Summary
Eleven FFI exports on the signer crate have no Go caller anywhere in the tree, and four of them additionally have no unit tests. They are inert in a shipped node — unreferenced dlsym symbols are never resolved — but they are documented public ABI with stated host-side consumers, so they are unshipped features rather than dead code.
Found while reviewing #4198/#4199 for the design work in #4222.
The unwired set
quarantine_status, refresh_cadence_status, hardening_metrics, roast_liveness_policy, promote_canary, rollback_canary, verify_blame_proof, roast_transcript_audit, refresh_shares, run_differential_fuzzing, canary_rollout_status.
(trigger_emergency_rekey was in this set and is now wired — see #4226. That one mattered because the kill switch was otherwise written out of band and erasable by the operator it targets.)
The two that are more than cosmetic
refresh_shares is state-mutating and has no caller. The entire TBTC_SIGNER_REFRESH_CADENCE_SECONDS subsystem — configuration, validation, cadence status — depends on a host call that never happens. Either wire it or remove the subsystem; leaving a configurable cadence that cannot elapse is the same trap as #4228.
verify_blame_proof and roast_transcript_audit have zero tests and are security-adjacent: blame adjudication and transcript evidence. quarantine_status and roast_liveness_policy are also untested. Tests here are worth more than the wiring.
Recommendation
Do not remove the exports. Every removal is an ABI-breaking major bump, which invalidates ci/frost-signer-pin.env and reopens two large, approve-ready PRs — for surface that costs nothing at runtime. None of it is in the deletion set of any design direction under discussion in #4222 either, so removing it now buys nothing under any future.
Instead: add tests for the four untested endpoints, and make an explicit wire-or-remove decision on refresh_shares as a follow-up.
Summary
Eleven FFI exports on the signer crate have no Go caller anywhere in the tree, and four of them additionally have no unit tests. They are inert in a shipped node — unreferenced
dlsymsymbols are never resolved — but they are documented public ABI with stated host-side consumers, so they are unshipped features rather than dead code.Found while reviewing #4198/#4199 for the design work in #4222.
The unwired set
quarantine_status,refresh_cadence_status,hardening_metrics,roast_liveness_policy,promote_canary,rollback_canary,verify_blame_proof,roast_transcript_audit,refresh_shares,run_differential_fuzzing,canary_rollout_status.(
trigger_emergency_rekeywas in this set and is now wired — see #4226. That one mattered because the kill switch was otherwise written out of band and erasable by the operator it targets.)The two that are more than cosmetic
refresh_sharesis state-mutating and has no caller. The entireTBTC_SIGNER_REFRESH_CADENCE_SECONDSsubsystem — configuration, validation, cadence status — depends on a host call that never happens. Either wire it or remove the subsystem; leaving a configurable cadence that cannot elapse is the same trap as #4228.verify_blame_proofandroast_transcript_audithave zero tests and are security-adjacent: blame adjudication and transcript evidence.quarantine_statusandroast_liveness_policyare also untested. Tests here are worth more than the wiring.Recommendation
Do not remove the exports. Every removal is an ABI-breaking major bump, which invalidates
ci/frost-signer-pin.envand reopens two large, approve-ready PRs — for surface that costs nothing at runtime. None of it is in the deletion set of any design direction under discussion in #4222 either, so removing it now buys nothing under any future.Instead: add tests for the four untested endpoints, and make an explicit wire-or-remove decision on
refresh_sharesas a follow-up.