[StanCan321]

Stage 2 of the Ord integration

Draft — do not merge before #12.

This is the second-stage follow-up to #12, which adds the opt-in Ord download and configuration foundation. Review and merge #12 first. Once #12 lands, GitHub will reduce this PR diff to the three Stage 2 commits only.

Dependency and scope

• Stage 1: qt: add opt-in Ord installation and initial index #12 — opt-in Ord installation and configuration
• Stage 2: this PR — asset-aware Ord indexing, dedicated wallet onboarding, and a guarded Qt inscription workflow

This PR intentionally builds on #12 rather than duplicating or replacing its installer design. It remains in draft while CI and maintainer review validate the safety model.

Summary

• add an experimental Inscribe page with file picker, drag and drop, and bounded Qt image preview
• create or restore only the dedicated Bitcoin Core wallet named ord
• pass recovery words to Ord over standard input using secure allocator-backed buffers
• show new recovery words once in a non-dismissible acknowledgment dialog without a clipboard-copy action
• intentionally omit BIP39 passphrase support because Ord 0.29.0 accepts it only through process arguments
• show a network-validated funding address, spendable cardinal balance, and total balance
• enable rune and sat indexing so rune-bearing and rare-sat outputs are not treated as ordinary cardinal funding
• use a new versioned ord/data-runes-sats-v1 index, preserving incompatible legacy ord/data indexes
• let Ord bind port zero on 127.0.0.1, parse the kernel-selected port from the child, and require a valid /blockcount response before wallet use
• bypass configured HTTP proxies for Ord loopback traffic
• validate fee rate and destination against the active Bitcoin network
• reject links, devices, oversized files, and oversized image previews
• create a private immutable file snapshot for preview and broadcast
• scope each successful preview to a one-shot request token and exact file hash, fee, destination, and compression state
• repeat the dry-run against the same snapshot and require the mining-fee estimate to match before starting the live command
• provide bounded process output, bounded terminate/kill cleanup, and an explicit cancel action

Safety properties

• the wallet selected in the Bitcoin Qt toolbar is never used; every wallet command pins --name ord
• recovery words are never placed in process arguments, error output is hidden for create/restore failures, and application-owned secret buffers are cleansed after use
• the Ord HTTP server binds only to 127.0.0.1 on a kernel-assigned ephemeral port
• loopback is a reachability restriction, not an authentication boundary; another local process can reach the unauthenticated Ord HTTP endpoint
• broadcast requires a request-scoped successful preview for the exact current file bytes and settings
• dry-run and live commands use the same immutable snapshot and argument builder
• Ord constructs the live transaction plan in a separate invocation, so a concurrent wallet-state change can still cause failure or a different final fee; users must inspect the returned broadcast result
• shell invocation, --no-limit, reinscription, parent, delegate, metadata, and rare-sat selection remain unavailable

Index migration

Ord 0.29.0 does not retrofit sat tracking into an index originally created without --index-sats, even if a later index update includes the flag. This PR therefore does not silently reuse or delete the Stage 1 index. It builds the required asset-aware index in ord/data-runes-sats-v1 and leaves ord/data untouched.

Upgrades require a fresh synchronization and temporarily need space for both indexes. The legacy directory can be removed manually only after the new index is synchronized and the dedicated Ord wallet has been verified.

Test plan

• Production bitcoin-qt build
• Complete Qt test suite: 39 passed, 0 failed
• Manager tests covering wallet balance, validated receive address, create, restore, request-scoped previews, replay rejection, file mutation, invalid fees/addresses, snapshot broadcast arguments, and forbidden flags
• Real checksum-pinned Ord 0.29.0 regtest flow covering index restart/reorg, legacy-index incompatibility, fresh rune/sat index verification, kernel-assigned server port, HTTP readiness, create, mnemonic restore through stdin, funding, balance, dry-run, and actual inscription broadcast
• Proxy-configured environment coverage during the real Ord test
• Python syntax, include, filename, include-guard, file, and whitespace checks
• GitHub CI, including native ASAN and the pinned Ord integration job

Review notes

The first commit introduces the experimental inscription page. The second adds wallet onboarding and the end-to-end flow. The third is an adversarial security-hardening pass covering preview authorization, file TOCTOU, mnemonic handling, address/amount validation, asset-aware coin safety, loopback lifecycle, proxy behavior, cancellation, hostile image/file inputs, migration behavior, and expanded tests.

Image resizing or lossy recompression remains deliberately out of scope. The UI exposes only Ord's lossless Brotli option so the snapshotted bytes remain auditable.

[StanCan321]

Security-hardening pass pushed in 11c5635. Local verification is complete: production Qt build, 39/39 Qt tests, and the checksum-pinned Ord 0.29.0 regtest flow all pass, including legacy-index incompatibility, fresh rune/sat indexing, proxy-configured loopback access, wallet restore, dry-run, and real inscription broadcast.\n\nThe new GitHub Actions run is waiting for maintainer approval before jobs can start: https://github.com/bitcoindogmode/bitcoin/actions/runs/36865559960