feat(tbtc): native signer state-anchor service, trust startup, and bootstrap ceremony (ABI 4.3)

.github/workflows/frost-cgo-integration.yml

@@ -76,6 +76,49 @@ jobs:
           test -f "$lib" || { echo "libfrost_tbtc.so not found at $lib"; exit 1; }
           echo "FROST_LIB_DIR=${CARGO_TARGET_DIR}/debug" >> "$GITHUB_ENV"
 
+      - name: Verify the witness geometry reservations agree across languages
+        run: |
+          set -euo pipefail
+          # The Go validators mint and pre-verify the offline-authority-signed trust
+          # certificates, so a geometry Go accepts must be exactly a geometry the signer
+          # accepts. Go cannot see the crate (it lives on the mirror branch), so its own
+          # test can only pin its own constants - it cannot notice the signer moving.
+          # This job can: it has the pinned crate checked out, so it compares the two
+          # sources directly. A reservation raised in Rust fails HERE, in the same gate
+          # that builds the pinned library, instead of surfacing after an operator has
+          # already run the offline signing ceremony against a geometry the node rejects.
+          rust_const() {
+            grep -oE "pub\(crate\) const $1: usize = [0-9]+" \
+              _signer-mirror/pkg/tbtc/signer/src/engine/store.rs \
+              | grep -oE '[0-9]+$'
+          }
+          go_const() {
+            grep -oE "$1 uint64 = [0-9]+" \
+              pkg/frost/signing/native_tbtc_signer_state_anchor_trust.go \
+              | grep -oE '[0-9]+$'
+          }
+          mismatch=0
+          check() {
+            rust_value="$(rust_const "$1" || true)"
+            go_value="$(go_const "$2" || true)"
+            if [ -z "$rust_value" ] || [ -z "$go_value" ]; then
+              echo "could not read $1 (rust) / $2 (go); a constant was renamed"
+              mismatch=1
+              return
+            fi
+            if [ "$rust_value" != "$go_value" ]; then
+              echo "witness geometry drift: $1 is [$rust_value] but $2 is [$go_value]"
+              mismatch=1
+            fi
+          }
+          check TBTC_SIGNER_STATE_WITNESS_ROTATION_TERMINAL_RECORD_RESERVATION \
+            NativeTBTCSignerStateWitnessRotationTerminalRecordReservation
+          check TBTC_SIGNER_STATE_WITNESS_QUARANTINE_RECORD_RESERVATION \
+            NativeTBTCSignerStateWitnessQuarantineRecordReservation
+          test "$mismatch" -eq 0 || {
+            echo "update the Go reservation constants and their validator in the same change"
+            exit 1; }
+
       - name: Verify the engine ABI symbols are exported
         run: |
           set -euo pipefail
@@ -86,13 +129,23 @@ jobs:
           missing=0
           for sym in \
             frost_tbtc_persist_distributed_dkg_key_package \
+            frost_tbtc_retire_distributed_dkg_key_packages \
             frost_tbtc_dkg_part1 \
             frost_tbtc_derive_interactive_attempt_context \
             frost_tbtc_interactive_session_open \
             frost_tbtc_interactive_session_abort \
             frost_tbtc_new_signing_package \
             frost_tbtc_interactive_aggregate \
             frost_tbtc_verify_signature_share \
+            frost_tbtc_durable_store_identity \
+            frost_tbtc_retained_key_package_inventory \
+            frost_tbtc_state_witness_proof \
+            frost_tbtc_state_witness_tip \
+            frost_tbtc_state_anchor_trust_head \
+            frost_tbtc_transition_state_witness_anchor \
+            frost_tbtc_state_anchor_bootstrap_facts \
+            frost_tbtc_acknowledge_state_witness_checkpoint \
+            frost_tbtc_recover_state_witness_checkpoint \
             frost_tbtc_version \
             frost_tbtc_abi_version; do
             if ! nm -D --defined-only "$lib" | grep -q " ${sym}$"; then

ci/frost-signer-pin.env

@@ -15,4 +15,4 @@
 #
 # After the scaffold and mirror branches merge into one, replace the cross-branch
 # checkout with an in-tree cargo build and retire this pin (keep the gate).
-FROST_SIGNER_MIRROR_REF=6e0fa9741ffb6b0bb5603eabe26fb4cc1b13ecd9
+FROST_SIGNER_MIRROR_REF=08b6d6f40027016101f32c1ffc509fde4746d0a2

cmd/cmd.go

@@ -37,6 +37,7 @@ func init() {
 		EthereumCommand,
 		MaintainerCommand,
 		MaintainerCliCommand,
+		TBTCSignerCommand,
 	)
 }
 

cmd/start.go

@@ -65,11 +65,64 @@ Environment variables:
 func start(cmd *cobra.Command) error {
 	ctx := context.Background()
 
-	beaconChain, tbtcChain, blockCounter, signing, operatorPrivateKey, err :=
-		ethereum.Connect(ctx, clientConfig.Ethereum)
+	var primaryEthereumTransport *tbtc.FrostPrimaryEthereumTransport
+	var err error
+	if clientConfig.Tbtc.EnableFrostPreSignAuthorization &&
+		!clientConfig.LibP2P.Bootstrap {
+		historyConfig := clientConfig.Tbtc.FrostRetainedGroupHistory
+		primaryEthereumTransport, err =
+			tbtc.NewFrostPrimaryEthereumTransport(
+				ctx,
+				tbtc.FrostPrimaryEthereumTransportConfig{
+					URL:            clientConfig.Ethereum.URL,
+					RequestTimeout: historyConfig.RequestTimeout,
+					TLSRootCAs:     historyConfig.PrimaryTLSRootCAs,
+					Resolver:       historyConfig.Resolver,
+				},
+			)
+		if err != nil {
+			return fmt.Errorf(
+				"cannot initialize guarded primary Ethereum transport: [%w]",
+				err,
+			)
+		}
+	}
+
+	var (
+		beaconChain        *ethereum.BeaconChain
+		tbtcChain          *ethereum.TbtcChain
+		blockCounter       chain.BlockCounter
+		signing            chain.Signing
+		operatorPrivateKey *operator.PrivateKey
+	)
+	if primaryEthereumTransport != nil {
+		beaconChain,
+			tbtcChain,
+			blockCounter,
+			signing,
+			operatorPrivateKey,
+			err = ethereum.ConnectWithClient(
+			ctx,
+			clientConfig.Ethereum,
+			primaryEthereumTransport.Client(),
+		)
+	} else {
+		beaconChain,
+			tbtcChain,
+			blockCounter,
+			signing,
+			operatorPrivateKey,
+			err = ethereum.Connect(ctx, clientConfig.Ethereum)
+	}
 	if err != nil {
+		if primaryEthereumTransport != nil {
+			primaryEthereumTransport.Close()
+		}
 		return fmt.Errorf("error connecting to Ethereum node: [%v]", err)
 	}
+	if primaryEthereumTransport != nil {
+		defer primaryEthereumTransport.Close()
+	}
 
 	netProvider, err := initializeNetwork(
 		ctx,
@@ -162,6 +215,25 @@ func start(cmd *cobra.Command) error {
 			btcChain,
 		)
 
+		var retainedGroupHistorySource interface{ Close() }
+		if clientConfig.Tbtc.EnableFrostPreSignAuthorization {
+			source, err := tbtc.NewFrostRetainedGroupHistorySource(
+				ctx,
+				clientConfig.Tbtc.FrostRetainedGroupHistory,
+				primaryEthereumTransport,
+				primaryEthereumTransport.ChainID(),
+			)
+			if err != nil {
+				return fmt.Errorf(
+					"cannot initialize independent FROST retained-group history source: [%w]",
+					err,
+				)
+			}
+			retainedGroupHistorySource = source
+			defer retainedGroupHistorySource.Close()
+			clientConfig.Tbtc.FrostRetainedGroupHistorySource = source
+		}
+
 		err = tbtc.Initialize(
 			ctx,
 			tbtcChain,