Commonware + BLS

[JakeHartnell]

Summary

Replaces libp2p with commonware-p2p for the WAVS aggregator's
peer-to-peer layer, and adds BLS12-381 alongside secp256k1 as a per-service signature option.

App-side UX (Tauri commands + React pages exposing BLS keys, P2P dashboard, unified activity,
BLS-aware service deploy) is split out into a follow-up PR stacked on this one — keeps this review
focused on node-internal protocol work and lets the UI keep moving on main without conflicts.

What's new

Commonware P2P (replaces libp2p)

packages/wavs/src/subsystems/aggregator/p2p.rs is essentially a rewrite around commonware-p2p
2026.3.0:

• Two operating modes (was: local mDNS / remote Kademlia):
  • Lookup mode (P2pConfig::Local): static peer addresses for local dev / testing.
  • Discovery mode (P2pConfig::Remote): bootstrapper-based discovery for production.
• Two-channel broadcast architecture: channel 0 feeds the broadcast Engine for caching +
  catch-up; channel 1 is read by an inbound bridge task for real-time forwarding to the aggregator.
• Peer identities: Ed25519 keys derived from the existing signing_mnemonic. Address format:
  <hex_ed25519_pubkey>@<host>:<port>.
• Subscription protocol: peers explicitly announce which services they care about; targeted
  delivery only sends to subscribed peers, with hello-on-first-contact handshakes and
  heartbeat-driven peer state pruning.
• Catch-up via broadcast cache: per-peer bounded deque (deque_size, default 128) replaces the
  old request/response protocol.

Dependencies dropped: libp2p (and the gossipsub/kad/mdns/autonat/identify/request-response
stack). Added: commonware-{p2p,broadcast,cryptography,math,runtime,utils,codec} and
rand_chacha/rand_core/bip39.

BLS12-381 signing

• New SignatureAlgorithm enum (packages/types/src/signing.rs) — Secp256k1 | Bls12381,
  selectable per service.
• WavsCryptoSigner (packages/types/src/signing/signer.rs) wraps either an alloy
  PrivateKeySigner or a commonware_cryptography::bls12381::PrivateKey.
• packages/utils/src/bls_signing.rs — deterministic BLS key derivation from BIP39 mnemonic +
  HD index, G1 pubkey (128 bytes) / G2 signature (256 bytes) serialization, proof-of-possession
  signing.
• PoA BLS middleware (packages/utils/src/test_utils/middleware/evm/middleware_poa_bls.rs) —
  drives the standalone poa-middleware repo's BLS variant via forge for e2e tests.
• Solidity ABIs for IPOAStakeRegistry, IWavsServiceHandler, IWavsServiceManager BLS
  variants (packages/types/src/contracts/solidity/abi/bls/).
• SubmissionManager::add_service_key is now algorithm-aware; aggregator submit constructs either
  ECDSA ServiceManagerEnvelope or BlsServiceManagerEnvelope.

Gated behind bls feature on packages/wavs (default-on for the node; BLS-disabled builds return
a clear error from add_service_key).

Tests

• 21 new P2P test cases across
  packages/wavs/tests/p2p_{broadcast,connectivity,identity}_tests.rs and
  packages/wavs/src/subsystems/aggregator/p2p_{config,status}_tests.rs covering broadcast-to-all,
  service filtering, retry-on-no-peers, dedup by digest, catchup-after-reconnect, bounded cache,
  peer-connected status, deterministic key derivation, mode-specific config parsing.
• bls-multi-operator matrix test in layer-tests/layer-tests.toml — forces
  EvmMiddlewareType::PoaBls regardless of config to exercise the BLS path end-to-end.

CI

• The test-eigenlayer job is gone (no longer needed).
• The setup composite action clones Lay3rLabs/poa-middleware (bls branch) into ${{ runner.workspace }}/contracts/poa-middleware and runs npm ci so forge can resolve the
  OpenZeppelin remap.
• Rust toolchain pinned to 1.91.1; all clippy -D warnings lints addressed.

What's removed

• All libp2p crates and the gossipsub/kad/mdns/autonat/identify/request-response code paths.
• Old PROTOCOL_VERSION = "/wavs/1.0.0" / CATCHUP_PROTOCOL = "/wavs/catchup/1.0.0" constants.
• mDNS-based local discovery (replaced by explicit peer_addresses in lookup mode).
• Multiaddr address format (/ip4/.../tcp/.../p2p/...) — replaced by pubkey@host:port.

Configuration migration

wavs.toml [wavs.p2p] section reshaped:

Before	After
p2p = { local = { listen_port = 9000 } } (mDNS auto-discovery)	p2p = { local = { listen_port = 9000, peer_addresses = ["<pubkey>@127.0.0.1:9001"], authorized_peers = ["<pubkey>"] } }
p2p = { remote = { listen_port = 9000, bootstrap_nodes = ["/ip4/1.2.3.4/tcp/9000/p2p/12D3KooW..."] } }	p2p = { remote = { listen_port = 9000, bootstrappers = ["<pubkey>@1.2.3.4:9000"] } }

Existing options like max_retry_duration_secs, submission_ttl_secs, cleanup_interval_secs
etc. are replaced by the broadcast Engine's simpler model (max_message_size, deque_size). See
the inline docs in wavs.toml for the full list.

Test plan

• CI green: lint + workspace tests + POA BLS e2e (bls-multi-operator matrix test).
• Manually run two nodes locally with p2p = { local = ... } and confirm broadcast + catch-up
  across restart.
• Run a BLS service end-to-end against a poa-middleware (bls branch) deployment.

Follow-up

The frontend layer (Tauri commands + new P2P / settings / activity pages + BLS-aware service
deploy) ships as a stacked PR on bls-commonware-app.

[JakeHartnell]

Might remove all these planning files, but will leave them for now.

Update: removed

[layertau]

First-pass + second-pass security/correctness audit completed. I did not find a clear exploitable Critical/High issue in the reviewed areas, and targeted validation passed after fixing the local OpenSSL pkg-config environment:

• cargo test -p wavs-types --features bls
• cargo test -p wavs-types --features full
• cargo test -p utils bls_signing
• cargo test -p wavs p2p_ --tests

Non-blocking items I recommend maintainers/reviewers confirm before final approval:

1. BLS cross-layer compatibility coverage: the Rust BLS encoding/signing helpers are duplicated between packages/utils/src/bls_signing.rs and packages/types/src/signing/signer.rs. Unit tests cover determinism/shape/sorting, but I did not see a deterministic contract-vector/e2e test proving produced (signerPubkeys, aggregateSignature, referenceBlock) validates against the Solidity BLS service manager/handler for a fixed envelope. Given EIP-2537 coordinate ordering, padding, DST, and hash-preimage sensitivity, this would be valuable merge confidence.
2. Remote P2P config semantics: P2pConfig::Remote currently constructs discovery with discovery::Config::local() while comments say production should use Config::recommended(). Please confirm this is intentional for operator deployments or document the operational/security implications clearly.
3. P2P subscription targeting semantics: outbound publishes still send channel-0 broadcast engine messages to Recipients::All, while only channel 1 is targeted by service subscription. Please confirm channel 0 does not weaken the intended service-level isolation/confidentiality semantics, or clarify that subscriptions are an application/load filter rather than a confidentiality boundary.

Recommendation from this audit: comment only; do not request changes based on these findings alone, but I would avoid final approval until the BLS end-to-end compatibility coverage/expectation is satisfactory to maintainers.

[layertau]

Thanks for the substantial Commonware/BLS migration. The PR is well-scoped for a large protocol change, and I appreciate the new P2P coverage plus the explicit BLS e2e matrix.

I found one packaging/build issue that should be fixed before merge:

Important / blocking for published wavs-types feature consumers

packages/types/src/signing/signer.rs now uses tokio::task::spawn_blocking in the BLS signer path, but packages/types/Cargo.toml enables the optional Tokio dependency with only features = ["sync"]. In isolation, the advertised signer + bls/full feature set does not compile because spawn_blocking is gated behind Tokio's rt feature.

Repro:

cargo check -p wavs-types --no-default-features --features 'signer,bls'

Error:

error[E0425]: cannot find function `spawn_blocking` in module `tokio::task`
  --> packages/types/src/signing/signer.rs:184:53
note: the item is gated behind the `rt` feature

Recommended fix: add rt to the optional Tokio feature list for wavs-types (or avoid spawn_blocking in this crate), e.g.

tokio = { version = "1", optional = true, default-features = false, features = ["sync", "rt"] }

Please also add/ensure a CI check covers wavs-types --no-default-features --features full or at least signer,bls so this does not regress for downstream users.

[JakeHartnell]

@layertau can you open up a new PR for this branch that fixes up the wavs-types issues you noted?

[layertau]

Opened the requested stacked fix PR: #1146

It adds Tokio rt for the wavs-types BLS signer path and adds a standalone wavs-types --no-default-features --features full CI check. I verified locally with:

cargo check -p wavs-types --no-default-features --features full --locked

[layertau]

CI triage for failed Basic Checks run 25866730788:

The failure is in the POA workspace test run, specifically:

cargo test --workspace --locked --all-features -- --nocapture --test-threads=4

Failing test:

-p wavs --test p2p_broadcast_tests test_deduplication_by_digest

Observed assertion:

Node B should receive exactly 1 message (dedup filters duplicate), got 0

There is also a concurrent Tokio/commonware shutdown panic in the same test binary:

Cannot drop a runtime in a context where blocking is not allowed. This happens when a runtime is dropped from within an asynchronous context.

Assessment: this looks like a P2P test/runtime lifecycle reliability issue rather than the wavs-types feature-build issue from my earlier review. The dedup test can miss initial delivery entirely, and the commonware runtime teardown is happening from an async Tokio context. Please fix or stabilize this before merge; at minimum the test should wait on a positive connection/subscription readiness condition rather than fixed sleeps, and the commonware runtime/task handles should be shut down/dropped outside async runtime contexts.

[ueco-jb]

Assessment: this looks like a P2P test/runtime lifecycle reliability issue rather than the wavs-types feature-build issue from my earlier review. The dedup test can miss initial delivery entirely, and the commonware runtime teardown is happening from an async Tokio context. Please fix or stabilize this before merge; at minimum the test should wait on a positive connection/subscription readiness condition rather than fixed sleeps, and the commonware runtime/task handles should be shut down/dropped outside async runtime contexts.

@layertau is that an issue introduced in the current PR or could that be existing previously already?

[layertau]

@ueco-jb This appears introduced by the current PR.

Evidence:

• packages/wavs/tests/p2p_broadcast_tests.rs is a new file in this branch (A in origin/main...origin/bls-commonware), so the failing test_deduplication_by_digest did not exist on main.
• packages/wavs/src/subsystems/aggregator/p2p.rs is substantially rewritten in this PR from the previous libp2p implementation to commonware, so the commonware runtime teardown panic path also cannot be pre-existing on main in this form.

It may be exposing a broader async-test lifecycle pattern, but the concrete CI failure is from new Commonware P2P test/code paths added in this PR and should be treated as blocking for this PR.