Sign sweeps with the primary or any fallback wallet

Split the sweep build from signing: the destination and fees always come from
the primary wallet (stable txid), then signing is attempted with each of the
primary/fallback arkd-wallets until one succeeds. Broadcasting stays on the
primary. This lets a single arkd sweep batches signed by any of its LPs' wallets.

Author: bitcoin-coder-bob

internal/config/config.go

@@ -981,7 +981,7 @@ func (c *Config) appService() error {
 	}
 
 	svc, err := application.NewService(
-		c.wallet, c.signer, c.repo, c.txBuilder, c.scanner,
+		c.wallet, c.FallbackWalletServices(), c.signer, c.repo, c.txBuilder, c.scanner,
 		c.scheduler, c.liveStore, roundReportSvc, c.alerts, c.fee,
 	)
 	if err != nil {
@@ -999,7 +999,7 @@ func (c *Config) adminService() error {
 	}
 
 	c.adminSvc = application.NewAdminService(
-		c.wallet, c.repo, c.txBuilder, c.liveStore, unit, c.fee,
+		c.wallet, c.FallbackWalletServices(), c.repo, c.txBuilder, c.liveStore, unit, c.fee,
 	)
 	return nil
 }

internal/core/application/admin.go

@@ -57,7 +57,10 @@ type AdminService interface {
 }
 
 type adminService struct {
-	walletSvc       ports.WalletService
+	walletSvc ports.WalletService
+	// walletFallbacks are additional arkd-wallets whose batches admin.Sweep may also
+	// sign; signing is attempted with the primary wallet first, then each fallback.
+	walletFallbacks []ports.WalletService
 	repoManager     ports.RepoManager
 	txBuilder       ports.TxBuilder
 	sweeperTimeUnit ports.TimeUnit
@@ -70,11 +73,13 @@ type adminService struct {
 }
 
 func NewAdminService(
-	walletSvc ports.WalletService, repoManager ports.RepoManager, txBuilder ports.TxBuilder,
+	walletSvc ports.WalletService, walletFallbacks []ports.WalletService,
+	repoManager ports.RepoManager, txBuilder ports.TxBuilder,
 	liveStoreSvc ports.LiveStore, timeUnit ports.TimeUnit, feeManager ports.FeeManager,
 ) AdminService {
 	return &adminService{
 		walletSvc:       walletSvc,
+		walletFallbacks: walletFallbacks,
 		repoManager:     repoManager,
 		txBuilder:       txBuilder,
 		sweeperTimeUnit: timeUnit,
@@ -83,6 +88,12 @@ func NewAdminService(
 	}
 }
 
+// signingWallets returns the wallets to try when signing a sweep, in order: the
+// primary wallet first, then any configured fallbacks.
+func (a *adminService) signingWallets() []ports.WalletService {
+	return append([]ports.WalletService{a.walletSvc}, a.walletFallbacks...)
+}
+
 func (a *adminService) Wallet() ports.WalletService {
 	return a.walletSvc
 }
@@ -557,7 +568,7 @@ func (a *adminService) Sweep(
 		return "", "", fmt.Errorf("no funds to sweep")
 	}
 
-	txid, txhex, err = a.txBuilder.BuildSweepTx(inputs)
+	txid, txhex, err = buildAndSignSweepTx(a.txBuilder, a.signingWallets(), inputs)
 	if err != nil {
 		return
 	}

internal/core/application/admin_test.go

@@ -56,7 +56,7 @@ func TestAdminService_Settings(t *testing.T) {
 		if seed != nil {
 			require.NoError(t, repo.settingsRepo.Upsert(ctx, *seed, nil))
 		}
-		return application.NewAdminService(nil, repo, nil, nil, ports.UnixTime, nil)
+		return application.NewAdminService(nil, nil, repo, nil, nil, ports.UnixTime, nil)
 	}
 
 	t.Run("settings", func(t *testing.T) {
@@ -246,7 +246,7 @@ func TestAdminService_SettingsSerialization(t *testing.T) {
 	seed := validSettings()
 	probe := &serializeProbeRepo{settings: &seed, delay: 10 * time.Millisecond}
 	svc := application.NewAdminService(
-		nil, &mockRepoManager{settingsRepo: probe}, nil, nil, ports.UnixTime, nil,
+		nil, nil, &mockRepoManager{settingsRepo: probe}, nil, nil, ports.UnixTime, nil,
 	)
 
 	const workers = 8

internal/core/application/service.go

@@ -70,6 +70,7 @@ type service struct {
 
 func NewService(
 	wallet ports.WalletService,
+	walletFallbacks []ports.WalletService,
 	signer ports.SignerService,
 	repoManager ports.RepoManager,
 	builder ports.TxBuilder,
@@ -137,13 +138,19 @@ func NewService(
 	ctx, cancel := context.WithCancel(ctx)
 
 	svc := &service{
-		wallet:                   wallet,
-		signer:                   signer,
-		repoManager:              repoManager,
-		builder:                  builder,
-		cache:                    cache,
-		scanner:                  scanner,
-		sweeper:                  newSweeper(wallet, repoManager, builder, scheduler),
+		wallet:      wallet,
+		signer:      signer,
+		repoManager: repoManager,
+		builder:     builder,
+		cache:       cache,
+		scanner:     scanner,
+		sweeper: newSweeper(
+			wallet,
+			walletFallbacks,
+			repoManager,
+			builder,
+			scheduler,
+		),
 		operatorPrvkey:           operatorSigningKey,
 		operatorPubkey:           operatorSigningKey.PubKey(),
 		forfeitsBoardingSigsChan: make(chan struct{}, 1),

internal/core/application/sweep_fallback_internal_test.go

@@ -0,0 +1,102 @@
+package application
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/arkade-os/arkd/internal/core/ports"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeWallet is a distinct, comparable ports.WalletService identity. Only its
+// pointer identity matters for the fallback-iteration tests.
+type fakeWallet struct {
+	ports.WalletService
+	name string
+}
+
+// fakeSweepBuilder implements just the two sweep methods of ports.TxBuilder that
+// buildAndSignSweepTx uses. SignSweepTx succeeds only for goodWallet, recording the
+// order in which wallets are tried.
+type fakeSweepBuilder struct {
+	ports.TxBuilder
+	buildErr   error
+	unsignedTx string
+	txid       string
+	goodWallet ports.WalletService
+	signCalls  []ports.WalletService
+}
+
+func (b *fakeSweepBuilder) BuildSweepTx(inputs []ports.TxInput) (string, string, error) {
+	if b.buildErr != nil {
+		return "", "", b.buildErr
+	}
+	return b.unsignedTx, b.txid, nil
+}
+
+func (b *fakeSweepBuilder) SignSweepTx(
+	wallet ports.WalletService, unsignedTx string,
+) (string, error) {
+	b.signCalls = append(b.signCalls, wallet)
+	if b.goodWallet != nil && wallet == b.goodWallet {
+		return "signed:" + unsignedTx, nil
+	}
+	return "", fmt.Errorf("wallet %v cannot sign", wallet)
+}
+
+func TestBuildAndSignSweepTx(t *testing.T) {
+	inputs := []ports.TxInput{{Txid: "aa", Index: 0}}
+	primary := &fakeWallet{name: "primary"}
+	fb1 := &fakeWallet{name: "fb1"}
+	fb2 := &fakeWallet{name: "fb2"}
+	wallets := []ports.WalletService{primary, fb1, fb2}
+
+	t.Run("primary signs, fallbacks not tried", func(t *testing.T) {
+		b := &fakeSweepBuilder{unsignedTx: "unsigned", txid: "txid123", goodWallet: primary}
+
+		txid, signed, err := buildAndSignSweepTx(b, wallets, inputs)
+		require.NoError(t, err)
+		require.Equal(t, "txid123", txid)
+		require.Equal(t, "signed:unsigned", signed)
+		require.Equal(t, []ports.WalletService{primary}, b.signCalls)
+	})
+
+	t.Run("falls back to a later wallet in order", func(t *testing.T) {
+		b := &fakeSweepBuilder{unsignedTx: "unsigned", txid: "txid123", goodWallet: fb2}
+
+		txid, signed, err := buildAndSignSweepTx(b, wallets, inputs)
+		require.NoError(t, err)
+		require.Equal(t, "txid123", txid)
+		require.Equal(t, "signed:unsigned", signed)
+		require.Equal(t, []ports.WalletService{primary, fb1, fb2}, b.signCalls)
+	})
+
+	t.Run("no wallet can sign returns aggregated error naming each wallet", func(t *testing.T) {
+		b := &fakeSweepBuilder{unsignedTx: "unsigned", txid: "txid123"}
+
+		txid, signed, err := buildAndSignSweepTx(b, wallets, inputs)
+		require.Error(t, err)
+		require.Empty(t, txid)
+		require.Empty(t, signed)
+		require.Contains(t, err.Error(), "no wallet could sign sweep tx txid123")
+		require.Contains(t, err.Error(), "wallet[0]")
+		require.Contains(t, err.Error(), "wallet[2]")
+		require.Len(t, b.signCalls, 3)
+	})
+
+	t.Run("no signing wallets configured", func(t *testing.T) {
+		b := &fakeSweepBuilder{unsignedTx: "unsigned", txid: "txid123"}
+
+		_, _, err := buildAndSignSweepTx(b, nil, inputs)
+		require.ErrorContains(t, err, "no signing wallets configured for sweep tx txid123")
+		require.Empty(t, b.signCalls)
+	})
+
+	t.Run("build error short-circuits before signing", func(t *testing.T) {
+		b := &fakeSweepBuilder{buildErr: fmt.Errorf("boom")}
+
+		_, _, err := buildAndSignSweepTx(b, wallets, inputs)
+		require.ErrorContains(t, err, "boom")
+		require.Empty(t, b.signCalls)
+	})
+}

internal/core/application/sweeper.go

@@ -31,10 +31,13 @@ type sweeperTask struct {
 // it is responsible for sweeping batch outputs that reached the expiration date.
 // it also handles delaying the sweep events in case some parts of the tree are broadcasted
 type sweeper struct {
-	wallet      ports.WalletService
-	repoManager ports.RepoManager
-	builder     ports.TxBuilder
-	scheduler   ports.SchedulerService
+	wallet ports.WalletService
+	// walletFallbacks are additional arkd-wallets whose batches this arkd may also
+	// sweep; signing is attempted with the primary wallet first, then each fallback.
+	walletFallbacks []ports.WalletService
+	repoManager     ports.RepoManager
+	builder         ports.TxBuilder
+	scheduler       ports.SchedulerService
 
 	// cache of scheduled tasks, avoid scheduling the same sweep event multiple times
 	locker *sync.Mutex
@@ -44,14 +47,54 @@ type sweeper struct {
 }
 
 func newSweeper(
-	wallet ports.WalletService, repoManager ports.RepoManager, builder ports.TxBuilder,
+	wallet ports.WalletService, walletFallbacks []ports.WalletService,
+	repoManager ports.RepoManager, builder ports.TxBuilder,
 	scheduler ports.SchedulerService,
 ) *sweeper {
 	return &sweeper{
-		wallet, repoManager, builder, scheduler, &sync.Mutex{}, make(map[string]struct{}), nil,
+		wallet, walletFallbacks, repoManager, builder, scheduler,
+		&sync.Mutex{}, make(map[string]struct{}), nil,
 	}
 }
 
+// signingWallets returns the wallets to try when signing a sweep, in order: the
+// primary wallet first, then any configured fallbacks.
+func (s *sweeper) signingWallets() []ports.WalletService {
+	return append([]ports.WalletService{s.wallet}, s.walletFallbacks...)
+}
+
+// buildAndSignSweepTx builds the sweep transaction once (its destination and fees
+// come from the primary wallet) and then attempts to sign it with each wallet in
+// order, returning as soon as one succeeds. This lets a single arkd sweep batches
+// signed by any of its primary/fallback arkd-wallets. Broadcasting is left to the
+// caller.
+func buildAndSignSweepTx(
+	builder ports.TxBuilder, wallets []ports.WalletService, inputs []ports.TxInput,
+) (string, string, error) {
+	unsignedTx, txid, err := builder.BuildSweepTx(inputs)
+	if err != nil {
+		return "", "", err
+	}
+
+	if len(wallets) == 0 {
+		return "", "", fmt.Errorf("no signing wallets configured for sweep tx %s", txid)
+	}
+
+	signErrs := make([]error, 0, len(wallets))
+	for i, wallet := range wallets {
+		signed, signErr := builder.SignSweepTx(wallet, unsignedTx)
+		if signErr == nil {
+			return txid, signed, nil
+		}
+		// name the failing wallet so a multi-wallet operator can tell which rejected it
+		signErrs = append(signErrs, fmt.Errorf("wallet[%d]: %w", i, signErr))
+	}
+
+	return "", "", fmt.Errorf(
+		"no wallet could sign sweep tx %s: %w", txid, errors.Join(signErrs...),
+	)
+}
+
 func (s *sweeper) start(ctx context.Context) error {
 	s.scheduledTasks = make(map[string]struct{})
 	s.scheduler.Start()
@@ -627,7 +670,9 @@ func (s *sweeper) createBatchSweepTask(commitmentTxid, vtxoTreeRootTxid string)
 			)
 
 			// build the sweep transaction with all the expired non-swept batch outputs
-			sweepTxId, sweepTx, err = s.builder.BuildSweepTx(unspentOutputsToSweep)
+			sweepTxId, sweepTx, err = buildAndSignSweepTx(
+				s.builder, s.signingWallets(), unspentOutputsToSweep,
+			)
 			if err != nil {
 				return err
 			}
@@ -663,7 +708,9 @@ func (s *sweeper) createBatchSweepTask(commitmentTxid, vtxoTreeRootTxid string)
 		} else {
 			// if all outputs are spent, it means we missed to mark the batch as swept,
 			// build a sweep transaction without broadcasting it. we'll use it rebuild sweepEvent.
-			sweepTxId, sweepTx, err = s.builder.BuildSweepTx(outputsToSweep)
+			sweepTxId, sweepTx, err = buildAndSignSweepTx(
+				s.builder, s.signingWallets(), outputsToSweep,
+			)
 			if err != nil {
 				return err
 			}
@@ -749,7 +796,9 @@ func (s *sweeper) createCheckpointSweepTask(
 		checkpointTxid := toSweep.Txid
 		log.Debugf("sweeper: start sweeping checkpoint %s", checkpointTxid)
 
-		_, sweepTx, err := s.builder.BuildSweepTx([]ports.TxInput{toSweep})
+		_, sweepTx, err := buildAndSignSweepTx(
+			s.builder, s.signingWallets(), []ports.TxInput{toSweep},
+		)
 		if err != nil {
 			return err
 		}

internal/core/ports/tx_builder.go

@@ -60,7 +60,12 @@ type TxBuilder interface {
 	VerifyForfeitTxs(
 		vtxos []domain.Vtxo, connectors tree.FlatTxTree, txs []string,
 	) (valid map[domain.Outpoint]ValidForfeitTx, err error)
-	BuildSweepTx(inputs []TxInput) (txid string, signedSweepTx string, err error)
+	// BuildSweepTx builds the unsigned sweep transaction (its destination address
+	// and fees come from the primary wallet); SignSweepTx signs it with a given
+	// wallet. They are split so a sweep can be signed by any primary/fallback
+	// wallet without rebuilding it.
+	BuildSweepTx(inputs []TxInput) (unsignedTx string, txid string, err error)
+	SignSweepTx(wallet WalletService, unsignedTx string) (signedTx string, err error)
 	GetSweepableBatchOutputs(vtxoTree *tree.TxTree) (
 		vtxoTreeExpiry *arklib.RelativeLocktime, batchOutputs *TxInput, err error,
 	)

internal/infrastructure/live-store/live_store_test.go

@@ -834,13 +834,20 @@ func (m *mockedTxBuilder) BuildCommitmentTx(
 
 func (m *mockedTxBuilder) BuildSweepTx(
 	inputs []ports.TxInput,
-) (txid string, signedSweepTx string, err error) {
+) (unsignedTx string, txid string, err error) {
 	args := m.Called(inputs)
 	res0 := args.Get(0).(string)
 	res1 := args.Get(1).(string)
 	return res0, res1, args.Error(2)
 }
 
+func (m *mockedTxBuilder) SignSweepTx(
+	wallet ports.WalletService, unsignedTx string,
+) (signedTx string, err error) {
+	args := m.Called(wallet, unsignedTx)
+	return args.Get(0).(string), args.Error(1)
+}
+
 func (m *mockedTxBuilder) GetSweepableBatchOutputs(
 	vtxoTree *tree.TxTree,
 ) (vtxoTreeExpiry *arklib.RelativeLocktime, sweepInput *ports.TxInput, err error) {

internal/infrastructure/tx-builder/covenantless/builder.go

@@ -255,10 +255,17 @@ func (b *txBuilder) FinalizeAndExtract(tx string) (string, error) {
 }
 
 func (b *txBuilder) BuildSweepTx(inputs []ports.TxInput) (
-	txid, signedSweepTx string, err error,
+	unsignedTx, txid string, err error,
 ) {
 	ctx := context.Background()
-	return sweepTransaction(ctx, b.wallet, inputs)
+	return buildSweepTransaction(ctx, b.wallet, inputs)
+}
+
+func (b *txBuilder) SignSweepTx(
+	wallet ports.WalletService, unsignedTx string,
+) (signedTx string, err error) {
+	ctx := context.Background()
+	return signSweepTransaction(ctx, wallet, unsignedTx)
 }
 
 func (b *txBuilder) VerifyForfeitTxs(