The phantom luxfi/fhe/threshold and luxfi/fhe/pkg/threshold APIs the
RealThresholdDecryptor referenced (FHECiphertext, FHEThresholdShare,
KeyShare, ShareAggregator, PartialDecrypter, ...) were never built.
The canonical home for threshold-FHE primitives is
luxfi/threshold/protocols/tfhe — one and only one place.
Repoint the import; add the local replace directive until
luxfi/threshold cuts a release tag containing the new committee
surface; pkg/policy now compiles and 7/7 RealThresholdDecryptor tests
pass.
Implements the ThresholdDecryptor interface against the t-of-n
threshold-FHE service layer in luxfi/fhe/threshold.
RealThresholdDecryptor fans PartialDecrypt requests across configured
PartyClient peers, collects shares, and aggregates >=threshold valid
ones via the local ShareAggregator. The plaintext is rounded to a
boolean for the FHE policy verdict path.
Failure modes (insufficient quorum, peer errors, status non-OK) all
propagate as errors — the verifier wraps them as ErrFHEThresholdDec
and fails the policy gate closed.
go.mod adds a local replace for luxfi/fhe pending a release tag that
includes the threshold/ package.
Tests: 7/7 pass (2-of-3, 3-of-5, insufficient peers, two-peers-err
quorum-fail, one-peer-err quorum-pass, zero-threshold, roundToBool).
Full pkg/policy regression: 37/37 pass.
Adds a PlanProvider interface alongside the existing FChainClient.
When wired, the verifier prefers it: a precompiled, cached RulePlan
(see luxfi/fhe/policy) is evaluated locally against the per-intent
encrypted inputs and returns the same opaque verdict bytes the
ThresholdDecryptor already accepts.
The remote F-Chain path stays the default. Both can be wired
simultaneously; Plan wins if set. NewFHEVerifierWithPlan is the
factory for the local path.
Tests: PlanPathPrefersPlan (Plan beats FChain when both wired),
PlanPathDeny (encrypted-false -> ErrFHEVerdictDeny), PlanPathFailClosed
(eval error -> ErrFHEPolicyEval, decryptor untouched). All existing
FHEVerifier tests still pass unchanged.
Adds FHEVerifier — the encrypted-policy counterpart to the existing
LocalVerifier. FHEVerifier reads an FHE-encoded policy from F-Chain,
homomorphically evaluates it against the encrypted intent, and gates
signing on a threshold-decrypted boolean verdict.
Dependencies are interfaces (FChainClient, ThresholdDecryptor,
VelocityProvider) so the verifier is testable without the full crypto
stack and so the F-Chain transport layer can evolve independently.
Fail-closed semantics: missing deps, expired intent, unknown wallet,
F-Chain eval error, and threshold-decrypt error all reject.
- New file: pkg/policy/fhe_verifier.go (188 LOC)
- Tests: pkg/policy/fhe_verifier_test.go — 8/8 passing in <1s
- No changes to LocalVerifier or any existing code path.
zeekay