feat(frost): interactive-signing observability counters (handoff §6.3)

[mswilkison]

What

The one genuinely buildable, non-gated item from the handoff's §6 production-integration review. The interactive signing runner surfaces outcomes only via return values — no logs or metrics — so before the coordinated tECDSA→FROST flip there's no operator-visible signal for "is interactive signing working, and is anything failing closed?"

Adds process-wide cumulative counters following the existing roast_retry_metrics.go pattern:

• frost_interactive_signing_success_total / _failure_total — whether the interactive path, once driven, produces signatures or fails on a committed attempt. Emitted at the single executor-entry chokepoint where the drive's (signature, error) outcome is interpreted (the inactive fall-through — both nil — counts as neither).
• frost_interactive_signing_coarse_fallback_refused_total — the flip-safety signal: increments whenever no-coarse-fallback mode (KEEP_CORE_FROST_INTERACTIVE_SIGNING_ONLY) terminally refuses a would-be coarse/legacy signing, at all three feat(frost): no-coarse-fallback mode for coarse-path retirement (default off) #4101 refusal sites (legacy backend, native-backend promotion, FFI adapter). During a staged flip a misconfigured node — interactive-only on but interactive signing not running — shows up here instead of silently failing every attempt.

RegisterInteractiveSigningMetrics mirrors RegisterRoastRetryMetrics; operators wire it at startup (alongside the existing one, when the registration wiring lands). Emitted in every build, stays at zero until the gated interactive path runs — inert by default.

Why this is the only code item here

From the §6 review (verified against code, in FROST_PRODUCTION_HANDOFF.md): §6.1 signer-material is mostly already built (material flows via DKG + persistence; the resolver fail-closed is already tested), §6.2 activation wiring and §6.4 wallet lifecycle are gated (audit/recovery-leaf/MacLane), and the rest of §6.3 is ops/runbooks. Observability is the one un-gated code slice — and it's exactly what the coordinated flip needs.

Validation

Builds across all tag combos; new tests pass (incl. an end-to-end legacy-backend refusal bumping the counter); no regression in backend/executor-entry suites; cgo vet + gofmt clean.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: aeafc290-7175-4018-b09a-b212b94d0428

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/frost-interactive-signing-metrics

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}