dkg: fail fast on peer restart or death during ceremonies

[pinebit]

Makes DKG ceremonies fail fast with actionable errors when a peer restarts or dies mid-ceremony, instead of hanging forever.

• The sync server treats a peer step regression as a fatal peer restart: it aborts the local ceremony and rejects the restarted peer via the existing response error field, so both sides exit with an error instructing all operators to restart the ceremony together. Wire compatible, no new message fields.
• startSyncProtocol records the first fatal sync failure; RunProtocol and Run return it instead of a generic context cancellation.
• Pedersen collection points (node pubkeys, validator pubkey shares) time out after the configured DKG timeout with an error naming the missing peers, and collect exactly one message per expected peer (duplicates and unexpected senders are ignored).
• The lock signature exchange times out instead of blocking on the context forever.
• The final shutdown sync is bounded so a peer dying after the last step cannot hang the process.
• The pedersen board drops duplicate bundle re-deliveries (kyber evicts a dealer on duplicates), logs complaint responses on send and receive, and stops kyber FastSync protocol goroutines on abort by closing forwarded board channels. No kyber changes.
• Documents ceremony interruption recovery in docs/dkg.md.

New integration tests reproduce the production incident: a chained replace-operator ceremony where a peer restarts mid-DKG (previously the restarted peer looped in connect churn and all other peers hung forever), and a ceremony where a peer dies without restarting.

category: refactor
ticket: none

[codecov]

Codecov Report

❌ Patch coverage is 84.32432% with 29 lines in your changes missing coverage. Please review.
✅ Project coverage is 57.79%. Comparing base (6054bcb) to head (22ef6e5).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
dkg/dkg.go	70.21%	12 Missing and 2 partials ⚠️
dkg/pedersen/board.go	87.50%	8 Missing and 1 partial ⚠️
dkg/pedersen/reshare.go	0.00%	2 Missing ⚠️
dkg/protocol.go	75.00%	2 Missing ⚠️
dkg/sync/server.go	75.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4616      +/-   ##
==========================================
+ Coverage   57.56%   57.79%   +0.22%     
==========================================
  Files         246      246              
  Lines       33707    33993     +286     
==========================================
+ Hits        19405    19646     +241     
- Misses      11855    11887      +32     
- Partials     2447     2460      +13     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR improves DKG ceremony robustness by failing fast (with actionable errors) when peers restart or die mid-ceremony, replacing several “hang forever” failure modes with bounded timeouts and abort paths.

Changes:

• Sync protocol now detects and propagates fatal sync failures so DKG returns actionable errors instead of generic context cancellations.
• Pedersen DKG message collection now enforces per-peer dedup/expectations with a bounded timeout and clearer missing-peer reporting; Pedersen board adds bundle dedup + shutdown behavior to avoid kyber goroutine leaks.
• Lock signature exchange and final shutdown synchronization are now time-bounded; new integration tests reproduce peer-restart and peer-death incidents; docs updated with recovery guidance.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
docs/dkg.md	Documents expected behavior and recovery steps for ceremony interruptions/restarts.
dkg/sync/sync_test.go	Adds a unit test ensuring restarted peers are rejected promptly with actionable errors.
dkg/sync/server.go	Implements peer restart detection and server-side abort signaling (see review comment re: regression-only handling).
dkg/protocol.go	Plumbs fatal sync errors through RunProtocol to return actionable failures.
dkg/protocol_restart_test.go	Adds integration tests reproducing restart/death incidents to ensure fail-fast behavior.
dkg/pedersen/reshare.go	Updates validator pubkey share collection to use bounded, per-peer collection semantics.
dkg/pedersen/dkg.go	Implements bounded per-peer collection with dedup/unexpected-sender handling and missing-peer reporting.
dkg/pedersen/dkg_internal_test.go	Adds unit tests for collection semantics, forwarder shutdown behavior, and duplicate bundle dropping.
dkg/pedersen/config.go	Adds peer ID enumeration and derives a collection timeout from phase duration.
dkg/pedersen/board.go	Adds bundle dedup, complaint logging, and forwarders that close kyber-facing channels on abort.
dkg/exchanger.go	Adds an explicit timeout to signature exchange to avoid blocking indefinitely.
dkg/exchanger_internal_test.go	Adds a unit test asserting signature exchange times out when peers don’t respond.
dkg/dkg.go	Records/returns fatal sync errors, bounds shutdown sync, and wires fatal error propagation into DKG flow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud