Context
PR #4005 (multi-agent review report at agent-docs/reviews/pr-4005/report.md) surfaces that the FROST signer has no working refresh path and no working dealer fallback by deliberate design:
refresh_shares returns EngineError::CryptographicRefreshNotSupported (pkg/tbtc/signer/src/lib.rs:40-44); the variant is recovery_class: terminal (pkg/tbtc/signer/src/errors.rs:130).trigger_emergency_rekey only sets an immutable flag (emergency_rekey_event at pkg/tbtc/signer/src/engine/lifecycle.rs:217-302) — it does not perform a rekey.- The dealer-style
run_dkg was deleted per Decision 6 of the FROST design.
To rotate or recover keys, operators MUST run another distributed DKG end-to-end. If a permissioned operator cohort degrades below the live-DKG threshold (planned maintenance, geopolitical action, infrastructure outage), the wallet is locked until operators can be replaced AND a full DKG re-run completes.
Decision (from gap-inventory.md)
Defer to a separate PR. The CryptographicRefreshNotSupported variant becomes a long-term API contract for #4005; refresh/recovery is a known limitation.
Design options
Two paths are viable; pick one before implementation.
Option A: Share-extension reshare
t-of-n members with the help of k ≥ n-t semi-trusted helpers produce new shares against the same group key without exposing old shares. Known FROST-friendly construction. Restores the refresh-and-recover invariant without full DKG.
Option B: Dealer-mediated refresh with governance
Restricted dealer-mediated refresh: requires f+1 distinct governance-signed approvals per signer's share to recover a degraded set. The dealer is the membership secret itself split via XOR-Shamir across the still-online operators (no single dealer trust).
Acceptance criteria
- Refresh path produces a new share set against the same group key (or a recoverable group key) without full DKG re-run.
- Refresh can recover from a degraded operator set down to
t-of-n (or f+1 approvals for option B).
refresh_shares returns RecoveryClass::Recoverable instead of Terminal.- External audit coverage (or threat-model analysis) for the chosen construction.
- Migration guide for operators: how to invoke refresh, expected runtime, governance requirements.
Related
Context
PR #4005 (multi-agent review report at
agent-docs/reviews/pr-4005/report.md) surfaces that the FROST signer has no working refresh path and no working dealer fallback by deliberate design:refresh_sharesreturnsEngineError::CryptographicRefreshNotSupported(pkg/tbtc/signer/src/lib.rs:40-44); the variant isrecovery_class: terminal(pkg/tbtc/signer/src/errors.rs:130).trigger_emergency_rekeyonly sets an immutable flag (emergency_rekey_eventatpkg/tbtc/signer/src/engine/lifecycle.rs:217-302) — it does not perform a rekey.run_dkgwas deleted per Decision 6 of the FROST design.To rotate or recover keys, operators MUST run another distributed DKG end-to-end. If a permissioned operator cohort degrades below the live-DKG threshold (planned maintenance, geopolitical action, infrastructure outage), the wallet is locked until operators can be replaced AND a full DKG re-run completes.
Decision (from gap-inventory.md)
Defer to a separate PR. The
CryptographicRefreshNotSupportedvariant becomes a long-term API contract for #4005; refresh/recovery is a known limitation.Design options
Two paths are viable; pick one before implementation.
Option A: Share-extension reshare
t-of-nmembers with the help ofk ≥ n-tsemi-trusted helpers produce new shares against the same group key without exposing old shares. Known FROST-friendly construction. Restores the refresh-and-recover invariant without full DKG.Option B: Dealer-mediated refresh with governance
Restricted dealer-mediated refresh: requires
f+1distinct governance-signed approvals per signer's share to recover a degraded set. The dealer is the membership secret itself split via XOR-Shamir across the still-online operators (no single dealer trust).Acceptance criteria
t-of-n(orf+1approvals for option B).refresh_sharesreturnsRecoveryClass::Recoverableinstead ofTerminal.Related
agent-docs/gap-inventory.mdDecision 3agent-docs/reviews/pr-4005/raw/contrarian.md(P0 finding)docs/roast-phase-4-liveness-policy-recovery.md