feat(cluster-tool): per-producer finalizer keys, genesis producer registration, and the producer-registration flow (WIRE-367)

[heifner]

Part of WIRE-367. Gives the harness what it needs to stand up a real block producer, and adds the flow that drives one from a fresh account to producing blocks and back.

Per-producer BLS finalizer keys

The harness minted one K1+BLS set per producer node and every producer account on that node shared it. regfinkey enforces a global duplicate-key check, so N accounts sharing one BLS key cannot all register — which meant update_ranked_producers could never publish, and no harness cluster had ever run on a ranked schedule. Every flow to date ran on whatever setprodkeys stamped at bootstrap.

BLS keys are now per producer account (OperatorAccount.wireFinalizer); the K1 block-signing key stays node-shared, since it carries no uniqueness constraint. NodeopProcess takes operators: OperatorAccount[] and emits one --producer-name plus its BLS --signature-provider per hosted producer, and the genesis finalizer policy is built from producer keys rather than node keys. Because that K1 is shared by construction, NodeopProcess.create now refuses a node whose hosted producer accounts do not all carry the same one.

Bootstrap ordering

Three constraints, each of which cost a failed flow run to find, now pinned by tests in ClusterBuildDefaultsGenesisProducers.test.ts:

1. ProducerIdentities must precede ProducerNodes. A producing node renders one --signature-provider per hosted account at launch, so the keys must exist by then. Key material is a separate phase from the newaccount write, which cannot run until sysio.system is deployed. Symptom: ClusterKeyStore: operator "defproducera" has not been provisioned.
2. Finality must stay before SystemContract. bios::setfinalizer is a BIOS-ABI action and stops existing once the system contract replaces bios code. Symptom: Unknown action setfinalizer in contract sysio.
3. regoperator for genesis producers waits for OPPConfig — sysio.opreg isn't deployed until OPPContracts.

Plus one non-ordering trap: regfinkey bills its rows to the producer, and neither route to a producer account leaves room. Steps.consensus.planGrantProducerRam grants it, keyed by handle because a sponsored producer's on-chain name is generated at run time. Symptom: Account using more than allotted RAM usage.

New surface

• SystemContractSteps — planRegproducer, planRegfinkey, planActfinkey, planUnregprod, planSetscorecfg, planSetacctram, all on the generated action types — planSetscorecfg carries the rolling-window gate (missed_round_window_ms, max_pct_missed_rounds_in_window) alongside the consecutive threshold.
• ProducerNodeTool — spawns an ad-hoc producing node outside NodeConfig.plan, ports from BindConfigProvider.findAvailable.
• WireOperatorProvisioningTool — a PRODUCER without producerNodeIndex now routes to the collateral-backed OPP-operator path (unique K1/EM/ED plus a BLS finalizer key of its own, sponsored account, ETH+SOL funding, authex links on both chains, regoperator). A spec naming both producerNodeIndex and ethereumHdIndex is refused, since genesis and collateral-backed are mutually exclusive routes.
• ProtocolTiming.ScheduleRebuildIntervalMs — the ranked schedule is rebuilt at most once per 120 slots, so the flow's schedule and demotion deadlines derive from it rather than from producer rotations alone.

SSM key custody

A producer NODE now publishes nothing under its own name. Finality moved to per-account
finalizer keys, so buildArgs renders every --signature-provider spec from an ACCOUNT's
publicationLabel — the block-signing K1 from the first hosted account, one finalizer BLS
per hosted account — and the producer-account rows already republish that K1 under each
account's own label. The node_NN parameters were fetched by nobody, so publishing them wrote
live signing keys into every replication region for no reader. Removing the row left
SignatureKeySource single-valued and nodeIndex write-only, so both go and the key resolver
collapses to the one lookup it always was. The bios node is not an exception: its identity is an
operator row whose label IS the node name its daemon renders.

The cross-check test asserted [K1, BLS] per producing node — an assumption, and the wrong one.
It now DERIVES the expected ids from what buildArgs renders and names the bios label divergence
explicitly, so it fails when a rendered spec has no publication rather than when a guess about
node keys stops holding. Worth knowing: these steps are composed only under
--signature-provider-type SSM, which the e2e gate does not exercise, so the unit tests are the
whole safety net until a cluster workflow boots an SSM cluster against it.

Two gaps under --signature-provider-type SSM, both invisible under the default KEY mode:

• A flow-provisioned operator's keys were never published. The bootstrap walker enumerates identities from config, and a flow's label is not in the config, so the daemon later started for it rendered SSM: specs pointing at parameters nothing had written. Its provisioning phase now publishes them itself, through the same renderer the walker uses, and only for labels the walker does not already cover.
• An existing parameter was retained on sight. If it held a different key than the one this run materialized, the daemon reading it would sign with a key the chain never saw. The publish step now compares the stored value in canonical native form and fails, naming the parameter and region, rather than adopting a stale copy. A parameter is still never overwritten.

The flow

flow-producer-registration, 9 phases: provision → negative case (registered but unbonded never enters the schedule) → ETH deposit → SOL deposit → start node → enters schedule and produces a block → missed rounds drive demotion → regproducer clears the demotion while the miss streak survives → producing a block clears the streak → withdraw below minimum removes it. The two recovery assertions are separate on purpose: regproducer is a free signature, so it re-opens the schedule without pardoning the record, and only producing retires the streak. Assertions read the active schedule via get_producer_schedule rather than head_block_producer, and the exit check requires the demoted producer to be absent while the schedule still holds only genesis producers at or above MIN_SCHEDULE_SIZE. Picked up by dynamic discovery, so no workflow edit.

Validation

• pnpm build, pnpm run lint, and 2070 tests across 229 suites.
• e2e gate 33992129110 on the current heads: 15/15 flows green, including this one (1240s) and emissions-soak, where genesis producers newly drawing producer pay would have surfaced.

CI

Build and test is red here until Wire-Network/wire-libraries-ts#80 merges and publishes. This repo resolves @wireio/sdk-core from the registry, and the published version predates the WIRE-367 ABI: every error is a missing setscorecfg, rank_score or standby_bps. No code change here will fix it, and none is needed — the sibling-linked build used by the e2e gate above is green.

Merge order

Last. After Wire-Network/wire-sysio#599 and Wire-Network/wire-libraries-ts#80.