fix(tbtc/signer): require a genesis floor in the anchor descendant validator

[mswilkison]

Stacked on #4198. Pairs with the mirrored Go-side change in #4226.

The divergence

The Go and Rust anchor-trust descendant validators disagree about which references are admissible, in both directions:

check	Go	Rust
certified floor must be revision 1 of its service epoch	✅	❌ (this PR)
checkpoint store fingerprint fixed across generations	❌ (#4226)	✅

Neither gap is reachable today. Bootstrap and rotation endpoints both force a revision-1 To reference, so every call site already passes one — the full suite passes unchanged with the check added, which is the evidence for that claim rather than an assumption about it.

Why fix a latent gap

A divergence between the trees is not a cosmetic asymmetry. Whichever tree is more permissive would accept a certificate chain the other refuses — and the refusal happens on every store open, since the Rust trust journal is replayed and re-validated fail-closed each time. There is no truncation, rebase, or compaction path back from that state.

So the failure mode is a deterministic brick of a permissioned signer store, recoverable only by re-provisioning onto a fresh store identity — which abandons every DKG key package bound to the old one. Fail-closed is the safe direction, and it is still a dead store. The two validators should not be able to drift apart again.

The fix

Assert the union of the two rule sets rather than the intersection. Do not relax Go: its floor-revision rule is load-bearing at startup, where the floor arrives as external data from the Rust readback and the check is genuine defense in depth.

This PR adds Go's rule to Rust. The mirrored fingerprint check lands on the Go side in #4226.

Validation tightening only — no wire format, encoding, or ABI change, so no ABI revision. ci/frost-signer-pin.env is deliberately not bumped here: the pin must not point at an unmerged side branch. It should move to this commit once this merges into codex/signer-store-identity-abi.

Verification

cargo fmt -- --check
cargo clippy --all-targets -- -D warnings
TBTC_SIGNER_STATE_PATH=/tmp/... cargo test     # 369 passed, 0 failed

Two new tests pin both halves of the parity so a future edit to either validator has to confront the other: one asserts a non-genesis floor is refused while a revision-1 floor still admits the same descendant (so the rule rejects the floor shape, not ordinary descendants), and one asserts a store-fingerprint change across generations is refused.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 252e8f41-5751-4b32-a11f-5e1ecbeab8ae

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}