feat: adding reconstruction threshold in node

crates/e2e-tests/tests/ckd_verification.rs

@@ -1,4 +1,7 @@
-use crate::common;
+use crate::common::{
+    CKD_PV_VERIFICATION_PORT_SEED, CKD_VERIFICATION_PORT_SEED, must_get_bls_public_key,
+    must_get_domain, must_setup_cluster,
+};
 
 use anyhow::Context;
 use blstrs::{G1Projective, G2Projective, Scalar};
@@ -7,8 +10,7 @@ use group::ff::Field as _;
 use near_account_id::AccountId;
 use near_mpc_contract_interface::types::kdf::derive_app_id;
 use near_mpc_contract_interface::types::{
-    Bls12381G1PublicKey, Bls12381G2PublicKey, CKDAppPublicKey, CKDAppPublicKeyPV, Curve,
-    DomainPurpose,
+    Bls12381G1PublicKey, Bls12381G2PublicKey, CKDAppPublicKey, CKDAppPublicKeyPV, Protocol,
 };
 use rand::SeedableRng;
 use threshold_signatures::confidential_key_derivation::{
@@ -42,20 +44,11 @@ fn verify_ckd(
 #[expect(non_snake_case)]
 async fn ckd_response__passes_cryptographic_verification() {
     // given
-    let (cluster, running) =
-        common::must_setup_cluster(common::CKD_VERIFICATION_PORT_SEED, |_| {}).await;
-
-    let bls_domain = running
-        .domains
-        .domains
-        .iter()
-        .find(|d| {
-            Curve::from(d.protocol) == Curve::Bls12381 && matches!(d.purpose, DomainPurpose::CKD)
-        })
-        .expect("no Bls12381 CKD domain found")
-        .clone();
-
-    let mpc_pk = common::must_get_bls_public_key(&running, bls_domain.id);
+    let (cluster, running) = must_setup_cluster(CKD_VERIFICATION_PORT_SEED, |_| {}).await;
+
+    let bls_domain = must_get_domain(&running, Protocol::ConfidentialKeyDerivation);
+
+    let mpc_pk = must_get_bls_public_key(&running, bls_domain.id);
     let user = cluster.default_user_account().clone();
 
     let mut rng = rand::rngs::StdRng::seed_from_u64(1);
@@ -95,20 +88,11 @@ async fn ckd_response__passes_cryptographic_verification() {
 #[expect(non_snake_case)]
 async fn ckd_pv_response__passes_cryptographic_verification() {
     // given
-    let (cluster, running) =
-        common::must_setup_cluster(common::CKD_PV_VERIFICATION_PORT_SEED, |_| {}).await;
-
-    let bls_domain = running
-        .domains
-        .domains
-        .iter()
-        .find(|d| {
-            Curve::from(d.protocol) == Curve::Bls12381 && matches!(d.purpose, DomainPurpose::CKD)
-        })
-        .expect("no Bls12381 CKD domain found")
-        .clone();
-
-    let mpc_pk = common::must_get_bls_public_key(&running, bls_domain.id);
+    let (cluster, running) = must_setup_cluster(CKD_PV_VERIFICATION_PORT_SEED, |_| {}).await;
+
+    let bls_domain = must_get_domain(&running, Protocol::ConfidentialKeyDerivation);
+
+    let mpc_pk = must_get_bls_public_key(&running, bls_domain.id);
     let user = cluster.default_user_account().clone();
 
     let mut rng = rand::rngs::StdRng::seed_from_u64(2);

crates/e2e-tests/tests/common.rs

@@ -7,8 +7,9 @@ use blstrs::{G1Projective, Scalar};
 use e2e_tests::{CLUSTER_WAIT_TIMEOUT, MpcCluster, MpcClusterConfig, metrics};
 use group::Group;
 use near_mpc_contract_interface::types::{
-    Bls12381G2PublicKey, CKDAppPublicKey, Curve, DomainId, DomainPurpose, ProtocolContractState,
-    PublicKey, PublicKeyExtended, RunningContractState,
+    Bls12381G2PublicKey, CKDAppPublicKey, Curve, DomainConfig, DomainId, DomainPurpose, Protocol,
+    ProtocolContractState, PublicKey, PublicKeyExtended, ReconstructionThreshold,
+    RunningContractState,
 };
 use near_mpc_crypto_types::Bls12381G1PublicKey;
 use serde_json::json;
@@ -37,8 +38,9 @@ pub const CONTRACT_UPGRADE_COMPATIBILITY_TESTNET_PORT_SEED: u16 = 19;
 pub const TIMEOUT_METRIC_PORT_SEED: u16 = 20;
 pub const MIGRATION_BACK_PORT_SEED: u16 = 21;
 pub const SIGTERM_HANDLER_PORT_SEED: u16 = 22;
-pub const UPDATE_PARTICIPANT_URL_PORT_SEED: u16 = 23;
-pub const AVAILABLE_FOREIGN_CHAINS_PORT_SEED: u16 = 24;
+pub const DISTINCT_RECONSTRUCTION_THRESHOLDS_PORT_SEED: u16 = 23;
+pub const UPDATE_PARTICIPANT_URL_PORT_SEED: u16 = 24;
+pub const AVAILABLE_FOREIGN_CHAINS_PORT_SEED: u16 = 25;
 
 /// Start a cluster, wait for Running state and presignatures to buffer.
 ///
@@ -386,6 +388,38 @@ pub fn must_get_bls_public_key(
     }
 }
 
+/// Builds a `DamgardEtAl` signing domain with reconstruction threshold `t`, which needs `2t - 1` signers.
+pub fn damgard_etal_domain(id: u64, t: u64) -> DomainConfig {
+    DomainConfig {
+        id: DomainId(id),
+        protocol: Protocol::DamgardEtAl,
+        reconstruction_threshold: ReconstructionThreshold::new(t),
+        purpose: DomainPurpose::Sign,
+    }
+}
+
+/// Builds a `ConfidentialKeyDerivation` (CKD) domain with reconstruction threshold `t`, which needs `t` signers.
+pub fn ckd_domain(id: u64, t: u64) -> DomainConfig {
+    DomainConfig {
+        id: DomainId(id),
+        protocol: Protocol::ConfidentialKeyDerivation,
+        reconstruction_threshold: ReconstructionThreshold::new(t),
+        purpose: DomainPurpose::CKD,
+    }
+}
+
+/// Returns the first domain running `protocol_type` (the registry allows
+/// duplicates), panicking if absent.
+pub fn must_get_domain(running: &RunningContractState, protocol_type: Protocol) -> DomainConfig {
+    running
+        .domains
+        .domains
+        .iter()
+        .find(|d| d.protocol == protocol_type)
+        .unwrap_or_else(|| panic!("no domain with protocol {protocol_type:?}"))
+        .clone()
+}
+
 /// Send a sign request and assert the network produced a successful response.
 ///
 /// Panics if the request can't be submitted to the contract — the test cannot
@@ -416,6 +450,38 @@ pub async fn send_sign_request(
     Ok(())
 }
 
+/// Sign with every signing domain in `running` (including duplicates), asserting
+/// each request succeeds.
+pub async fn sign_all_domains(
+    cluster: &MpcCluster,
+    running: &RunningContractState,
+    rng: &mut impl rand::Rng,
+) {
+    let sign_domains = running
+        .domains
+        .domains
+        .iter()
+        .filter(|d| d.purpose == DomainPurpose::Sign);
+
+    for domain in sign_domains {
+        let payload = match Curve::from(domain.protocol) {
+            Curve::Edwards25519 => generate_eddsa_payload(rng),
+            _ => generate_ecdsa_payload(rng),
+        };
+        let outcome = cluster
+            .send_sign_request(domain.id, payload, cluster.default_user_account())
+            .await
+            .expect("sign request failed");
+        assert!(
+            outcome.is_success(),
+            "sign request for domain {:?} (protocol {:?}) failed: {:?}",
+            domain.id,
+            domain.protocol,
+            outcome.failure_message()
+        );
+    }
+}
+
 /// Send a CKD request and assert the network produced a successful response.
 ///
 /// Panics if the request can't be submitted to the contract — the test cannot

crates/e2e-tests/tests/distinct_reconstruction_thresholds.rs

@@ -0,0 +1,125 @@
+use crate::common::{
+    DISTINCT_RECONSTRUCTION_THRESHOLDS_PORT_SEED, ckd_domain, damgard_etal_domain,
+    generate_ckd_app_public_key, generate_ecdsa_payload, generate_eddsa_payload, must_get_domain,
+    must_setup_cluster, wait_metric_on_nodes,
+};
+
+use e2e_tests::{CLUSTER_WAIT_TIMEOUT, metrics};
+use near_mpc_contract_interface::types::{
+    DomainConfig, DomainId, DomainPurpose, Protocol, ReconstructionThreshold,
+};
+use rand::SeedableRng;
+
+/// Each domain signs under its own reconstruction threshold, not the governance
+/// threshold. With 6 nodes and 1 killed, Cait-Sith (needs all 6) can no longer sign
+/// while Damgard et al. (`2t - 1 = 5`), CKD (`t = 5`) and Frost (`t = 5`) still can.
+#[tokio::test]
+#[expect(non_snake_case)]
+async fn distinct_reconstruction_thresholds__should_use_per_domain_threshold_when_nodes_are_down() {
+    // Given
+    let mut rng = rand::rngs::StdRng::seed_from_u64(0);
+    let (mut cluster, contract_state) =
+        must_setup_cluster(DISTINCT_RECONSTRUCTION_THRESHOLDS_PORT_SEED, |c| {
+            c.num_nodes = 6;
+            c.initial_participant_indices = (0..6).collect();
+            c.threshold = 6;
+            c.triples_to_buffer = 2;
+            c.presignatures_to_buffer = 2;
+            c.domains = vec![
+                DomainConfig {
+                    id: DomainId(0),
+                    protocol: Protocol::CaitSith,
+                    reconstruction_threshold: ReconstructionThreshold::new(6),
+                    purpose: DomainPurpose::Sign,
+                },
+                damgard_etal_domain(1, 3),
+                ckd_domain(2, 5),
+                DomainConfig {
+                    id: DomainId(3),
+                    protocol: Protocol::Frost,
+                    reconstruction_threshold: ReconstructionThreshold::new(5),
+                    purpose: DomainPurpose::Sign,
+                },
+            ];
+        })
+        .await;
+
+    let caitsith_domain = must_get_domain(&contract_state, Protocol::CaitSith);
+    let damgard_domain = must_get_domain(&contract_state, Protocol::DamgardEtAl);
+    let ckd_domain = must_get_domain(&contract_state, Protocol::ConfidentialKeyDerivation);
+    let frost_domain = must_get_domain(&contract_state, Protocol::Frost);
+
+    // When
+    cluster.kill_nodes(&[5]).expect("failed to kill node 5");
+
+    // Then Damgard et al. (needs 5 signers) still signs.
+    let outcome = cluster
+        .send_sign_request(
+            damgard_domain.id,
+            generate_ecdsa_payload(&mut rng),
+            cluster.default_user_account(),
+        )
+        .await
+        .expect("failed to submit Damgard et al. sign request");
+    assert!(
+        outcome.is_success(),
+        "Damgard et al. sign request failed with 5 of 6 nodes alive: {:?}",
+        outcome.failure_message()
+    );
+
+    // And CKD (its own `t = 5`, not the governance threshold of 6) still derives.
+    let outcome = cluster
+        .send_ckd_request(
+            ckd_domain.id,
+            generate_ckd_app_public_key(&mut rng),
+            cluster.default_user_account(),
+        )
+        .await
+        .expect("failed to submit CKD request");
+    assert!(
+        outcome.is_success(),
+        "CKD request failed with 5 of its 5 required signers alive: {:?}",
+        outcome.failure_message()
+    );
+
+    // And Frost (its own `t = 5`) still signs.
+    let outcome = cluster
+        .send_sign_request(
+            frost_domain.id,
+            generate_eddsa_payload(&mut rng),
+            cluster.default_user_account(),
+        )
+        .await
+        .expect("failed to submit Frost sign request");
+    assert!(
+        outcome.is_success(),
+        "Frost sign request failed with 5 of its 5 required signers alive: {:?}",
+        outcome.failure_message()
+    );
+
+    // And Cait-Sith (needs all 6) is unanswerable. Its request never resolves on
+    // chain, and the yield auto-timeout outlives the JSON-RPC call, so we race the
+    // doomed request against the surviving nodes' timeout counter rather than
+    // awaiting it (see `timeout_metric.rs`).
+    tokio::select! {
+        res = wait_metric_on_nodes(
+            &cluster,
+            &[0, 1, 2, 3, 4],
+            metrics::TIMEOUTS_INDEXED,
+            |v| v >= 1,
+            CLUSTER_WAIT_TIMEOUT,
+        ) => res.unwrap_or_else(|_| panic!(
+            "{} did not reach 1 on the surviving nodes — Cait-Sith request was answered \
+             despite only 5 of its 6 required signers being alive",
+            metrics::TIMEOUTS_INDEXED
+        )),
+        _ = cluster.send_sign_request(
+            caitsith_domain.id,
+            generate_ecdsa_payload(&mut rng),
+            cluster.default_user_account(),
+        ) => panic!(
+            "Cait-Sith sign request returned before the timeout metric — it should be \
+             unanswerable with only 5 of 6 required signers alive"
+        ),
+    }
+}

crates/e2e-tests/tests/e2e.rs

@@ -3,6 +3,7 @@ mod ckd_verification;
 mod cleanup_lagging_node;
 mod common;
 mod contract_upgrade_compatibility;
+mod distinct_reconstruction_thresholds;
 mod foreign_chain_configuration;
 mod foreign_chain_tx_validation;
 mod key_resharing;

crates/e2e-tests/tests/parallel_sign_calls.rs

@@ -7,7 +7,7 @@ use near_mpc_contract_interface::types::{
 };
 use serde_json::json;
 
-/// 9 parallel calls (3 robust ECDSA + 2 ECDSA + 2 EdDSA + 2 CKD) via the test parallel
+/// 9 parallel calls (3 DamgardEtAl + 2 ECDSA + 2 EdDSA + 2 CKD) via the test parallel
 /// contract, against a 6-node / threshold-5 cluster that carries all four signing-scheme
 /// domains. Verifies all calls succeed and both the signature and CKD queues drain.
 #[tokio::test]
@@ -25,12 +25,7 @@ async fn mpc_cluster_should_successfully_process_parallel_requests() {
             c.initial_participant_indices = (0..6).collect();
             c.threshold = 5;
             c.domains = vec![
-                DomainConfig {
-                    id: DomainId(0),
-                    protocol: Protocol::DamgardEtAl,
-                    reconstruction_threshold: ReconstructionThreshold::new(3),
-                    purpose: DomainPurpose::Sign,
-                },
+                common::damgard_etal_domain(0, 3),
                 DomainConfig {
                     id: DomainId(1),
                     protocol: Protocol::CaitSith,