Run DKG on main chain

contracts/scripts/abigen_dkg.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+#
+# Generate Go bindings for the DKGContract and ECIESKeyRegistry contracts.
+#
+# The contracts live in the top-level foundry-based contracts repo
+# (../../../contracts relative to this script). We build them with forge and
+# then run abigen against the resulting artifacts, producing a single
+# binding_dkg.abigen.gen.go file in the contract package.
+
+set -Eeuo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+CONTRACTS_DIR="$(cd "$SCRIPT_DIR/../../../contracts" && pwd)"
+OUT_GO="$(cd "$SCRIPT_DIR/../../rolling-shutter/contract" && pwd)/binding_dkg.abigen.gen.go"
+
+(cd "$CONTRACTS_DIR" && forge build --offline)
+
+TMP_COMBINED="$(mktemp --suffix=.json)"
+trap 'rm -f "$TMP_COMBINED"' EXIT
+
+jq -n \
+    --slurpfile dkg "$CONTRACTS_DIR/out/DKGContract.sol/DKGContract.json" \
+    --slurpfile ecies "$CONTRACTS_DIR/out/ECIESKeyRegistry.sol/ECIESKeyRegistry.json" \
+'{
+  contracts: {
+    "src/common/DKGContract.sol:DKGContract": {
+      abi: ($dkg[0].abi | tostring),
+      bin: $dkg[0].bytecode.object,
+      "bin-runtime": $dkg[0].deployedBytecode.object,
+      userdoc: "{}",
+      devdoc: "{}"
+    },
+    "src/common/ECIESKeyRegistry.sol:ECIESKeyRegistry": {
+      abi: ($ecies[0].abi | tostring),
+      bin: $ecies[0].bytecode.object,
+      "bin-runtime": $ecies[0].deployedBytecode.object,
+      userdoc: "{}",
+      devdoc: "{}"
+    }
+  },
+  version: "foundry"
+}' > "$TMP_COMBINED"
+
+abigen \
+    --combined-json "$TMP_COMBINED" \
+    --pkg contract \
+    --out "$OUT_GO"

mise-test-setup/README.md

@@ -1,7 +1,7 @@
 # Mise Test Setup
 
 `mise test setup` is a local mise-driven setup for running the shutter service
-flow with Ethereum, shuttermint, keypers, and supporting infrastructure.
+flow with Ethereum, keypers, and supporting infrastructure.
 
 For the normal happy path, the two main commands are:
 
@@ -21,14 +21,13 @@ mise run test-decryption
 
   - Add a new keyper set on-chain for the selected keypers.
 
-- `mise run wait-for-dkg --keyper-set-index 2`
+- `mise run wait-for-dkg --ksi 2 --success`
 
-  - Wait until a given keyper set finishes DKG successfully.
-
-- `mise run wait-for-dkg --eon 5`
-
-  - Wait until a specific DKG finishes. This exits with a nonzero status if that
-    eon completes with failure.
+  - Wait until the DKG for a given Keyper Set Index succeeds on-chain. Without
+    `--ksi`, defaults to the latest registered keyper set. Without `--success`
+    / `--failure`, exits 0 on any completion. With `--retry N`, pins the watch
+    to a specific retry counter; with `--success`/`--failure`, asserts that
+    retry's outcome.
 
 - `mise run test-decryption`
 
@@ -58,9 +57,6 @@ can still run them directly if you want to test specific parts of the system:
 - `up-ethereum`
 - `deploy`
 - `gen-keyper-configs`
-- `init-chain-seed`
-- `init-chain-nodes`
-- `patch-genesis`
 - `init-keyper-dbs`
 - `up`
 - `down`
@@ -72,14 +68,6 @@ Dependency flow for `wait-for-initial-dkg`:
 ```text
 - `wait-for-initial-dkg`
   - `up`
-    - `patch-genesis`
-      - `init-chain-nodes`
-        - `init-chain-seed`
-          - `gen-compose`
-        - `gen-keyper-configs`
-          - `deploy`
-            - `up-ethereum`
-              - `gen-compose`
     - `init-keyper-dbs`
       - `up-db`
         - `gen-compose`

mise-test-setup/compose.common.yml

@@ -34,21 +34,6 @@ services:
       timeout: 1s
       retries: 30
 
-  chain-seed:
-    image: rolling-shutter
-    entrypoint: /rolling-shutter
-    command:
-      - chain
-      - --config
-      - /chain/config/config.toml
-    volumes:
-      - ${DATA_DIR}/chain-seed:/chain
-    healthcheck:
-      test: curl -sf http://127.0.0.1:26657/status >/dev/null
-      interval: 1s
-      timeout: 1s
-      retries: 10
-
   bootnode:
     image: rolling-shutter
     entrypoint: /rolling-shutter

mise-test-setup/compose.keypers.yml.j2

@@ -1,20 +1,3 @@
-x-chain-base: &chain_base
-  image: rolling-shutter
-  entrypoint:
-    - /rolling-shutter
-  command:
-    - chain
-    - --config
-    - /chain/config/config.toml
-  healthcheck:
-    test: curl -sf http://127.0.0.1:26657/status >/dev/null
-    interval: 1s
-    timeout: 1s
-    retries: 10
-  depends_on:
-    chain-seed:
-      condition: service_healthy
-
 x-keyper-base: &keyper_base
   image: rolling-shutter
   entrypoint:
@@ -26,18 +9,11 @@ x-keyper-base: &keyper_base
 
 services:
     {%- for i in range(num_keypers|int) %}
-    chain-{{ i }}:
-        <<: *chain_base
-        volumes:
-        - ../${DATA_DIR}/chain-{{ i }}/:/chain
-
     keyper-{{ i }}:
         <<: *keyper_base
         depends_on:
           bootnode:
             condition: service_started
-          chain-{{ i }}:
-            condition: service_healthy
         volumes:
         - ../${DATA_DIR}/keyper-{{ i }}.toml:/config.toml
     {%- if not loop.last %}

mise-test-setup/compose.yml.j2

@@ -1,4 +1,3 @@
 include:
   - ../compose.common.yml
-  - ./compose.keypers.yml
-  - ../compose.{{ deployment_type }}.yml
+  - ./compose.keypers.yml

mise-test-setup/e2e-tests/mise-tasks/e2e_utils.py

@@ -0,0 +1,72 @@
+"""Shared helpers for DKG e2e tests.
+
+Importable from `mise run` task scripts in this directory: the file is colocated
+with the task scripts, so uv adds its directory to sys.path automatically.
+
+Both helpers delegate to `mise run wait-for-dkg`, which polls the DKG Contract
+directly. They wrap the subprocess in a timeout so that a hung DKG fails the
+e2e test promptly rather than blocking the whole suite.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+
+_PARENT_TASKS_DIR = Path(__file__).resolve().parents[2] / "mise-tasks"
+if str(_PARENT_TASKS_DIR) not in sys.path:
+    sys.path.insert(0, str(_PARENT_TASKS_DIR))
+
+import utils  # noqa: E402  (re-exported for test scripts)
+
+
+DEFAULT_SUCCESS_TIMEOUT = 120.0
+DEFAULT_FAILURE_TIMEOUT = 240.0
+
+
+def wait_for_dkg_success(
+    *,
+    keyper_set_index: int,
+    timeout: float = DEFAULT_SUCCESS_TIMEOUT,
+) -> None:
+    """Wait for `succeeded(keyper_set_index)` on the DKG Contract."""
+    cmd = [
+        "mise", "run", "wait-for-dkg",
+        "--ksi", str(keyper_set_index),
+        "--success",
+    ]
+    try:
+        subprocess.run(cmd, check=True, timeout=timeout)
+    except subprocess.TimeoutExpired:
+        raise SystemExit(
+            f"Timed out after {timeout:.0f}s waiting for DKG success "
+            f"for keyper set {keyper_set_index}"
+        )
+
+
+def wait_for_dkg_failure(
+    *,
+    keyper_set_index: int,
+    retry_counter: int = 0,
+    timeout: float = DEFAULT_FAILURE_TIMEOUT,
+) -> None:
+    """Wait for the (keyper_set_index, retry_counter) cycle to elapse without success.
+
+    Raises SystemExit if the DKG unexpectedly succeeded or on timeout.
+    """
+    cmd = [
+        "mise", "run", "wait-for-dkg",
+        "--ksi", str(keyper_set_index),
+        "--retry", str(retry_counter),
+        "--failure",
+    ]
+    try:
+        subprocess.run(cmd, check=True, timeout=timeout)
+    except subprocess.TimeoutExpired:
+        raise SystemExit(
+            f"Timed out after {timeout:.0f}s waiting for DKG failure "
+            f"for keyper set {keyper_set_index} retry {retry_counter}"
+        )

mise-test-setup/e2e-tests/mise-tasks/test

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#MISE description="Run all DKG e2e tests in sequence (happy path, then offline recovery)"
+#MISE depends=["test-dkg-happy-path", "test-dkg-offline-recovery"]
+
+# Sequential execution and fail-fast are enforced by `jobs = 1` in the
+# sibling mise.toml; each depended-on test also calls `mise run clean` at
+# startup, so no cleanup between them is needed.
+echo "all DKG e2e tests passed"

mise-test-setup/e2e-tests/mise-tasks/test-dkg-happy-path

@@ -0,0 +1,37 @@
+#!/usr/bin/env -S uv run --script
+#MISE description="DKG e2e: initial set + three keyper-set transitions, with decryption after each"
+#MISE env={NUM_KEYPERS = "6", INITIAL_KEYPER_SET_INDICES = "0,1,2", INITIAL_THRESHOLD = "2"}
+
+import os
+
+from e2e_utils import utils, wait_for_dkg_success
+
+
+def add_set_and_verify(
+    indices: str, threshold: str, keyper_set_index: int, keyper_index: int = 0
+) -> None:
+    utils.run(["mise", "run", "add-keyper-set", "--indices", indices, "--threshold", threshold])
+    wait_for_dkg_success(keyper_set_index=keyper_set_index)
+    utils.run(["mise", "run", "check-dkg", "--ksi", str(keyper_set_index)])
+    cmd = ["mise", "run", "test-decryption"]
+    if keyper_index != 0:
+        cmd += ["--keyper-index", str(keyper_index)]
+    utils.run(cmd)
+
+
+utils.run(["mise", "run", "clean"])
+utils.run(["mise", "run", "fund-keypers"])
+
+# Keyper set 1 (initial): 0,1,2 / threshold 2.
+utils.run(["mise", "run", "wait-for-initial-dkg"])
+utils.run(["mise", "run", "check-dkg", "--ksi", "1"])
+utils.run(["mise", "run", "test-decryption"])
+
+# Keyper set 2: grow to 0,1,2,3 / threshold 3.
+add_set_and_verify("0,1,2,3", "3", 2)
+
+# Keyper set 3: zero-overlap replacement 3,4,5 / threshold 2.
+add_set_and_verify("3,4,5", "2", 3, keyper_index=3)
+
+# Keyper set 4: return to original 0,1,2 / threshold 2.
+add_set_and_verify("0,1,2", "2", 4)

mise-test-setup/e2e-tests/mise-tasks/test-dkg-offline-recovery

@@ -0,0 +1,31 @@
+#!/usr/bin/env -S uv run --script
+#MISE description="DKG e2e: DKG fails below threshold, then succeeds once a third keyper comes online"
+#MISE env={NUM_KEYPERS = "4", INITIAL_KEYPER_SET_INDICES = "0,1,2,3", INITIAL_THRESHOLD = "2"}
+
+from e2e_utils import utils, wait_for_dkg_failure, wait_for_dkg_success
+
+
+utils.run(["mise", "run", "clean"])
+utils.run(["mise", "run", "fund-keypers"])
+
+# Bootstrap: 2-of-4 initial DKG succeeds. This also establishes a previous
+# keyper set with threshold 2, which gates the next config vote.
+utils.run(["mise", "run", "wait-for-initial-dkg"])
+
+# Stop keypers 2 and 3 before adding the 3-of-4 set.
+# The new set's config vote only needs 2 votes (previous threshold),
+# so keypers 0 and 1 can push it through despite the higher new threshold.
+utils.run(["docker", "compose", "stop", "keyper-2", "keyper-3"])
+
+utils.run(["mise", "run", "add-keyper-set", "--indices", "0,1,2,3", "--threshold", "3"])
+
+# Only 2 of 3 required keypers online → DKG must fail.
+wait_for_dkg_failure(keyper_set_index=2)
+
+# Bring keyper-2 online to reach threshold; the keyper logic retries DKG.
+utils.run(["docker", "compose", "up", "-d", "keyper-2"])
+
+# Use keyper_set_index=2 to avoid a false positive from eon 1's success row.
+wait_for_dkg_success(keyper_set_index=2)
+
+utils.run(["mise", "run", "test-decryption"])

mise-test-setup/e2e-tests/mise.toml

@@ -0,0 +1,20 @@
+# DKG e2e tests harness. Env vars and parent tasks (e.g. `clean`,
+# `wait-for-dkg`, `test-decryption`) are inherited from ../mise.toml via mise's
+# directory-walking config discovery. Tests scripts live in `mise-tasks/`.
+
+# jobs = 1 forces mise to run task dependencies serially so the `test`
+# runner's two depends execute in order and fail-fast (offline-recovery is
+# skipped if happy-path fails). Mise defaults to parallel (jobs = 4) which
+# would otherwise let both tests `mise run clean` simultaneously and clobber
+# each other's docker state.
+[settings]
+jobs = 1
+
+[env]
+# The happy-path test needs keypers 3, 4, and 5 for the zero-overlap
+# replacement set; bump the pool to 6. Mise's directory-walking config
+# discovery means this override is applied to every `mise run` invocation
+# made from inside `e2e-tests/`, including child `mise run` subprocesses
+# spawned by test scripts — which need the larger pool to find
+# `keyper-4.toml`/`keyper-5.toml` when the test adds the 3,4,5 set.
+NUM_KEYPERS = "6"

mise-test-setup/mise-tasks/add-keyper-set

@@ -26,6 +26,7 @@ run_path = (
 deployment_run = json.loads(run_path.read_text())
 keyper_set_manager = utils.get_created_contract_address(deployment_run, "KeyperSetManager")
 key_broadcast_contract = utils.get_created_contract_address(deployment_run, "KeyBroadcastContract")
+dkg_contract = utils.get_created_contract_address(deployment_run, "DKGContract") or ""
 keyper_addresses = ",".join(
     utils.keyper_address(data_dir / f"keyper-{index}.toml") for index in indices
 )
@@ -47,6 +48,8 @@ utils.run(
         "--env",
         f"KEYBROADCAST_ADDRESS={key_broadcast_contract}",
         "--env",
+        f"DKG_CONTRACT_ADDRESS={dkg_contract}",
+        "--env",
         f"KEYPER_ADDRESSES={keyper_addresses}",
         "--env",
         f"THRESHOLD={threshold}",