feat(tbtc): native signer state-anchor service, trust startup, and bootstrap ceremony (ABI 4.3) - #4199

Open

mswilkison wants to merge 94 commits into

feat/frost-schnorr-migration-scaffoldfrom

codex/frost-preauth-outbox-restored

Commits on Jul 25, 2026

Harden FROST authorization and Bitcoin broadcast recovery
mswilkison
committed
ea3d12e
Implement crash-safe FROST retained-group readiness
mswilkison
committed
27c310c
Bind FROST activation to signer store identity
mswilkison
committed
2dfd96e
wip(tbtc): ABI 3.5 inventory/state-witness consumers and signing readiness

mswilkison
and
claude
committed
11a8629
fix(tbtc)!: require signer ABI 4.0 and pin the v2-transcript lib

mswilkison
and
claude
committed
1928a66
fix(tbtc): harden retained journal persistence paths
mswilkison
committed
521fcd5
Bind FROST activation to historical deployment epochs
mswilkison
committed
adb05d5
fix(tbtc): bind signer readiness to ABI 4.1 state
mswilkison
committed
b534e19
test(tbtc): use secp256k1 retained binding fixture
mswilkison
committed
937aaba
Add authenticated native signer state anchoring
mswilkison
committed
8470083

Commits on Jul 26, 2026

Harden native signer anchor admission and trust startup
mswilkison
committed
1d75161
Reject aggregate memo calls without active owner
mswilkison
committed
0d50f0d
Recover native signer anchor trust transitions at startup

mswilkison
and
claude
committed
d5a429c
Keep legacy wallets off interactive aggregate memo ownership

mswilkison
and
claude
committed
7f5ff27
ci: pin frost signer mirror to the ABI 4.3 trust-transition head

mswilkison
and
claude
committed
f9de3e3
Add native signer anchor bootstrap provisioning ceremony

mswilkison
and
claude
committed
643b2ab
test(tbtc): cover native signer anchor bootstrap provisioning ceremony

mswilkison
and
claude
committed
d3fdb9a

Commits on Jul 27, 2026

Add native signer anchor bootstrap initialize client

mswilkison
and
claude
committed
0c32250
test(tbtc): cover bootstrap initialize client protocol

mswilkison
and
claude
committed
e037450
Keep scaffold-era signer material off retained FROST key-group binding

mswilkison
and
claude
committed
6cc6f5a
test: align tagged FROST suites with anchor barrier and memo ownership

mswilkison
and
claude
committed
1749bfe

Commits on Jul 29, 2026

fix(tbtc): harden FROST activation durability paths
mswilkison
committed
782f9a3
Add manifest-bound retained FROST history source
mswilkison
committed
d73af44
Harden retained FROST history semantics
mswilkison
committed
64deb8e
Bind retained FROST activation transcripts
mswilkison
committed
a3cf577
Cache FROST activation reconciliation asynchronously
mswilkison
committed
126654b
Require quorum certificates for FROST quarantine lifts
mswilkison
committed
1c2727d
Require quorum checkpoints for FROST history
mswilkison
committed
448a36d
Harden FROST checkpoint trust and recovery
mswilkison
committed
e5fffa5
Harden retained history endpoint identity
mswilkison
committed
49b1fbd
Route the primary Ethereum chain through an identity-frozen transport

mswilkison
and
claude
committed
f856d53
fix(tbtc): enforce live activation and history bounds
mswilkison
committed
26a8ef4
fix(tbtc): harden journal and outbox recovery
mswilkison
committed
5186668
fix(tbtc): bind activation signatures to outbox state
mswilkison
committed
2dcabf7
fix(tbtc): preserve FROST liveness during replay
mswilkison
committed
aa77036
test(tbtc): relax WSS timeout watchdog
mswilkison
committed
24254d0
fix(tbtc): reconcile externally broadcast variants
mswilkison
committed
e243bcf
fix(tbtc): harden retained history transport startup
mswilkison
committed
c692248
fix(tbtc): tolerate endpoint availability skew
mswilkison
committed
d416220
feat(tbtc): retained FROST wallet history source and identity-frozen primary transport (#4200)
mswilkison
authored
9e89555
fix(ethereum): share RPC limiter with FROST reads
mswilkison
committed
592e060
fix(tbtc): cache signer readiness during authorization
mswilkison
committed
182b9c9
fix(tbtc): recheck retained journal before signing
mswilkison
committed
5431ea8
fix(tbtc): fail over retained TLS replicas
mswilkison
committed
d33fc50
fix(ethereum): cancel FROST limiter waits
mswilkison
committed
28ce22b
fix(ethereum): make shared limiter context-aware
mswilkison
committed
009c727
fix(tbtc): admit DKG before readiness
mswilkison
committed
7f3f182
fix(tbtc): fail over primary TLS profiles
mswilkison
committed
853e082
fix(bitcoin): add canonical Electrum status
mswilkison
committed
3b7fa2f
fix: reconcile canonical replica observations
mswilkison
committed
eccebb0
fix(tbtc): drain outbox before unlock
mswilkison
committed
8ea4b02
Retire orphaned FROST DKG packages
mswilkison
committed
862db37
Keep FROST signing epoch group-consistent
mswilkison
committed
cde74f0
Preserve unresolved FROST DKG packages
mswilkison
committed
4a4a7cd
Harden FROST DKG package cleanup
mswilkison
committed
338df93
Defer FROST DKG package retirement
mswilkison
committed
cca329d

Commits on Jul 30, 2026

Pin FROST DKG retirement state
mswilkison
committed
7f3aa2d
Protect DKG packages from stale retirement snapshots
mswilkison
committed
410f6a6
Handle legacy and re-included FROST DKG boundaries
mswilkison
committed
60b90cb
fix(tbtc): preserve partially persisted FROST DKG shares

mswilkison
and
claude
committed
692a321
test(tbtc): cover destructive FROST DKG reconciliation paths

mswilkison
and
claude
committed
82e19f4
fix(tbtc): gate FROST signing on quarantine and its own durable advance

mswilkison
and
claude
committed
32b4dbd
fix(tbtc): adopt orphan FROST journal batches without a restart

mswilkison
and
claude
committed
5df61b9
fix(tbtc): bound FROST journal files at write time

mswilkison
and
claude
committed
57e6431
fix(tbtc): match the signer's six-record terminal witness reserve in Go

mswilkison
and
claude
committed
d6c8a46
fix(tbtc): amortize the pre-sign generation reservation over its workflow

mswilkison
and
claude
committed
37b4e36
test(tbtc): cover the guarded HTTPS round trip end to end

mswilkison
and
claude
committed
6a63657
fix(tbtc): surface rejected Bitcoin rebroadcasts during replay

mswilkison
and
claude
committed
a864911
fix(tbtc): retain retained-endpoint peers by separation identity

mswilkison
and
claude
committed
0651412
docs(tbtc): state what binds the cached handshake snapshots

mswilkison
and
claude
committed
957b026
fix(tbtc): reserve the signer's quarantine records in the Go geometry bound

mswilkison
and
claude
committed
1cef89d
ci: pin the signer mirror to the ABI 4.4 retirement head

mswilkison
and
claude
committed
5c4ecd9
ci: compare the witness geometry reservations across languages

mswilkison
and
claude
committed
4f054e8
fix(tbtc): admit the signing window's own advance, and attest live state

mswilkison
and
claude
committed
c9977a3
docs(tbtc): state what the generation reservation does not cover

mswilkison
and
claude
committed
6825402
test(tbtc): cover preserving FROST DKG reconciliation and caller admission

mswilkison
and
claude
committed
adacf55
style(tbtc): gofmt the retained transport test

mswilkison
and
claude
committed
f7fb16d
fix(tbtc): derive the FROST journal file bound and ride out unreachable dependencies

mswilkison
and
claude
committed
fcc4f08

Commits on Jul 31, 2026

fix(frost): stop a transport blip from terminally poisoning the signer anchor

mswilkison
and
claude
committed
b38f8e4
docs(tbtc): document the offline FROST anchor rotation ceremony

mswilkison
and
claude
committed
9083658
fix(tbtc): fail the activation health verdict on a poisoned signer anchor

mswilkison
and
claude
committed
44ad440
fix(tbtc): stop admitting FROST work a poisoned anchor cannot finish

mswilkison
and
claude
committed
1394663
feat(tbtc): make a silently non-signing FROST node visible before activation

mswilkison
and
claude
committed
725e3c0
fix(tbtc): register the anchor admission rejection counters

mswilkison
and
claude
committed
0e4d69f
docs(tbtc): cover the poisoned anchor in the rotation runbook

mswilkison
and
claude
committed
b2f6990
docs(tbtc): name the rollback the anchor actually defends against

mswilkison
and
claude
committed
2fc4da8
fix(tbtc): reserve FROST anchor capacity per input, not per batch

mswilkison
and
claude
committed
c616e86
docs(tbtc): correct the revision cost in the terms table

mswilkison
and
claude
committed
9da4cce
fix(tbtc): align signer health with workload capacity
mswilkison
committed
5247561
fix(tbtc): preserve admitted signing capacity
mswilkison
committed
276f01b
fix(tbtc): classify transient signer dependencies
mswilkison
committed
0ae0cf0
fix(tbtc): bound authorization dependency retries
mswilkison
committed
744fe5e
fix(spv): propagate target wallet lookup failures
mswilkison
committed
02a2840
fix(tbtc): preserve signing wire and DKG recovery
mswilkison
committed
97bb190