[vietddude]

Summary

• Nodes sign every keygen, signing and reshare result event with their identity key (node_id + result_signature).
• The client verifies the signature against known node public keys (NodeKeyLookup) and rejects unsigned or tampered results.
• With RequiredNodeSignatures set to t+1, the client delivers a result only after t+1 distinct nodes report the same outcome. Each operation triggers the callback exactly once.
• Result idempotent keys now include the node ID, so JetStream no longer drops the other nodes' copies.
• Reshare results carry session_id and are grouped per session. The required count for a reshare is the new committee's threshold + 1.

Testing

• Unit tests for signing/verifying results and for the aggregator (go test -race ./pkg/client ./pkg/event).
• Full e2e suite (keygen, reshare, signing) passes with RequiredNodeSignatures = mpc_threshold + 1. The e2e tests now fail if any error result is received.

Known limitations

• An error reported by only one node is delivered after the 15s aggregation timeout instead of immediately.
• The per-session reshare threshold is only known to the client that sent the reshare. Another client receiving the result falls back to the old t+1, so a reshare to a smaller committee can report ERROR_INSUFFICIENT_NODE_SIGNATURES there.
• On macOS, e2e/setup_test_identities.sh needs GNU sed, and the tests need GOWORK=off when run inside the workspace.

[sonarqubecloud]

Quality Gate failed

Failed conditions
3.6% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud