oprf-gate-2of3: add leg D (retry-then-success convergence)

[kwsantiago]

What

Add leg D to the oprf-gate-2of3 boot test: the box boots with both holders down (so the gate's first discovery attempt fails insufficient-peers), a holder then comes online mid-retry, and a later attempt converges to a mounted, serving vault.

Also raises the test's bootUnlockTimeoutSec from 45s to 100s so leg D has room to converge after a proven-failed first attempt, while leg C still fails closed well within its 180s wait.

Why

The test covered retry-then-fail-closed (leg C) and first-attempt unlock (legs A/B, holders pre-started), but never retry-then-success — a boot that fails an initial insufficient-peers attempt and converges once a holder appears. This is the real recovery path when a holder is slow to come up at boot (e.g. a geo-distributed holder), and it complements the in-attempt holder failover added in keep v0.7.4.

Deterministic by construction (not a race)

The bead was deferred because naively bringing a holder up races its startup against the gate deadline. This leg avoids the race:

1. Boot holders-down; wait until the gate is actively retrying (ActiveState=activating).
2. Sleep one full ~24s discovery cycle.
3. Assert the vault is still locked AND the gate is still retrying — deterministic proof the first attempt failed with budget remaining (no holder was reachable, so nothing could have unlocked).
4. Only then bring a holder online, and assert convergence via the existing gate_unlocked_boot() (gate goes active, vault mounted, Vaultwarden up).

Verification

Ran the full 4-VM test locally: passed (987s), all legs A-D green, on the first run (the determinism holds).

Closes keep-node-asf.

Summary by CodeRabbit

• Tests
  • Expanded boot-unlock coverage for the FROST gate with a longer retry window.
  • Added a scenario verifying that the vault remains locked during retries and unlocks successfully when quorum becomes available.
  • Updated fail-closed validation to confirm the gate stays unavailable when quorum cannot be reached.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 57c9f806-08e9-4375-b737-be715f84a8db

📥 Commits

Reviewing files that changed from the base of the PR and between 75825f8 and be79d4e.

📒 Files selected for processing (1)

• tests/oprf-gate-2of3.nix

---

Walkthrough

The OPRF gate test increases its boot-unlock retry timeout, adds a retry-then-success scenario with delayed holder availability, and updates the fail-closed scenario to stop the new holder service before rebooting.

Changes

OPRF retry validation

Layer / File(s)	Summary
Retry budget and timing setup tests/oprf-gate-2of3.nix	The frost gate timeout increases from 45 to 100 seconds, with updated retry expectations.
Retry success and fail-closed scenarios tests/oprf-gate-2of3.nix	Leg D verifies that a later retry unlocks the vault after one holder starts; Leg C stops the holder service and reboots to validate the no-quorum fail-closed path.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant TestBox
  participant FrostGate
  participant HolderService
  participant Vault
  TestBox->>FrostGate: reboot with holders unavailable
  FrostGate->>FrostGate: enter activating retry state
  TestBox->>FrostGate: verify vault remains locked
  TestBox->>HolderService: start one holder service
  FrostGate->>HolderService: retry unlock request
  HolderService-->>FrostGate: holder response
  FrostGate->>Vault: unlock and mount vault

Loading

Possibly related PRs

• privkeyio/keep-node#78: Introduces the OPRF 2-of-3 boot-unlock retry behavior exercised by this test.

Poem

A rabbit watched the gate retry,
While sleepy holders passed it by.
One woke up; the vault said “Go!”
No quorum? Locked tight below.
Retry brought success—hooray! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change by adding Leg D and describing the retry-then-success behavior.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch oprf-gate-retry-success

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}