feat: Multiple Validators

[sergerad]

Summary

• Multi-validator signature integration:

  • Proto: SignBlockResponse gains public_key; rpc.proto sync target is repeated.
  • Store genesis: GenesisState.validator_keys: ValidatorKeys; DB signature column stores full BlockSignatures.
  • Validator: fixed a bug — membership checks now test the parent's validator set, not the proposed header's.
  • Block producer: validator_urls: Vec<Url>, concurrent fan-out to all validators, positional signature aggregation.
  • RPC: tx/batch submission fans out to every validator.

• Single-signature genesis bootstrap: the genesis header commits the full validator set, but the block itself carries exactly one signature from the bootstrapping validator (verified against the committed set). Because a block's signatures are verified against its parent's committed set, the full set is automatically required to sign from block 1 onwards. The verification rule lives in miden_node_utils::genesis::verify_genesis_signatures, shared by the store and the ntx-builder (which previously had its own copy of the all-must-sign check).

  • The validator set is part of the genesis configuration: a top-level validators list of hex-encoded public keys in genesis.toml. When omitted, the set defaults to the bootstrapping validator's key alone; when specified, it must include the bootstrapping validator's public key (rejected with a dedicated error otherwise, since such a genesis could never verify).
  • miden-validator bootstrap takes a single --key.hex/--key.kms-id for the bootstrapping validator's own key; no other key material is passed on the command line.
  • New miden-validator pubkey subcommand prints a key's public key (local or KMS) in the hex encoding the validators config list expects, so operators can hand their pubkey to the bootstrapper without sharing secrets.

• Added miden-validator bootstrap --file <genesis.dat>: seeds a validator's local DB/block store from an already-signed genesis block without re-signing.

• Updated scripts/run-node.sh to run two validators end to end: it derives both validators' public keys via miden-validator pubkey, writes them as the validators list of a generated genesis config, and validator 1 bootstraps and signs genesis with only its own key. Validator 2's directory is seeded via --file from that genesis output. Neither validator ever holds the other's secret key.

• Updated operator docs (bootstrap-and-genesis.md, sequencer.md) to reflect the multi-validator flow: each non-bootstrapping operator sends their public key to the bootstrapping operator, who lists it in the genesis config's validators and signs genesis with their own key alone; every other validator seeds via --file.

Changelog

[[entry]]
scope       = "node"
impact      = "breaking"
description = "Added multiple Validator genesis bootstrap and tx/block validation"