[kwsantiago]

Summary

The enclave now treats the spending policy as part of the encrypted key. The host seals the policy bytes with the wallet key, and import installs that policy. A later policy change is refused, a second blob with a different policy is refused, and signing is refused until a policy is loaded. An empty policy denies. Older blobs that carry no policy binding fail closed.

Re-importing an older blob still opens that blob's policy. There is no rollback counter.

Test plan

• cargo test --manifest-path keep-enclave/enclave/Cargo.toml
• cargo test -p keep-enclave-host --lib
• CI

Summary by CodeRabbit

• New Features

  • Encrypted wallet imports now carry and verify the associated policy. The first accepted wallet seals that policy, and later imports must match it.
  • Signing operations are denied until a policy is loaded.

• Bug Fixes

  • Empty policy configurations now deny requests instead of allowing evaluation to proceed.
  • Invalid, empty, or tampered wallet keys and policies are rejected during import.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 18220d77-7030-4ea4-959c-7e14395f1124

📥 Commits

Reviewing files that changed from the base of the PR and between a9af7cb and ca806d4.

📒 Files selected for processing: 4

• keep-enclave/enclave/src/kms.rs
• keep-enclave/enclave/src/policy.rs
• keep-enclave/enclave/src/vsock_server.rs
• keep-enclave/host/src/kms.rs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4db84a3c-9067-4f5d-b861-82f00d495b40

📥 Commits

Reviewing files that changed from the base of the PR and between 48ebaea and a9af7cb.

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing: 5

• keep-enclave/enclave/src/kms.rs
• keep-enclave/enclave/src/policy.rs
• keep-enclave/enclave/src/vsock_server.rs
• keep-enclave/host/Cargo.toml
• keep-enclave/host/src/kms.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

Host and enclave KMS now encrypt wallet keys together with policy bytes and bind the ciphertext to a policy hash. The enclave server installs a policy from an accepted wallet, prevents policy replacement, and denies signing operations until a policy is loaded.

Changes

Sealed wallet policy

Layer / File(s)	Summary
Seal and open wallet policy keep-enclave/host/src/kms.rs, keep-enclave/host/Cargo.toml, keep-enclave/enclave/src/kms.rs	Host and enclave KMS encode a length-prefixed wallet key followed by policy bytes. They authenticate the policy hash as AES-GCM additional authenticated data and validate the recovered key, policy, and hash. Tests cover the encoded layout, round trip, and rejection of a tampered hash.
Import and seal enclave policy keep-enclave/enclave/src/vsock_server.rs, keep-enclave/enclave/src/policy.rs	The server validates policy data and wallet-key length during encrypted import. It seals the policy hash after the first accepted wallet, rejects later mismatched policies, and rejects empty policy configurations. An empty policy engine returns Deny(ExplicitDeny).
Require policy for signing keep-enclave/enclave/src/vsock_server.rs	Signing, PSBT signing, and FROST round 1 and round 2 return PolicyDenied when no policy is loaded.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant EnvelopeEncryption
  participant VsockServer
  participant EnclaveKms
  EnvelopeEncryption->>VsockServer: Provide encrypted wallet
  VsockServer->>EnclaveKms: decrypt_wallet_key(encrypted wallet)
  EnclaveKms-->>VsockServer: Return wallet key and policy bytes
  VsockServer->>VsockServer: Validate and seal policy hash

Loading

Suggested reviewers: wksantiago

Merge Risk: ⚪ Minimal · up to a9af7

No confirmed issue remains that should block merging after normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 44.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 50 functions across 4 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: binding the enclave spending policy to the imported key.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 44.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 50 functions across 4 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the sealed key tight,
Policy travels, hashed just right.
No rule? The signing paws all wait,
A loaded policy guards the gate.
I nibble carrots, then celebrate.}

_{Comment @coderabbitai help to get the list of available commands.}