test(sdk-lib-mpc): add EdDSA MPCv2 keyshare wire-format regression

Check in a static DKG keyshare fixture (bincode-serialized
Keyshare<EdwardsPoint>, generated 2026-09-01 from @bitgo/sdk-lib-mpc
@10.18.0) and a regression test that loads it through DSG and verifies
the resulting Ed25519 signature. If wasm-mps changes its bincode layout
or the multi-party-schnorr Keyshare<G> struct gains new fields via Cargo
feature unification, DSG round 0 deserialization fails and CI catches the
breaking change before it reaches production.

Ticket: WCI-1476

Author: vibhavgo

modules/sdk-lib-mpc/test/fixtures/eddsaMPCv2Keyshares.ts

@@ -0,0 +1,33 @@
+// Generated: 2026-09-01
+// @bitgo/sdk-lib-mpc version: 10.18.0
+// Coin: EdDSA MPCv2 (3-party DKG, deterministic seeds)
+//
+// These are real bincode-serialized Keyshare<EdwardsPoint> blobs produced by
+// @bitgo/wasm-mps at the version pinned in sdk-lib-mpc at generation time.
+// If the wire format changes, DSG round0 will fail to deserialize these bytes,
+// making the regression test below the earliest signal of a breaking change.
+
+export const EDDSA_MPCV2_FIXTURES = {
+  commonKeychain:
+    '6baa8e5ff9598564971770ecf5e1e9015f54ba614d39ac891eaf38d71c8eb46f92cd4c5f1d950f933f83f3f5a5cec3b19ac527e099df3435708d5aaeb0d5840d',
+
+  // Opaque bincode-serialized Keyshare<EdwardsPoint> from @bitgo/wasm-mps
+  userKeyShare: Buffer.from(
+    '02030029e955f0a2b4eda4f79c002e53d68ff4d2ba4132e0a373a7152e2c23b1293b0a6baa8e5ff9598564971770ecf5e1e9015f54ba614d39ac891eaf38d71c8eb46f616f4774f13e0351b6a5e6de9d67bcd2d6904f4e538337b05b0771174daefd320092cd4c5f1d950f933f83f3f5a5cec3b19ac527e099df3435708d5aaeb0d5840d01fa4ed5a0d728ae2391b0b4e40091b03f1470b8a363bc04d73484e53e87a453',
+    'hex'
+  ),
+  backupKeyShare: Buffer.from(
+    '020301914acb96aa584e61b5767fed4fde813dcd211ca638bc67cb2b0744ee773952006baa8e5ff9598564971770ecf5e1e9015f54ba614d39ac891eaf38d71c8eb46f616f4774f13e0351b6a5e6de9d67bcd2d6904f4e538337b05b0771174daefd320092cd4c5f1d950f933f83f3f5a5cec3b19ac527e099df3435708d5aaeb0d5840d01fa4ed5a0d728ae2391b0b4e40091b03f1470b8a363bc04d73484e53e87a453',
+    'hex'
+  ),
+  bitgoKeyShare: Buffer.from(
+    '020302e67f369acc5fc17549edf54f2be0529bc788f61991d45bef41e05bb93e4969066baa8e5ff9598564971770ecf5e1e9015f54ba614d39ac891eaf38d71c8eb46f616f4774f13e0351b6a5e6de9d67bcd2d6904f4e538337b05b0771174daefd320092cd4c5f1d950f933f83f3f5a5cec3b19ac527e099df3435708d5aaeb0d5840d01fa4ed5a0d728ae2391b0b4e40091b03f1470b8a363bc04d73484e53e87a453',
+    'hex'
+  ),
+
+  // CBOR-encoded EddsaReducedKeyShare for the user party
+  userReducedKeyShare: Buffer.from(
+    'b90003686b6579536861726598a4020300182918e9185518f018a218b418ed18a418f7189c00182e185318d6188f18f418d218ba1841183218e018a3187318a715182e182c182318b11829183b0a186b18aa188e185f18f9185918851864189717187018ec18f518e118e901185f185418ba1861184d183918ac1889181e18af183818d7181c188e18b4186f1861186f1847187418f1183e03185118b618a518e618de189d186718bc18d218d61890184f184e18531883183718b0185b07187117184d18ae18fd183200189218cd184c185f181d18950f1893183f188318f318f518a518ce18c318b1189a18c5182718e0189918df183418351870188d185a18ae18b018d518840d0118fa184e18d518a018d7182818ae1823189118b018b418e400189118b0183f14187018b818a3186318bc0418d71834188418e5183e188718a41853637075629820186b18aa188e185f18f9185918851864189717187018ec18f518e118e901185f185418ba1861184d183918ac1889181e18af183818d7181c188e18b4186f6d726f6f74436861696e436f64659820189218cd184c185f181d18950f1893183f188318f318f518a518ce18c318b1189a18c5182718e0189918df183418351870188d185a18ae18b018d518840d',
+    'hex'
+  ),
+} as const;

modules/sdk-lib-mpc/test/unit/tss/eddsa/mpcv2Compatibility.ts

@@ -0,0 +1,116 @@
+/**
+ * Wire-format compatibility regression tests for EdDSA MPCv2 keyshares.
+ *
+ * These tests load *frozen* keyshare bytes captured at a specific @bitgo/sdk-lib-mpc
+ * version. If @bitgo/wasm-mps changes its bincode layout, DSG round 0 will throw
+ * while deserializing the fixture bytes — the earliest possible signal of a
+ * breaking change before it reaches production.
+ */
+import assert from 'assert';
+import crypto from 'crypto';
+import { ed25519 } from '@noble/curves/ed25519';
+import { EddsaMPSDsg, MPSTypes, MPSUtil } from '../../../../src/tss/eddsa-mps';
+import { EDDSA_MPCV2_FIXTURES } from '../../../fixtures/eddsaMPCv2Keyshares';
+
+const MESSAGE = Buffer.from('WCI-1476 EdDSA MPCv2 wire-format regression sentinel');
+
+describe('EdDSA MPCv2 wire-format compatibility', function () {
+  it('should deserialize frozen user keyshare without error (bincode format guard)', async function () {
+    const dsg = new EddsaMPSDsg.DSG(0);
+    await dsg.initDsg(EDDSA_MPCV2_FIXTURES.userKeyShare, MESSAGE, 'm', 2);
+    const msg = dsg.getFirstMessage();
+    assert(msg.payload.length > 0, 'DSG round 0 must produce a non-empty message');
+  });
+
+  it('should deserialize frozen backup keyshare without error', async function () {
+    const dsg = new EddsaMPSDsg.DSG(1);
+    await dsg.initDsg(EDDSA_MPCV2_FIXTURES.backupKeyShare, MESSAGE, 'm', 2);
+    const msg = dsg.getFirstMessage();
+    assert(msg.payload.length > 0, 'Backup DSG round 0 must produce a non-empty message');
+  });
+
+  it('should deserialize frozen bitgo keyshare without error', async function () {
+    const dsg = new EddsaMPSDsg.DSG(2);
+    await dsg.initDsg(EDDSA_MPCV2_FIXTURES.bitgoKeyShare, MESSAGE, 'm', 0);
+    const msg = dsg.getFirstMessage();
+    assert(msg.payload.length > 0, 'BitGo DSG round 0 must produce a non-empty message');
+  });
+
+  it('should produce a valid signature from frozen user+bitgo keyshares', async function () {
+    const sig = (await MPSUtil.executeTillRound(
+      3,
+      new EddsaMPSDsg.DSG(0),
+      new EddsaMPSDsg.DSG(2),
+      EDDSA_MPCV2_FIXTURES.userKeyShare,
+      EDDSA_MPCV2_FIXTURES.bitgoKeyShare,
+      MESSAGE,
+      'm'
+    )) as Buffer;
+
+    assert.strictEqual(sig.length, 64, 'Signature must be 64 bytes');
+
+    const pubKeyHex = EDDSA_MPCV2_FIXTURES.commonKeychain.slice(0, 64);
+    const pubKey = Buffer.from(pubKeyHex, 'hex');
+    assert(ed25519.verify(sig, MESSAGE, pubKey), 'Signature must verify under the frozen commonKeychain public key');
+  });
+
+  it('should produce a valid signature from frozen user+backup keyshares', async function () {
+    const sig = (await MPSUtil.executeTillRound(
+      3,
+      new EddsaMPSDsg.DSG(0),
+      new EddsaMPSDsg.DSG(1),
+      EDDSA_MPCV2_FIXTURES.userKeyShare,
+      EDDSA_MPCV2_FIXTURES.backupKeyShare,
+      MESSAGE,
+      'm'
+    )) as Buffer;
+
+    const pubKeyHex = EDDSA_MPCV2_FIXTURES.commonKeychain.slice(0, 64);
+    const pubKey = Buffer.from(pubKeyHex, 'hex');
+    assert(ed25519.verify(sig, MESSAGE, pubKey), 'Signature must verify under the frozen commonKeychain public key');
+  });
+
+  it('should decode frozen reducedKeyShare and match commonKeychain fields', function () {
+    const decoded = MPSTypes.getDecodedReducedKeyShare(EDDSA_MPCV2_FIXTURES.userReducedKeyShare);
+
+    const pubHex = EDDSA_MPCV2_FIXTURES.commonKeychain.slice(0, 64);
+    const chaincodeHex = EDDSA_MPCV2_FIXTURES.commonKeychain.slice(64);
+
+    assert.strictEqual(
+      Buffer.from(decoded.pub).toString('hex'),
+      pubHex,
+      'Decoded pub must match commonKeychain pubkey'
+    );
+    assert.strictEqual(
+      Buffer.from(decoded.rootChainCode).toString('hex'),
+      chaincodeHex,
+      'Decoded rootChainCode must match commonKeychain chaincode'
+    );
+    assert(decoded.keyShare.length > 0, 'keyShare in reducedKeyShare must be non-empty');
+  });
+
+  it('should reject randomised bytes as a keyshare (guard validation)', async function () {
+    const randomBytes = Buffer.from(crypto.randomBytes(EDDSA_MPCV2_FIXTURES.userKeyShare.length));
+    const dsg = new EddsaMPSDsg.DSG(0);
+    await dsg.initDsg(randomBytes, MESSAGE, 'm', 2);
+    assert.throws(
+      () => dsg.getFirstMessage(),
+      /Error while creating/,
+      'DSG round 0 must reject random bytes that are not a valid bincode keyshare'
+    );
+  });
+
+  it('should produce a valid signature at a derived path from frozen keyshares', async function () {
+    const sig = (await MPSUtil.executeTillRound(
+      3,
+      new EddsaMPSDsg.DSG(0),
+      new EddsaMPSDsg.DSG(2),
+      EDDSA_MPCV2_FIXTURES.userKeyShare,
+      EDDSA_MPCV2_FIXTURES.bitgoKeyShare,
+      MESSAGE,
+      'm/0/1'
+    )) as Buffer;
+
+    assert.strictEqual(sig.length, 64, 'Derived-path signature must be 64 bytes');
+  });
+});