From e2d926f5e09e785a3dde3da7f880d73821a185a6 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Fri, 9 Oct 2026 08:56:29 -0400
Subject: [PATCH] fix: use explicit OS entropy for assistant and wallet IDs

---
 core/archipelago/src/assistant/confirm.rs   | 5 +++--
 core/archipelago/src/assistant/untrusted.rs | 2 +-
 core/archipelago/src/wallet/minibits.rs     | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/core/archipelago/src/assistant/confirm.rs b/core/archipelago/src/assistant/confirm.rs
index 568a9e34..ef2109cd 100644
--- a/core/archipelago/src/assistant/confirm.rs
+++ b/core/archipelago/src/assistant/confirm.rs
@@ -23,7 +23,6 @@ use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::{Arc, Mutex, OnceLock};
 use std::time::Duration;
 
-use rand::RngCore;
 use serde_json::json;
 use sha2::{Digest, Sha256};
 use tokio::sync::oneshot;
@@ -227,7 +226,9 @@ pub fn global() -> Arc<ConfirmGate> {
 /// nonce for the same action never matches today's pending entry).
 pub fn mint_nonce(tool_name: &str, validated_args: &str) -> String {
     let mut salt = [0u8; 16];
-    rand::thread_rng().fill_bytes(&mut salt);
+    crate::entropy::draw_key_bytes(&mut rand::rngs::OsRng, &mut salt).unwrap_or_else(|e| {
+        panic!("refusing to mint a confirmation nonce from degenerate entropy: {e} (KEY-05)")
+    });
     let mut hasher = Sha256::new();
     hasher.update(salt);
     hasher.update(tool_name.as_bytes());
diff --git a/core/archipelago/src/assistant/untrusted.rs b/core/archipelago/src/assistant/untrusted.rs
index 5c244a58..13994cd8 100644
--- a/core/archipelago/src/assistant/untrusted.rs
+++ b/core/archipelago/src/assistant/untrusted.rs
@@ -30,7 +30,7 @@ pub const TOKEN_LEN: usize = 8;
 /// wrapped. Called exactly once per [`UntrustedBlock::new`] /
 /// [`wrap_untrusted`] invocation.
 fn fresh_token() -> String {
-    rand::thread_rng()
+    rand::rngs::OsRng
         .sample_iter(Alphanumeric)
         .take(TOKEN_LEN)
         .map(char::from)
diff --git a/core/archipelago/src/wallet/minibits.rs b/core/archipelago/src/wallet/minibits.rs
index d40ace08..87a55506 100644
--- a/core/archipelago/src/wallet/minibits.rs
+++ b/core/archipelago/src/wallet/minibits.rs
@@ -474,7 +474,7 @@ async fn ensure_token(
 
 /// Draw a fresh readable wallet name, Minibits-style: adjective + noun + number.
 fn generate_wallet_id() -> String {
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rngs::OsRng;
     let adj = ADJECTIVES.choose(&mut rng).copied().unwrap_or("quiet");
     let noun = NOUNS.choose(&mut rng).copied().unwrap_or("harbor");
     let num = rand::Rng::gen_range(&mut rng, 1..=999);