fix(consensus): restrict collected signatures to shard members

[hackobi]

Summary

• Restrict relayed consensus signatures to identities in the current shard.
• Apply the membership gate in both outbound aggregation and inbound proposal handling.
• Preserve case-insensitive public-key identity matching while retaining the original key spelling.
• Add focused regression tests for non-member rejection, member acceptance, and input immutability.

Security rationale

The Petri review identified a quorum-inflation risk: a cryptographically valid signature from an identity outside the current shard could be stored and later counted. This draft addresses that specific signer-membership gap. It does not claim to resolve vote freshness, block-height/round binding, shard derivation, block acceptance, or transport authentication; those require separate review work.

Verification

• bun test src/libs/consensus/v2/routines/signerMembership.test.ts — 3 passed.
• Targeted related suite — new tests and existing pinning tests passed; an existing getShard.test.ts failed before reaching assertions because Bun does not provide the repository test's jest.requireMock API.
• bunx eslint@8.57.1 ... — passed.
• bun run type-check-ts — blocked by unrelated pre-existing repository errors (TLSNotary config, transaction types, GCR APIs, and other baseline diagnostics).
• No live nodes, credentials, generated databases, or upstream PR Added Petri Consensus #692 were modified.

Review status

This remains a draft pending independent consensus review, maintainer review, CI validation, and integration coverage through both changed code paths. No approval is claimed from the preliminary automated review attempts.

Checklist

• Confirm current shard membership source is the authoritative signer set.
• Add integration coverage through both broadcastBlockHash and manageProposeBlockHash.
• Independent consensus review.
• CI passes on GitHub.
• Maintainer approval.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hackobi]

CI follow-up: the repository workflow previously created zero jobs because of a duplicate trigger key. That syntax issue is isolated in draft PR #988. With the repair applied, Type Check and Sonar checks pass; repository-wide Lint still fails on the existing baseline (222 errors, 757 warnings). PR #986 remains draft and is not merge-ready.

[hackobi]

Independent review found a blocking gap tracked in #990: verifyBlock() excludes outsider signatures from quorum but syncBlock() can still pass the original block to Chain.insertBlock(), which stores validation_data unchanged. The review also found inconsistent identity casing between membership filtering and exact finality lookups. Do not approve or merge #986 until the acceptance/storage boundary and casing behavior are covered. Attempted focused regression execution was blocked by existing harness/module-resolution failures under both Bun and Jest.