feat(tbtc): retained FROST wallet history source and identity-frozen primary transport

[mswilkison]

Stacked on #4199 (codex/frost-preauth-outbox-restored). Draft — keep-core activation remains dormant until the external tbtc-v2 anchor/broadcast/indexer/reconciliation path is delivered; nothing here activates on its own.

The retained FROST wallet history source and its activation surface, restacked onto the rebuilt #4199 lineage:

• Manifest-bound retained history source: a signed, paginated retained-group export with an independent finalized-Ethereum verifier, configured via FrostRetainedGroupHistory and constructed by the start command before TBTC initialization whenever FROST activation is on.
• Hardened history semantics with quorum checkpoints for history reads and quorum certificates required for FROST quarantine lifts.
• Activation transcripts bound into the v3 handshake (BindingHash folded into challenge/payload/journal state), with the activation reconciliation cached asynchronously off the production signer-readiness seam (journal stamp quick-checks bracket attest; stale caches 503 with Retry-After).
• Checkpoint trust and recovery hardening: handshake state self-verification and checkpoint-descent-checked signing.
• Retained history endpoint identity: authenticated endpoint identities replace URL-hash fingerprints (operator-receipt/request/query wires bumped to v4; history-page/export-signature to v5 on the feat(tbtc): native signer state-anchor service, trust startup, and bootstrap ceremony (ABI 4.3) #4199 side of the merge).
• Identity-frozen primary Ethereum transport: the primary chain handle owns its exact RPC client — direct TLS 1.3 HTTP/1.1 only, first complete DNS answer frozen, every connection and WebSocket reconnect verified and recorded, and the retained history source held to a separation policy against the primary transport's trust domain.

Verification

At the pushed head: go build ./..., repo-wide gofmt clean, go vet, full go test over pkg/tbtc, pkg/chain/ethereum, pkg/frost/..., cmd, plus the frost_native and frost_native frost_roast_retry mock-FFI tag sets and the frost-cgo-integration suite against the pinned signer (b35637ed0, ABI 4.3).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ec4bc915-5cd9-4bbc-a285-1e0b29538b93

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/frost-retained-history-source

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}