feat(primitives): add native multisig wire types

[joshieDo]

Defines bounded native multisig configuration and signature wire formats together with the public precompile ABI. Execution remains inactive behind an explicit validation guard; extracted from #4069.

Stacked on #7242.

Do not merge: this branch temporarily pins mpp-rs #391 through Foundry #16213. Merge both upstream PRs, restore the Foundry checkouts in specs.yml to master, and rerun CI first.

[github-actions]

✅ Changelog found on PR.

Edit changelog

[joshieDo]

cyclops audit fast note="extracted from #4069, check that PR for the spec"

[tempoxyz-bot]

👁️ Cyclops Review

This change adds bounded native-multisig wire types and a public precompile ABI while keeping execution inactive. One critical authorization bypass remains actionable on the current head after rechecking the drifted diff; details are inline.

Reviewer Callouts

• ⚡ Polymorphic signer recovery: Audit every consumer of TempoSignature::recover_signer; multisig recovery returns a claimed account rather than cryptographically proving authority.
• ⚡ Multisig verification gas: The zero-cost assumption is sound only if every carrier path is rejected before intrinsic gas; add per-approval pricing before activation.

[github-actions]

📊 Tempo Precompiles Coverage

precompiles

Coverage: 6435/10593 lines (60.75%)

File details

File	Lines	Coverage
src/account_keychain/dispatch.rs	16/42	38.10%
src/account_keychain/mod.rs	310/896	34.60%
src/address_registry/dispatch.rs	21/27	77.78%
src/address_registry/mod.rs	50/60	83.33%
src/current_committee/dispatch.rs	0/9	0.00%
src/current_committee/mod.rs	0/18	0.00%
src/dispatch.rs	126/152	82.89%
src/error.rs	52/166	31.33%
src/ip_validation.rs	10/10	100.00%
src/lib.rs	127/143	88.81%
src/nonce/dispatch.rs	6/7	85.71%
src/nonce/mod.rs	44/58	75.86%
src/receive_policy_guard/dispatch.rs	0/12	0.00%
src/receive_policy_guard/mod.rs	0/139	0.00%
src/signature_verifier/dispatch.rs	15/23	65.22%
src/signature_verifier/mod.rs	13/55	23.64%
src/stablecoin_dex/dispatch.rs	59/71	83.10%
src/stablecoin_dex/mod.rs	989/1097	90.15%
src/stablecoin_dex/order/mod.rs	120/154	77.92%
src/stablecoin_dex/order/storage.rs	178/249	71.49%
src/stablecoin_dex/orderbook.rs	183/242	75.62%
src/storage/actions.rs	11/90	12.22%
src/storage/evm.rs	390/437	89.24%
src/storage/hashmap.rs	0/241	0.00%
src/storage/mod.rs	27/69	39.13%
src/storage/packing.rs	68/93	73.12%
src/storage/thread_local.rs	200/296	67.57%
src/storage/types/array.rs	0/72	0.00%
src/storage/types/bytes_like.rs	135/179	75.42%
src/storage/types/cache.rs	65/122	53.28%
src/storage/types/mapping.rs	27/48	56.25%
src/storage/types/mod.rs	47/71	66.20%
src/storage/types/primitives.rs	21/24	87.50%
src/storage/types/set.rs	28/192	14.58%
src/storage/types/slot.rs	80/101	79.21%
src/storage/types/vec.rs	103/261	39.46%
src/storage_credits/accounting.rs	79/92	85.87%
src/storage_credits/dispatch.rs	16/16	100.00%
src/storage_credits/mod.rs	138/193	71.50%
src/tip20/dispatch.rs	64/73	87.67%
src/tip20/mod.rs	657/801	82.02%
src/tip20/rewards.rs	242/260	93.08%
src/tip20/roles.rs	85/88	96.59%
src/tip20_channel_reserve/dispatch.rs	0/42	0.00%
src/tip20_channel_reserve/mod.rs	3/548	0.55%
src/tip20_factory/dispatch.rs	9/11	81.82%
src/tip20_factory/mod.rs	117/140	83.57%
src/tip403_registry/dispatch.rs	29/46	63.04%
src/tip403_registry/mod.rs	347/544	63.79%
src/tip_fee_manager/amm.rs	295/465	63.44%
src/tip_fee_manager/dispatch.rs	35/37	94.59%
src/tip_fee_manager/mod.rs	56/155	36.13%
src/validator_config/dispatch.rs	18/28	64.29%
src/validator_config/mod.rs	171/227	75.33%
src/validator_config_v2/dispatch.rs	30/33	90.91%
src/validator_config_v2/mod.rs	523/581	90.02%
src/zone_factory/dispatch.rs	0/15	0.00%
src/zone_factory/mod.rs	0/215	0.00%
src/zone_factory/portal.rs	0/57	0.00%

contracts

Coverage: 1/202 lines (0.50%)

File details

File	Lines	Coverage
src/lib.rs	1/1	100.00%
src/precompiles/receive_policy_guard.rs	0/78	0.00%
src/precompiles/storage_credits.rs	0/7	0.00%
src/precompiles/tip20.rs	0/50	0.00%
src/precompiles/tip20_channel_reserve.rs	0/27	0.00%
src/precompiles/tip403_registry.rs	0/9	0.00%
src/precompiles/validator_config_v2.rs	0/3	0.00%
src/precompiles/zone_factory.rs	0/27	0.00%

Total: 6436/10795 lines (59.62%)

📦 Download full HTML report

[joshieDo]

cyclops audit fast note="this belongs to the GH stack #7243 and the TIP 1061 is specified in the PR 7242. any bug not introduced by this PR should be clearly marked"

[tempoxyz-bot]

👁️ Cyclops Review

This change introduces TIP-1061 native-multisig wire types, validation helpers, and pre-activation handling. One verified High-severity consensus flaw remains: the pre-T11 activation gate covers only the outer AA signature, allowing type 0x05 through authorization-list entries and creating transaction-validity divergence between upgraded and non-upgraded nodes.

Reviewer Callouts

• ⚡ Reserved address namespaces (crates/primitives/src/transaction/multisig.rs:450–472): InitMultisig::account() rejects only the zero address, while TIP-1061 also requires excluding virtual, active-precompile, and TIP-20 namespaces. Add those checks before bootstrap activation at T11.
• ⚡ Nested signature size (crates/primitives/src/transaction/multisig.rs:949–958): nested multisig approvals bypass MAX_MULTISIG_OWNER_SIGNATURE_BYTES; structural limits permit an encoding near 131 KB, slightly above reth's default 128 KB transaction-input limit. Confirm pool and consensus size limits are aligned before T11.
• ⚡ Infallible constructors (crates/primitives/src/transaction/multisig.rs:511–518,588–590): MultisigAddress::account() and MultisigSignature::new() panic if validation invariants are violated. Ensure the T11 precompile uses fallible construction and cannot introduce an unchecked path.

[joshieDo]

cyclops audit fast note="this belongs to the GH stack #7243 and the TIP 1061 is specified in the PR 7242. any bug not introduced by this PR should be clearly marked"

[tempoxyz-bot]

👁️ Cyclops Review

This change adds TIP-1061 native-multisig parsing while keeping execution disabled. One verified high-severity activation-guard gap can split consensus before T11; two low-severity validation gaps are currently latent.

Reviewer Callouts

• ⚡ Nested payload bounds: validate_shape caps only primitive approvals individually; add a total encoded-size bound before T11 activation.
• ⚡ 65-byte round-trip ambiguity: An exactly 65-byte multisig encoding serializes as 0x05 but decodes as secp256k1, which is unsafe for compact database round trips.
• ⚡ Deferred authorization invariants: Before enabling execution, enforce initialized-only nested signatures, owner membership, quorum, and rejection of signatures after quorum.

[joshieDo]

cyclops audit fast note="this belongs to the GH stack #7243 and the TIP 1061 is specified in the PR 7242. any bug not introduced by this PR should be clearly marked"

[tempoxyz-bot]

👁️ Cyclops Review

This PR adds TIP-1061 native-multisig wire types, decoding, and ABI declarations while keeping execution disabled behind NativeMultisigNotActive. The activation gate prevents a live authorization exploit, but three stateless validation and construction invariants remain under-enforced.

Reviewer Callouts

• ⚡ Activation gas accounting: crates/revm/src/signature_gas.rs:45 charges zero for multisig verification. The activation change must add bounded per-owner verification gas in the same change that removes NativeMultisigNotActive.
• ⚡ Unauthenticated stateless recovery: Initialized multisig recovery returns the account supplied by the payload before stateful authorization. Future pool, RPC, and subblock consumers must not treat that recovered address as authenticated until the stateful verifier succeeds.
• ⚡ Payload bounds: Nested approvals are exempt from the primitive owner-signature byte cap, while the authorization-list length is only pool-bounded. Reassess consensus-level transaction payload and verification-work bounds before activation.
• ⚡ RPC compatibility: The hand-written TempoSignature JSON deserializer replaces the prior derived untagged behavior for every signature type. Run compatibility coverage for existing primitive and keychain JSON forms.