fix(tbtc/signer): bound interactive session persistence#4157
Merged
mswilkison merged 10 commits intoJul 15, 2026
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Jul 14, 2026
## Stack Rust signer review-fix stack 3 of 3. - Depends on: #4158, which depends on #4157 - Ultimate base: `extraction/frost-signer-mirror-2026-05-26` (#4005) Merge #4157 and #4158 first, then retarget this PR down the stack. ## What changed - Serialize the complete first fallible state load and migration behind a dedicated process-local initialization mutex. - Double-check the OnceLock after acquiring the initializer mutex so concurrent first callers invoke the loader and any in-place migration only once. - Keep the initializer separate from `STATE_FILE_LOCK`, avoiding lock-order recursion when the loader resolves the active state path. - Recover the initializer token after mutex poisoning and leave the OnceLock unset after load errors so later calls can retry. - Add deterministic concurrency and failure-retry regressions against the same helper used by production `state()`. ## Review finding addressed - P2: serialize first-time state loading and migration. ## Verification - `cargo fmt --manifest-path pkg/tbtc/signer/Cargo.toml -- --check` - `cargo check --locked --manifest-path pkg/tbtc/signer/Cargo.toml --all-targets` - `cargo clippy --locked --manifest-path pkg/tbtc/signer/Cargo.toml --all-targets -- -D warnings` - `cargo test --locked --manifest-path pkg/tbtc/signer/Cargo.toml` (263 passed, 1 ignored; the ignored multiprocess helper passes in its child process; 28 binary and 1 integration test passed) - `cargo test --locked --manifest-path pkg/tbtc/signer/Cargo.toml formal_verification_` - `pkg/tbtc/signer/scripts/run_phase5_chaos_suite.sh` (all 6 scenarios passed) - `git diff --check` CI is authoritative for the TLA+ model and dependency-audit gates.
## Stack Rust signer review-fix stack 2 of 3. - Depends on: #4157 - Ultimate base: `extraction/frost-signer-mirror-2026-05-26` (#4005) - Follow-up: #4159 — startup load serialization Merge #4157 first, then retarget this PR to the extraction branch. ## What changed - Introduce a transparent `SecretHex` holder backed by `Zeroizing<String>` with redacted Debug output and zeroize-on-drop semantics. - Use it for DKG secret packages, confidential round-2 packages, and the long-lived native FROST key package signing share. - Preserve the existing JSON string wire shape and FFI ABI while avoiding independent unwiped Rust-owned secret string allocations. - Continue wiping decoded and serialized byte buffers and returned FFI buffers through their existing paths. ## Review finding addressed - P2: treat DKG package fields as secret-bearing types. Caller-owned FFI request memory remains the caller responsibility; Rust-owned request/result allocations and returned buffers now have explicit wipe paths. ## Verification - `cargo fmt --manifest-path pkg/tbtc/signer/Cargo.toml -- --check` - `cargo check --locked --manifest-path pkg/tbtc/signer/Cargo.toml --all-targets` - `cargo clippy --locked --manifest-path pkg/tbtc/signer/Cargo.toml --all-targets -- -D warnings` - DKG serde, Debug-redaction, zeroize-on-drop, distributed-DKG persistence, and FFI round-trip tests - `cargo test --locked --manifest-path pkg/tbtc/signer/Cargo.toml` - `git diff --check` The TLA+ runner and `cargo-deny` are unavailable locally; CI remains authoritative for those gates.
mswilkison
merged commit Jul 15, 2026
1ef344c
into
extraction/frost-signer-mirror-2026-05-26
19 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack
Rust signer review-fix stack 1 of 3.
extraction/frost-signer-mirror-2026-05-26(feat(tbtc/signer): Rust FROST/ROAST signer (distributed DKG, interactive-only signing, FFI ABI 2.0) #4005)What changed
TBTC_SIGNER_MAX_SESSIONSlimit.Review findings addressed
Retired per-message tombstones use only the unoccupied portion of the shared legacy-compatible total session budget. Live wallet/DKG sessions are never classified as retireable.
Verification
cargo fmt --manifest-path pkg/tbtc/signer/Cargo.toml -- --checkcargo check --locked --manifest-path pkg/tbtc/signer/Cargo.toml --all-targetscargo clippy --locked --manifest-path pkg/tbtc/signer/Cargo.toml --all-targets -- -D warningscargo test --locked --manifest-path pkg/tbtc/signer/Cargo.toml(259 passed, 1 ignored; the ignored multiprocess helper passes in its child process; 28 binary and 1 integration test passed)cargo test --locked --manifest-path pkg/tbtc/signer/Cargo.toml formal_verification_pkg/tbtc/signer/scripts/run_phase5_chaos_suite.sh(all 6 scenarios passed)git diff --checkCI is authoritative for the TLA+ model and dependency-audit gates.