memory budget. Chosen over
+# `page_size` because it is already in `Cargo.lock` (it backs the
+# page-isolation tests), so this adds no new crate to the graph, and over
+# a raw `libc::sysconf` because the query stays safe on Windows too.
 region = { version = "=3.0.2", optional = true }
 keyring-core = { version = "=1.0.0", optional = true }
 # Cross-process advisory file lock for the vault read-modify-write.
 # `fd-lock` 4.x is pure-rustix and replaces the `fs2`/`fs4` family that
 # was removed from the sqlite arm — those tests grep for `fs2`/`fs4`
 # literals in this crate's source/manifest and would re-trigger on the
 # older crates. `fd-lock` has no such collision.
-fd-lock = { version = "4.0.4", optional = true }
+# LOCAL-FS ONLY: flock/LockFileEx interlock processes only on local
+# filesystems; over NFS/CIFS the lock does not interlock, so a vault file
+# must not be shared across hosts — steer multi-host to the OS-keyring arm.
+# Exact-pinned (`=`) like the rest of the soundness-critical stack: the
+# `VaultLock` unsafe drop-order argument in `secrets/file/mod.rs` is
+# calibrated to fd-lock 4.0.4's guard internals; any bump must re-verify
+# that the guard releases the OS lock before the backing `RwLock` frees.
+fd-lock = { version = "=4.0.4", optional = true }
 
 # CLI deps (gated by the `cli` feature)
 clap = { version = "4", features = ["derive"], optional = true }
@@ -124,19 +161,26 @@ filetime = "0.2"
 # Test-only: construct the `Zeroizing<[u8; 32]>` secret on an
 # `IdentityKeyEntry` to prove the on-disk wire shape drops it. The
 # production `zeroize` dep is gated behind the `secrets` feature, which
-# the off-state CI build disables, so the test surface needs its own.
+# the off-state build disables, so the test surface needs its own.
+# NOTE: that off-state build (`--no-default-features --features
+# sqlite,cli`) is a local/manual check, NOT a CI gate — no workflow runs
+# it today. Keep this dev-dep regardless: it is what lets the off-state
+# build succeed when someone does run it.
 zeroize = { version = "=1.8.2", features = ["derive"] }
 tracing-test = { version = "0.2", features = ["no-env-filter"] }
 serial_test = "3"
-# `default-features = false` so the off-state CI invocation
-# (`--no-default-features --features sqlite,cli`) actually exercises a
+# `default-features = false` so the off-state build
+# (`--no-default-features --features sqlite,cli`, a local/manual check —
+# see the note above; no CI job runs it) actually exercises a
 # build with `secrets`/`kv` disabled — otherwise the dev-dep view would
 # silently re-enable the default feature set for every integration test.
 # Test surface is opted into explicitly: `secrets` and `kv` are listed
 # so the plain `cargo test -p platform-wallet-storage` invocation runs
 # both feature paths (the `kv`-gated `sqlite_object_metadata.rs`
-# integration test and the `secrets`-gated unit tests).
-platform-wallet-storage = { path = ".", default-features = false, features = ["sqlite", "cli", "secrets", "kv", "__test-helpers"] }
+# integration test and the `secrets`-gated unit tests). `test-util` is here
+# so `secrets_mock_store_test_util.rs` proves the feature gate from the
+# outside — `cfg(test)` alone would satisfy it from within the crate.
+platform-wallet-storage = { path = ".", default-features = false, features = ["sqlite", "cli", "secrets", "kv", "__test-helpers", "test-util"] }
 tempfile = "3"
 # `sqlite_hardening_3625.rs`, `sqlite_persist_roundtrip.rs`, and
 # `sqlite_load_reconstruction.rs` import `dash_sdk::platform::address_sync::AddressFunds`.
@@ -154,6 +198,7 @@ dash-sdk = { path = "../rs-sdk", default-features = false, features = [
 default = ["sqlite", "cli", "secrets", "kv"]
 # SQLite-backed persister (`platform_wallet_storage::sqlite`).
 sqlite = [
+    "dep:libc",
     "dep:platform-wallet",
     "dep:serde",
     "dep:key-wallet",
@@ -162,10 +207,11 @@ sqlite = [
     "dep:dash-sdk",
     "dep:rusqlite",
     "dep:refinery",
+    "dep:refinery-core",
+    "dep:time",
     "dep:bincode",
     "dep:tempfile",
     "dep:chrono",
-    "dep:sha2",
 ]
 # Maintenance CLI binary. Requires `sqlite` because the only subcommands
 # in scope today operate on the SQLite persister.
@@ -184,17 +230,34 @@ cli = [
 # crate without the crypto graph.
 secrets = [
     "dep:argon2",
+    # Enable argon2's `zeroize` feature so the KDF wipes its sensitive
+    # intermediate state (`initial_hash`/`blockhash`) on drop, and so
+    # `impl Zeroize for Block` is compiled in — `derive_key` in
+    # `secrets/file/crypto.rs` owns the block matrix itself and relies on
+    # it, because argon2 0.5.3 does NOT wipe that matrix on its own. Keep
+    # it in the feature list (not a `default-features = false` rewrite) so
+    # argon2's own default features stay intact.
+    "argon2/zeroize",
+    # bincode is the producer for the Tier-2 envelope wire format and the
+    # three AAD encodings (`Tier2Aad`/`EntryAad`/`VerifyAad`) — see
+    # `secrets/wire/`. `=2.0.1` is the workspace-wide pin.
+    "dep:bincode",
     "dep:chacha20poly1305",
     # secrets uses serde directly (vault format + crypto envelope derive
     # `Serialize`/`Deserialize`); declare the dep here so
     # `--no-default-features --features secrets` builds without leaning
     # on the `sqlite` feature also having `dep:serde`.
     "dep:serde",
+    # `JsonSchema` for `SecretString` is unconditional under `secrets`: the
+    # schema is a bare `"type": "string"` carrying no length policy and no
+    # value, so there is nothing for a consumer to opt out of.
+    "dep:schemars",
     "dep:serde_json",
     "dep:tempfile",
     "dep:zeroize",
     "dep:subtle",
     "dep:getrandom",
+    "dep:memsec",
     "dep:region",
     "dep:keyring-core",
     "dep:fd-lock",
@@ -203,6 +266,11 @@ secrets = [
     "dep:apple-native-keyring-store",
     "dep:windows-native-keyring-store",
 ]
+# `Deserialize` for `SecretString`. Deliberately DEFAULT-OFF even though
+# `secrets` already pulls the `serde` DEP in: this gates the IMPL, not the
+# dep, so a config type can only grow a secret field when the consumer asks
+# for it. NO `Serialize` is ever provided, under any feature combination.
+serde = ["dep:serde"]
 # Per-object-type key/value metadata API
 # (`platform_wallet_storage::{KvStore, KvError, ObjectId}`) plus the
 # SQLite-backed impl. Requires `sqlite` because the only shipped backend
@@ -215,4 +283,14 @@ kv = ["sqlite"]
 # the write connection. The double-underscore prefix follows Cargo's
 # convention for "MUST NOT enable from downstream" features
 # (https://doc.rust-lang.org/cargo/reference/features.html#feature-resolver-version-2).
-__test-helpers = ["sqlite"]
+__test-helpers = ["sqlite", "dep:sha2"]
+# Exposes `SecretStore::file_mock` / `EncryptedFileStore::open_mock` — vault
+# constructors that use the Argon2id floor for fresh-vault creation and
+# per-secret wrapping; existing vaults retain their header parameters. Enable
+# it in `[dev-dependencies]` ONLY. The constructors panic outside debug builds
+# and this crate's own test harness.
+test-util = []
+# Persists and restores Orchard viewing keys from the
+# `PlatformWalletChangeSet::shielded` field. Other shielded state remains in
+# the host-provided `ShieldedStore`.
+shielded = ["sqlite", "platform-wallet?/shielded"]