fix: preserve intent safety through multisig dispatch

Author: UnArbosFive

sdk/python/bittensor/cli/context.py

@@ -530,6 +530,7 @@ def submit(
         except ValueError as error:
             self.output.error(str(error))
             raise typer.Exit(2) from error
+        semantic_intent = intent.semantic_intent()
 
         # MEV shielding: explicit flag > persistent config > the intent's own
         # default. `forced` distinguishes "the user asked for shielding" (hard
@@ -538,10 +539,10 @@ def submit(
         # `mev_shield_required` intents (collateral AMM buys) refuse the
         # unshielded opt-out entirely.
         configured_shield = cfg.get("mev_shield")
-        if intent.mev_shield_required:
+        if semantic_intent.mev_shield_required:
             if self.mev_shield is False or configured_shield is False:
                 self.output.error(
-                    f"{intent.op} must be submitted MEV-shielded",
+                    f"{semantic_intent.op} must be submitted MEV-shielded",
                     help=(
                         "collateral / burned-registration AMM fills cannot run "
                         "unshielded; omit --no-mev-shield"
@@ -557,17 +558,17 @@ def submit(
             shield = bool(configured_shield)
             shield_forced = shield
         else:
-            shield = intent.mev_shield_default
+            shield = semantic_intent.mev_shield_default
             shield_forced = False
         if shield and (proxy_for is not None or self.uses_extension_signer()):
             blocker = "a proxied call" if proxy_for is not None else "the extension signer"
-            if shield_forced or intent.mev_shield_required:
+            if shield_forced or semantic_intent.mev_shield_required:
                 self.output.error(
                     f"MEV shielding cannot wrap {blocker}",
                     help=(
                         "collateral intents cannot fall back to unshielded; "
                         "sign directly without a proxy/extension"
-                        if intent.mev_shield_required
+                        if semantic_intent.mev_shield_required
                         else "pass --no-mev-shield to submit unshielded"
                     ),
                 )
@@ -607,12 +608,12 @@ async def _shield_fee_preflight(client):
 
                 shortfall = self.run(_shield_fee_preflight)
                 if shortfall is not None:
-                    if shield_forced or intent.mev_shield_required:
+                    if shield_forced or semantic_intent.mev_shield_required:
                         self.output.error(
                             "MEV-shielded submission needs free TAO for the outer carrier fee",
                             help=(
-                                f"{intent.op} cannot submit unshielded"
-                                if intent.mev_shield_required
+                                f"{semantic_intent.op} cannot submit unshielded"
+                                if semantic_intent.mev_shield_required
                                 else "pass --no-mev-shield to submit unshielded "
                                 "(alpha fees work on the bare call), or fund the "
                                 "signing account with free TAO"
@@ -816,13 +817,13 @@ async def _execute(client):
                 # The MevShield pallet isn't active here (e.g. localnet). A
                 # forced / required shield must fail loudly; the built-in
                 # default degrades visibly so the command still works.
-                if shield_forced or intent.mev_shield_required:
+                if shield_forced or semantic_intent.mev_shield_required:
                     raise BittensorError(
                         "MEV shield is not active on this network "
                         "(MevShield.NextKey is unset); "
                         + (
-                            f"{intent.op} cannot submit unshielded"
-                            if intent.mev_shield_required
+                            f"{semantic_intent.op} cannot submit unshielded"
+                            if semantic_intent.mev_shield_required
                             else "pass --no-mev-shield to submit unshielded"
                         )
                     )
@@ -844,13 +845,13 @@ async def _execute(client):
                     else None
                 )
                 if shortfall is not None:
-                    if shield_forced or intent.mev_shield_required:
+                    if shield_forced or semantic_intent.mev_shield_required:
                         raise BittensorError(
                             "MEV-shielded submission needs free TAO for the outer "
                             "carrier fee; "
                             + (
-                                f"{intent.op} cannot submit unshielded"
-                                if intent.mev_shield_required
+                                f"{semantic_intent.op} cannot submit unshielded"
+                                if semantic_intent.mev_shield_required
                                 else "pass --no-mev-shield to submit unshielded "
                                 "(alpha fees work on the bare call)"
                             )

sdk/python/bittensor/cli/multisig_helpers.py

@@ -388,7 +388,13 @@ def wrap_intent_for_multisig_wallet(app_ctx, intent):
 
     Raises ``ValueError`` when the preset or local signatory set is unusable.
     """
-    from ..intents.multisig import MultisigExecute, MultisigThreshold1, _compose_inner
+    from ..intents.multisig import (
+        MultisigExecute,
+        MultisigIntentAdapter,
+        MultisigThreshold1,
+        MultisigThreshold1IntentAdapter,
+        _compose_inner,
+    )
 
     if getattr(intent, "signer", None) != "coldkey":
         return intent
@@ -414,7 +420,8 @@ def wrap_intent_for_multisig_wallet(app_ctx, intent):
         app_ctx.output.message(
             f"[dim]dispatching via 1-of-{len(signatories)} multisig {preset}[/dim]"
         )
-        return MultisigThreshold1(other_signatories=others, call=call_dict)
+        dispatch = MultisigThreshold1(other_signatories=others, call=call_dict)
+        return MultisigThreshold1IntentAdapter(dispatch=dispatch, semantic=intent)
 
     async def _timepoint(client):
         wallet = wallets.open_wallet(member_name, path=app_ctx.wallet_path)
@@ -433,12 +440,13 @@ async def _timepoint(client):
         f"[dim]{action} via {threshold}-of-{len(signatories)} multisig {preset} "
         f"as {format_signatory_display(signer_ss58, member_name)}[/dim]"
     )
-    return MultisigExecute(
+    dispatch = MultisigExecute(
         threshold=threshold,
         other_signatories=others,
         call=call_dict,
         timepoint=timepoint,
     )
+    return MultisigIntentAdapter(dispatch=dispatch, semantic=intent)
 
 
 async def multisig_list_records(

sdk/python/bittensor/executor.py

@@ -523,7 +523,7 @@ async def plan(
             violations=violations,
             call=call,
             extras=extras,
-            spend=intent.spend(),
+            spend=intent.semantic_intent().spend(),
             args={k: v for k, v in intent.to_dict().items() if k != "op"},
         )
 
@@ -565,7 +565,7 @@ async def execute(
         return the queue receipt instead. ``registration_timeout`` and the
         optional ``on_progress(dict)`` callback apply only to that wait.
         """
-        if intent.mev_shield_required:
+        if intent.semantic_intent().mev_shield_required:
             if proxy_for is not None:
                 raise BittensorError(
                     f"{intent.op} must be submitted MEV-shielded and cannot "

sdk/python/bittensor/intents/base.py

@@ -244,6 +244,14 @@ def affects_all_subnets(self) -> bool:
         """True if the intent acts across every subnet (so any allowlist must fail it)."""
         return False
 
+    def semantic_intent(self) -> "Intent":
+        """Intent whose safety contract governs this submission.
+
+        Execution adapters may wrap a call without changing the spend, subnet,
+        or MEV requirements of the operation being dispatched.
+        """
+        return self
+
     # Introspection ----------------------------------------------------------
 
     @classmethod

sdk/python/bittensor/intents/multisig.py

@@ -221,6 +221,65 @@ def summary(self) -> str:
         )
 
 
+@dataclass
+class MultisigIntentAdapter(Intent):
+    """Keep an inner intent's safety contract while dispatching it by multisig.
+
+    Saved-multisig CLI wallets turn a regular coldkey intent into one of the
+    concrete multisig intents above. The concrete intent owns call composition,
+    while ``semantic`` remains authoritative for policy scope and MEV handling.
+    This adapter is internal and deliberately unregistered: it is execution
+    state, not a separate operation exposed by the SDK.
+    """
+
+    op = "multisig_execute"
+    signer = "coldkey"
+
+    dispatch: MultisigExecute | MultisigThreshold1 = field(repr=False)
+    semantic: Intent = field(repr=False)
+
+    @property
+    def threshold(self) -> int:
+        return int(getattr(self.dispatch, "threshold", 1))
+
+    @property
+    def other_signatories(self) -> list:
+        return self.dispatch.other_signatories
+
+    async def build(self, substrate, wallet: Any):
+        return await self.dispatch.build(substrate, wallet)
+
+    def summary(self) -> str:
+        return self.dispatch.summary()
+
+    async def effects(self, substrate, signer_address: str) -> list[str]:
+        return await self.dispatch.effects(substrate, signer_address)
+
+    async def warnings(self, substrate, signer_address: str) -> list[str]:
+        return await self.dispatch.warnings(substrate, signer_address)
+
+    def spend(self):
+        return self.semantic.spend()
+
+    def touches_netuids(self) -> list[int]:
+        return self.semantic.touches_netuids()
+
+    def affects_all_subnets(self) -> bool:
+        return self.semantic.affects_all_subnets()
+
+    def semantic_intent(self) -> Intent:
+        return self.semantic
+
+    def to_dict(self) -> dict[str, Any]:
+        return self.dispatch.to_dict()
+
+
+class MultisigThreshold1IntentAdapter(MultisigIntentAdapter):
+    """Safety-preserving adapter for immediate 1-of-N dispatch."""
+
+    op = "multisig_threshold_1"
+
+
 @register
 @dataclass
 class MultisigApprove(Intent):

sdk/python/bittensor/intents/plan.py

@@ -49,6 +49,7 @@ def check_raw_call(self) -> list[str]:
         return ["raw call submission is disabled by policy (set allow_raw_calls=True)"]
 
     def check(self, intent: Intent, fee: Optional[Balance]) -> list[str]:
+        intent = intent.semantic_intent()
         violations: list[str] = []
         if self.max_fee_tao is not None:
             # A fee cap must not fail open: an unavailable estimate blocks

sdk/python/tests/unit/test_multisig_safety.py

@@ -0,0 +1,94 @@
+"""Safety invariants for automatic saved-multisig intent wrapping."""
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, Mock
+
+import pytest
+
+from bittensor import Policy
+from bittensor.cli import multisig_helpers
+from bittensor.client import Client
+from bittensor.executor import Executor
+from bittensor.intents._money import UNBOUNDED
+from bittensor.intents.multisig import (
+    MultisigThreshold1,
+    MultisigThreshold1IntentAdapter,
+)
+from bittensor.intents.registration import BurnedRegister
+from tests.harness.fake_substrate import FakeSubstrate
+from tests.harness.samples import ALICE, ALICE_HOT, BOB, dev_wallet
+
+
+@pytest.mark.asyncio
+async def test_saved_multisig_preserves_inner_policy_and_mev_contract(monkeypatch):
+    output = Mock()
+    app_ctx = SimpleNamespace(
+        wallet_name="treasury",
+        wallet_path="/unused",
+        wallet_given=True,
+        multisig_wallet_name=None,
+        output=output,
+    )
+    monkeypatch.setattr(multisig_helpers.cfg, "get_multisig", lambda name: {"name": name})
+    monkeypatch.setattr(
+        multisig_helpers,
+        "resolve_multisig_preset",
+        lambda _app_ctx, _preset: (1, [ALICE, BOB], ["alice", "bob"]),
+    )
+    monkeypatch.setattr(
+        multisig_helpers,
+        "pick_local_signatory",
+        lambda _app_ctx, *, preset, signatories: ("alice", ALICE),
+    )
+    semantic = BurnedRegister(netuid=7, hotkey_ss58=ALICE_HOT)
+
+    wrapped = multisig_helpers.wrap_intent_for_multisig_wallet(app_ctx, semantic)
+
+    assert isinstance(wrapped, MultisigThreshold1IntentAdapter)
+    assert wrapped.op == "multisig_threshold_1"
+    assert wrapped.semantic_intent() is semantic
+    assert wrapped.semantic_intent().mev_shield_default is True
+    assert wrapped.semantic_intent().mev_shield_required is True
+    assert wrapped.spend() is UNBOUNDED
+    assert wrapped.touches_netuids() == [7]
+    assert wrapped.affects_all_subnets() is False
+
+    violations = Policy(max_spend_tao=1, allowed_netuids=[1]).check(wrapped, fee=None)
+    assert any("cannot be bounded" in violation for violation in violations)
+    assert any("netuid 7" in violation for violation in violations)
+
+    plan = await Client("local", substrate=FakeSubstrate()).plan(
+        wrapped,
+        dev_wallet(),
+        policy=Policy(max_spend_tao=1, allowed_netuids=[1]),
+    )
+    assert plan.spend is UNBOUNDED
+    assert plan.violations == violations
+
+    assert app_ctx.multisig_wallet_name == "treasury"
+    assert app_ctx.wallet_name == "alice"
+
+
+@pytest.mark.asyncio
+async def test_required_mev_shield_survives_multisig_dispatch():
+    semantic = BurnedRegister(netuid=7, hotkey_ss58=ALICE_HOT)
+    dispatch = MultisigThreshold1(
+        other_signatories=[BOB],
+        call=semantic.to_dict(),
+    )
+    wrapped = MultisigThreshold1IntentAdapter(dispatch=dispatch, semantic=semantic)
+    executor = Executor(Mock())
+    expected = Mock()
+    executor.submit_shielded = AsyncMock(return_value=expected)
+    wallet = Mock()
+
+    result = await executor.execute(wrapped, wallet)
+
+    assert result is expected
+    executor.submit_shielded.assert_awaited_once_with(
+        wrapped,
+        wallet,
+        policy=None,
+        wait_for_inclusion=True,
+        wait_for_finalization=True,
+    )