feat(frost): real-crypto multi-node e2e + pre-merge cgo CI gate (handoff Items 1+2)

[mswilkison]

Pre-production handoff Items 1 and 2, bundled because the CI gate's whole purpose is to run the new e2e (and the gate's require-mode enforcement lives in the e2e's helper file).

Item 1 — real-crypto multi-node e2e

The union of the two half-faked e2es — roast_runner_bus_net_e2e (real runner+transport, fake engine) and roast_real_cgo_interactive_e2e (real engine, no runner/transport). Neither exercises the real-engine ⇄ real-pkg/net-transport ⇄ runner seam together; this does: n runners, each over its own real pkg/net bus, driving the real cgo engine to a real BIP-340 signature in one process (full-included 2-of-2 and t-of-included 3/threshold-2 subset).

• Wiring discovery (no engine change): the Go RFC-21 election seeds on SHA256(dkgGroupPublicKey ‖ sessionID ‖ messageDigest) and the Rust engine on SHA256(keyGroup ‖ …); passing []byte(keyGroup) as the binding's dkgGroupPublicKey makes them agree, so the runner's engine-vs-binding coordinator cross-check — never before run against the real engine — passes.
• Faithful shared-engine boundary surfaced by the seam: one process-global engine ⇒ the per-attempt aggregate idempotency marker lets exactly one seat aggregate the signature; co-resident seats observe interactive_attempt_already_aggregated after completing their full transport. In production each node has its own engine. Asserted precisely (exactly one winner + Succeeded; all others reached aggregate and hit the marker).

Item 2 — pre-merge cgo CI gate

.github/workflows/frost-cgo-integration.yml: checks out the Go branch + a pinned mirror commit (ci/frost-signer-pin.env), builds libfrost_tbtc, verifies exported frost_tbtc_* symbols, and runs the cgo-tagged tests with skips forbidden (KEEP_CORE_FROST_REQUIRE_CGO=true flips skipFrostUnavailable's lib-unavailable skip → fatal). An explicit SHA pin (not the moving tip) makes an engine/bridge drift fail loudly in one reviewed unit instead of silently dropping coverage. -Wl,--no-as-needed retains the DT_NEEDED under the bridge's dlsym(RTLD_DEFAULT) model.

Validation

• Item 1: against the rebuilt lib both tests pass, -race -count=3 clean (exactly one winner, no races), skip without the lib, cgo vet + gofmt clean.
• Item 2: require-mode fails without the lib (was a skip), skips when unset, passes with the lib; workflow YAML parses (7 steps); the verified ABI symbols are present in the built lib.
• A CI workflow can only be fully exercised by running it on a PR — the require-mode mechanism + YAML are locally validated; the job itself runs here.

Deliberately deferred (noted in the handoff)

• Production binary packaging (ship .so alongside keep-client, rpath, fail-closed startup preflight) — release-pipeline / MacLane.
• Structured ABI-version assertion (the current frost_tbtc_version string isn't an ABI contract) — mirror.

CI does not otherwise build the cgo tags; without this gate the path is inert in CI. The gate is the fix.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f0883f24-503a-4a40-b425-b633b926c114

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/frost-realcgo-multinode-e2e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}