Seems like we only need a new form of txid that can be used to make sure that a previously issued transaction made it into the blockchain. I propose:
sha256([prevout,vout],...,[address,amount],...)
It identifies the tx based on the unique set of inputs and outputs.
Normal clients have no need to implement this, only services issuing automated transactions. Just log the normal txid given to the client, and the new unique txid. If a transaction matching the unique txid is in the blockchain, deny duplicate withdrawal.
The proposed BIP (
https://gist.github.com/sipa/8907691) seems a little far reaching and hard to implement. Any malleability that would require access to the private key is a non-issue.
