fix(tbtc/signer): apply session lifecycle and quarantine gates on interactive open

The interactive path accepted an open after only the signing-policy
firewall check, so on a session start_sign_round would refuse it could
still emit a share - bypassing the established lifecycle/quarantine
gates (review finding). InteractiveSessionOpen now enforces, before
installing any interactive state, the same gates the coarse path does:

- emergency_rekey_event on an existing session -> LifecyclePolicyRejected
  (emergency_rekey_required),
- a terminally finalized session -> SessionFinalized,
- an auto-quarantined member_identifier (absent a DAO allowlist
  override) -> QuarantinePolicyRejected, reusing
  enforce_not_quarantined_identifiers so the allowlist override is
  honored identically.

The quarantine check targets this node's own member_identifier - the
member it is about to produce a share for - rather than the whole
included set, since under t-of-included a quarantined included member
simply will not be among the responsive subset.

Tests: an emergency-rekey session and a finalized session both refuse
interactive open; a quarantined member is rejected and a DAO allowlist
override restores signing. Full suite 261 passed / 1 ignored, clippy
-D warnings clean, chaos suite green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: mswilkison

pkg/tbtc/signer/src/engine/interactive.rs

@@ -107,6 +107,44 @@ pub fn interactive_session_open(
 
     ensure_session_insert_capacity(&guard.sessions, &request.session_id)?;
 
+    // Session lifecycle gates (frozen spec section 5: Open "checks
+    // policy gates"). The interactive path must refuse in exactly the
+    // states the coarse start_sign_round refuses: a session under an
+    // emergency rekey, or one already terminally finalized. Without
+    // these, InteractiveRound1/Round2 could emit a share where the
+    // established path would not.
+    if let Some(existing_session) = guard.sessions.get(&request.session_id) {
+        if let Some(emergency_rekey_event) = existing_session.emergency_rekey_event.as_ref() {
+            return Err(EngineError::LifecyclePolicyRejected {
+                session_id: request.session_id.clone(),
+                reason_code: "emergency_rekey_required".to_string(),
+                detail: format!(
+                    "emergency rekey required for session [{}] since [{}]: {}",
+                    request.session_id,
+                    emergency_rekey_event.triggered_at_unix,
+                    emergency_rekey_event.reason
+                ),
+            });
+        }
+        if existing_session.finalize_request_fingerprint.is_some() {
+            return Err(EngineError::SessionFinalized {
+                session_id: request.session_id.clone(),
+            });
+        }
+    }
+
+    // Quarantine gate: this node is about to produce a share for
+    // member_identifier, so an auto-quarantined member (absent a DAO
+    // allowlist override) must not be able to sign through the
+    // interactive path either.
+    let auto_quarantine_config = load_auto_quarantine_config()?;
+    enforce_not_quarantined_identifiers(
+        &request.session_id,
+        &[request.member_identifier],
+        &guard.quarantined_operator_identifiers,
+        auto_quarantine_config.as_ref(),
+    )?;
+
     // Signing-policy firewall (frozen spec section 5: Open "checks
     // policy gates"). When the firewall is enabled, the message must be
     // bound to a prior policy-checked build_taproot_tx for this

pkg/tbtc/signer/src/engine/tests.rs

@@ -12454,3 +12454,140 @@ fn interactive_abort_sweeps_expired_sessions() {
         "an abort must sweep expired interactive state in other sessions"
     );
 }
+
+#[test]
+fn interactive_open_rejected_on_session_lifecycle_states() {
+    let _guard = lock_test_state();
+    reset_for_tests();
+
+    let key_packages = interactive_test_key_packages();
+    let key_group = "interactive-test-key-group";
+    let message = [0x17u8; 32];
+    let included = [1u16, 2];
+
+    // A session under an emergency rekey must refuse interactive opens,
+    // exactly as start_sign_round does.
+    {
+        let mut guard = state().expect("state").lock().expect("lock");
+        guard.sessions.insert(
+            "interactive-lifecycle-rekey".to_string(),
+            SessionState {
+                emergency_rekey_event: Some(EmergencyRekeyEvent {
+                    reason: "test rekey".to_string(),
+                    triggered_at_unix: now_unix(),
+                }),
+                ..Default::default()
+            },
+        );
+    }
+    let rekey = open_interactive_for_test(
+        &key_packages,
+        "interactive-lifecycle-rekey",
+        key_group,
+        &message,
+        &included,
+        1,
+        1,
+        2,
+    )
+    .expect_err("an emergency-rekey session must refuse interactive open");
+    assert!(
+        matches!(rekey, EngineError::LifecyclePolicyRejected { ref reason_code, .. }
+            if reason_code == "emergency_rekey_required"),
+        "unexpected error: {rekey:?}"
+    );
+
+    // A terminally finalized session must refuse interactive opens.
+    {
+        let mut guard = state().expect("state").lock().expect("lock");
+        guard.sessions.insert(
+            "interactive-lifecycle-finalized".to_string(),
+            SessionState {
+                finalize_request_fingerprint: Some("already-finalized".to_string()),
+                ..Default::default()
+            },
+        );
+    }
+    let finalized = open_interactive_for_test(
+        &key_packages,
+        "interactive-lifecycle-finalized",
+        key_group,
+        &message,
+        &included,
+        1,
+        1,
+        2,
+    )
+    .expect_err("a finalized session must refuse interactive open");
+    assert!(
+        matches!(finalized, EngineError::SessionFinalized { .. }),
+        "unexpected error: {finalized:?}"
+    );
+}
+
+#[test]
+fn interactive_open_rejected_for_quarantined_member_honors_dao_allowlist() {
+    let _guard = lock_test_state();
+    reset_for_tests();
+
+    std::env::set_var(TBTC_SIGNER_ENABLE_AUTO_QUARANTINE_ENV, "true");
+    std::env::set_var(TBTC_SIGNER_AUTO_QUARANTINE_FAULT_THRESHOLD_ENV, "2");
+    std::env::set_var(TBTC_SIGNER_AUTO_QUARANTINE_TIMEOUT_PENALTY_ENV, "1");
+    std::env::set_var(TBTC_SIGNER_AUTO_QUARANTINE_INVALID_SHARE_PENALTY_ENV, "2");
+
+    // Member 1 is auto-quarantined.
+    {
+        let mut guard = state().expect("state").lock().expect("lock");
+        guard.quarantined_operator_identifiers.insert(1);
+    }
+
+    let key_packages = interactive_test_key_packages();
+    let key_group = "interactive-test-key-group";
+    let message = [0x18u8; 32];
+    let included = [1u16, 2];
+
+    let outcome = (|| -> Result<(), EngineError> {
+        let quarantined = open_interactive_for_test(
+            &key_packages,
+            "interactive-quarantine",
+            key_group,
+            &message,
+            &included,
+            1,
+            1,
+            2,
+        )
+        .expect_err("a quarantined member must not open an interactive session");
+        assert!(
+            matches!(quarantined, EngineError::QuarantinePolicyRejected { ref reason_code, .. }
+                if reason_code == "operator_auto_quarantined"),
+            "unexpected error: {quarantined:?}"
+        );
+
+        // A DAO allowlist override restores the member's ability to sign.
+        std::env::set_var(
+            TBTC_SIGNER_AUTO_QUARANTINE_DAO_ALLOWLIST_IDENTIFIERS_ENV,
+            "1",
+        );
+        let allowlisted = open_interactive_for_test(
+            &key_packages,
+            "interactive-quarantine-allowlisted",
+            key_group,
+            &message,
+            &included,
+            1,
+            1,
+            2,
+        )?;
+        assert!(!allowlisted.idempotent);
+        Ok(())
+    })();
+
+    std::env::remove_var(TBTC_SIGNER_ENABLE_AUTO_QUARANTINE_ENV);
+    std::env::remove_var(TBTC_SIGNER_AUTO_QUARANTINE_FAULT_THRESHOLD_ENV);
+    std::env::remove_var(TBTC_SIGNER_AUTO_QUARANTINE_TIMEOUT_PENALTY_ENV);
+    std::env::remove_var(TBTC_SIGNER_AUTO_QUARANTINE_INVALID_SHARE_PENALTY_ENV);
+    std::env::remove_var(TBTC_SIGNER_AUTO_QUARANTINE_DAO_ALLOWLIST_IDENTIFIERS_ENV);
+
+    outcome.expect("quarantine gate lifecycle");
+}