[DRAFT - decision-gated] feat(tbtc/signer): add TEE hardening checker stack

[mswilkison]

⚠️ DRAFT — decision-gated

This PR adds the optional TEE signer-hardening readiness stack on top of
PR #4005, which
lands the base FROST/ROAST Rust signer at pkg/tbtc/signer/.

It must NOT be undrafted or merged until:

1. PR feat(tbtc/signer): mirror FROST/ROAST Rust signer from tBTC monorepo #4005 merges.
2. Threshold's policy decision on TEE enforcement for signers is explicit and documented.
3. This branch is rebased onto canonical main after feat(tbtc/signer): mirror FROST/ROAST Rust signer from tBTC monorepo #4005 merges.

Canonical repo note

This PR was initially sourced from
tlabs-xyz/tbtc#88, but
threshold-network/keep-core is now the canonical repo for the signer. The
monorepo/source-PR reference is provenance only; follow-up fixes in this PR are
ordinary keep-core changes and are not expected to remain byte-for-byte mirrors
of the old source branch.

Scope

Four-phase TEE checker stack:

• Phase A — governance registry + audit-event validation (tee_registry_checker)
• Phase B — verifier/keyset/token/revocation validation (tee_token_checker)
• Phase C — runtime token + denylist + vendor-diversity enforcement (tee_runtime_checker)
• Phase D — enforcement modes + break-glass controls (tee_enforcement_checker)

Files

Path	Count
pkg/tbtc/signer/src/bin/tee_*.rs	4 Rust binaries
pkg/tbtc/signer/scripts/tee-*.sample.json	12 sample configs
pkg/tbtc/signer/README.md	1 README update
pkg/tbtc/signer/docs/tee-whitelisted-signer-activation-gate-record.md + tee-whitelisted-signer-enforcement-plan.md	2 docs

Follow-up fixes included

• Rebases/merges the branch onto the current feat(tbtc/signer): mirror FROST/ROAST Rust signer from tBTC monorepo #4005 signer base so the full
  signer Rust checks workflow is present.
• Keeps the feat(tbtc/signer): mirror FROST/ROAST Rust signer from tBTC monorepo #4005 README path fixes and production-profile/state-key
  documentation, and updates the new TEE sections to use pkg/tbtc/signer/.
• Rejects verifier keysets that reuse the same Schnorr public key under
  different key_ids, closing the threshold-quorum bypass.
• Bounds reused break-glass incident tickets by the original history activation
  time and policy TTL, so an old ticket cannot refresh its waiver window.
• Applies the same hard ceilings for attestation age and denylist staleness
  across the registry/token/runtime checkers.
• Makes TEE checker clock reads fail closed if the system clock is before the
  Unix epoch.

Initial provenance

• Source repository: tlabs-xyz/tbtc
• Source PR: #88 (decision-gated, draft)
• Initial source PR HEAD: 31f0aa2b8efbf8ac42909f8e8d4ce67248cb478e
• Source branch: feat/tee-phase-a-governance-registry (stacked on feat/frost-schnorr-migration)
• Base for this PR: extraction/frost-signer-mirror-2026-05-26 (PR #4005)
• Source PR includes: stacked phases B, C, D from monorepo PRs Chain-beacon/relay interface #89, Implement Ethereum DKG-related chain interfaces #90, Ethereum provider initialization #91

Verification

Local verification on the latest pushed head:

cargo fmt --manifest-path pkg/tbtc/signer/Cargo.toml -- --check
cargo clippy --manifest-path pkg/tbtc/signer/Cargo.toml --all-targets -- -D warnings
TBTC_SIGNER_STATE_PATH=/tmp/tbtc-signer-ci-state-pr4007-local.json \
  cargo test --manifest-path pkg/tbtc/signer/Cargo.toml

Plan context

This is an optional, decision-gated addition to the FROST extraction. Unlike the
mandatory extraction/mirror PRs, this PR's merge depends on the Threshold TEE
policy decision, not just operational readiness.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b4c1d0e6-a5e8-4b62-9c56-39395c2ef990

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch extraction/frost-signer-tee-stack-2026-05-26

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}