@aztec/validator-ha-signer 0.0.1-commit.a072138 → 0.0.1-commit.a5db02d

package/src/slashing_protection_service.ts

@@ -7,6 +7,8 @@
 import { type Logger, createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/promise';
 import { sleep } from '@aztec/foundation/sleep';
+import type { DateProvider } from '@aztec/foundation/timer';
+import type { BaseSignerConfig } from '@aztec/stdlib/ha-signing';
 
 import {
   type CheckAndRecordParams,
@@ -16,7 +18,16 @@ import {
   getBlockIndexFromDutyIdentifier,
 } from './db/types.js';
 import { DutyAlreadySignedError, SlashingProtectionError } from './errors.js';
-import type { SlashingProtectionDatabase, ValidatorHASignerConfig } from './types.js';
+import type { HASignerMetrics } from './metrics.js';
+import type { SlashingProtectionDatabase } from './types.js';
+
+export interface SlashingProtectionServiceDeps {
+  metrics: HASignerMetrics;
+  dateProvider: DateProvider;
+}
+
+/** Default max age (ms) of a stuck SIGNING duty before cleanup reclaims it: 2x the 72s Aztec slot duration. */
+export const DEFAULT_MAX_STUCK_DUTIES_AGE_MS = 144_000;
 
 /**
  * Slashing Protection Service
@@ -36,26 +47,28 @@ import type { SlashingProtectionDatabase, ValidatorHASignerConfig } from './type
 export class SlashingProtectionService {
   private readonly log: Logger;
   private readonly pollingIntervalMs: number;
-  private readonly signingTimeoutMs: number;
+  private readonly peerSigningTimeoutMs: number;
   private readonly maxStuckDutiesAgeMs: number;
 
+  private readonly metrics: HASignerMetrics;
+  private readonly dateProvider: DateProvider;
+
   private cleanupRunningPromise: RunningPromise;
+  private lastOldDutiesCleanupAtMs?: number;
 
   constructor(
     private readonly db: SlashingProtectionDatabase,
-    private readonly config: ValidatorHASignerConfig,
+    private readonly config: BaseSignerConfig,
+    deps: SlashingProtectionServiceDeps,
   ) {
     this.log = createLogger('slashing-protection');
     this.pollingIntervalMs = config.pollingIntervalMs;
-    this.signingTimeoutMs = config.signingTimeoutMs;
-    // Default to 144s (2x 72s Aztec slot duration) if not explicitly configured
-    this.maxStuckDutiesAgeMs = config.maxStuckDutiesAgeMs ?? 144_000;
-
-    this.cleanupRunningPromise = new RunningPromise(
-      this.cleanupStuckDuties.bind(this),
-      this.log,
-      this.maxStuckDutiesAgeMs,
-    );
+    this.peerSigningTimeoutMs = config.peerSigningTimeoutMs;
+    this.maxStuckDutiesAgeMs = config.maxStuckDutiesAgeMs ?? DEFAULT_MAX_STUCK_DUTIES_AGE_MS;
+
+    this.cleanupRunningPromise = new RunningPromise(this.cleanup.bind(this), this.log, this.maxStuckDutiesAgeMs);
+    this.metrics = deps.metrics;
+    this.dateProvider = deps.dateProvider;
   }
 
   /**
@@ -67,7 +80,6 @@ export class SlashingProtectionService {
    * 2. If insert succeeds, we acquired the lock - return the lockToken
    * 3. If a record exists, handle based on status:
    *    - SIGNED: Throw appropriate error (already signed or slashing protection)
-   *    - FAILED: Delete the failed record
    *    - SIGNING: Wait and poll until status changes, then handle result
    *
    * @returns The lockToken that must be used for recordSuccess/deleteDuty
@@ -76,7 +88,7 @@ export class SlashingProtectionService {
    */
   async checkAndRecord(params: CheckAndRecordParams): Promise<string> {
     const { validatorAddress, slot, dutyType, messageHash, nodeId } = params;
-    const startTime = Date.now();
+    const startTime = this.dateProvider.now();
 
     this.log.debug(`Checking duty: ${dutyType} for slot ${slot}`, {
       validatorAddress: validatorAddress.toString(),
@@ -89,10 +101,11 @@ export class SlashingProtectionService {
 
       if (isNew) {
         // We successfully acquired the lock
-        this.log.info(`Acquired lock for duty ${dutyType} at slot ${slot}`, {
+        this.log.verbose(`Acquired lock for duty ${dutyType} at slot ${slot}`, {
           validatorAddress: validatorAddress.toString(),
           nodeId,
         });
+        this.metrics.recordLockAcquire(true);
         return record.lockToken;
       }
 
@@ -107,6 +120,7 @@ export class SlashingProtectionService {
             existingNodeId: record.nodeId,
             attemptingNodeId: nodeId,
           });
+          this.metrics.recordSlashingProtection(dutyType);
           throw new SlashingProtectionError(
             slot,
             dutyType,
@@ -116,15 +130,17 @@ export class SlashingProtectionService {
             record.nodeId,
           );
         }
+        this.metrics.recordDutyAlreadySigned(dutyType);
         throw new DutyAlreadySignedError(slot, dutyType, record.blockIndexWithinCheckpoint, record.nodeId);
       } else if (record.status === DutyStatus.SIGNING) {
         // Another node is currently signing - check for timeout
-        if (Date.now() - startTime > this.signingTimeoutMs) {
+        if (this.dateProvider.now() - startTime > this.peerSigningTimeoutMs) {
           this.log.warn(`Timeout waiting for signing to complete for duty ${dutyType} at slot ${slot}`, {
             validatorAddress: validatorAddress.toString(),
-            timeoutMs: this.signingTimeoutMs,
+            timeoutMs: this.peerSigningTimeoutMs,
             signingNodeId: record.nodeId,
           });
+          this.metrics.recordDutyAlreadySigned(dutyType);
           throw new DutyAlreadySignedError(slot, dutyType, record.blockIndexWithinCheckpoint, 'unknown (timeout)');
         }
 
@@ -149,10 +165,11 @@ export class SlashingProtectionService {
    * @returns true if the update succeeded, false if token didn't match
    */
   async recordSuccess(params: RecordSuccessParams): Promise<boolean> {
-    const { validatorAddress, slot, dutyType, signature, nodeId, lockToken } = params;
+    const { rollupAddress, validatorAddress, slot, dutyType, signature, nodeId, lockToken } = params;
     const blockIndexWithinCheckpoint = getBlockIndexFromDutyIdentifier(params);
 
     const success = await this.db.updateDutySigned(
+      rollupAddress,
       validatorAddress,
       slot,
       dutyType,
@@ -162,7 +179,7 @@ export class SlashingProtectionService {
     );
 
     if (success) {
-      this.log.info(`Recorded successful signing for duty ${dutyType} at slot ${slot}`, {
+      this.log.verbose(`Recorded successful signing for duty ${dutyType} at slot ${slot}`, {
         validatorAddress: validatorAddress.toString(),
         nodeId,
       });
@@ -184,10 +201,17 @@ export class SlashingProtectionService {
    * @returns true if the delete succeeded, false if token didn't match
    */
   async deleteDuty(params: DeleteDutyParams): Promise<boolean> {
-    const { validatorAddress, slot, dutyType, lockToken } = params;
+    const { rollupAddress, validatorAddress, slot, dutyType, lockToken } = params;
     const blockIndexWithinCheckpoint = getBlockIndexFromDutyIdentifier(params);
 
-    const success = await this.db.deleteDuty(validatorAddress, slot, dutyType, lockToken, blockIndexWithinCheckpoint);
+    const success = await this.db.deleteDuty(
+      rollupAddress,
+      validatorAddress,
+      slot,
+      dutyType,
+      lockToken,
+      blockIndexWithinCheckpoint,
+    );
 
     if (success) {
       this.log.info(`Deleted duty ${dutyType} at slot ${slot} to allow retry`, {
@@ -213,7 +237,20 @@ export class SlashingProtectionService {
    * Start running tasks.
    * Cleanup runs immediately on start to recover from any previous crashes.
    */
-  start() {
+  /**
+   * Start the background cleanup task.
+   * Also performs one-time cleanup of duties with outdated rollup addresses.
+   */
+  async start() {
+    // One-time cleanup at startup: remove duties from previous rollup versions
+    const numOutdatedRollupDuties = await this.db.cleanupOutdatedRollupDuties(this.config.rollupAddress);
+    if (numOutdatedRollupDuties > 0) {
+      this.log.info(`Cleaned up ${numOutdatedRollupDuties} duties with outdated rollup address at startup`, {
+        currentRollupAddress: this.config.rollupAddress.toString(),
+      });
+      this.metrics.recordCleanup('outdated_rollup', numOutdatedRollupDuties);
+    }
+
     this.cleanupRunningPromise.start();
     this.log.info('Slashing protection service started', { nodeId: this.config.nodeId });
   }
@@ -236,15 +273,41 @@ export class SlashingProtectionService {
   }
 
   /**
-   * Cleanup own stuck duties
+   * Periodic cleanup of stuck duties and optionally old signed duties.
+   * Runs in the background via RunningPromise.
    */
-  private async cleanupStuckDuties() {
-    const numDuties = await this.db.cleanupOwnStuckDuties(this.config.nodeId, this.maxStuckDutiesAgeMs);
-    if (numDuties > 0) {
-      this.log.info(`Cleaned up ${numDuties} stuck duties`, {
+  private async cleanup() {
+    // 1. Clean up stuck duties (our own node's duties that got stuck in 'signing' status).
+    // This cannot race an in-flight signing: every signing operation is hard-bounded by a timeout
+    // clamped below maxStuckDutiesAgeMs / 2 (see ValidatorHASigner), so a live SIGNING row is
+    // always released long before it can be considered stuck.
+    const numStuckDuties = await this.db.cleanupOwnStuckDuties(this.config.nodeId, this.maxStuckDutiesAgeMs);
+    if (numStuckDuties > 0) {
+      this.log.verbose(`Cleaned up ${numStuckDuties} stuck duties`, {
         nodeId: this.config.nodeId,
         maxStuckDutiesAgeMs: this.maxStuckDutiesAgeMs,
       });
+      this.metrics.recordCleanup('stuck', numStuckDuties);
+    }
+
+    // 2. Clean up old signed duties if configured
+    // we shouldn't run this as often as stuck duty cleanup.
+    if (this.config.cleanupOldDutiesAfterHours !== undefined) {
+      const maxAgeMs = this.config.cleanupOldDutiesAfterHours * 60 * 60 * 1000;
+      const nowMs = this.dateProvider.now();
+      const shouldRun =
+        this.lastOldDutiesCleanupAtMs === undefined || nowMs - this.lastOldDutiesCleanupAtMs >= maxAgeMs;
+      if (shouldRun) {
+        const numOldDuties = await this.db.cleanupOldDuties(maxAgeMs);
+        this.lastOldDutiesCleanupAtMs = nowMs;
+        if (numOldDuties > 0) {
+          this.log.verbose(`Cleaned up ${numOldDuties} old signed duties`, {
+            cleanupOldDutiesAfterHours: this.config.cleanupOldDutiesAfterHours,
+            maxAgeMs,
+          });
+          this.metrics.recordCleanup('old', numOldDuties);
+        }
+      }
     }
   }
 }

package/src/types.ts

@@ -1,36 +1,51 @@
-import {
-  BlockNumber,
-  type CheckpointNumber,
-  type IndexWithinCheckpoint,
-  type SlotNumber,
-} from '@aztec/foundation/branded-types';
+import { SlotNumber } from '@aztec/foundation/branded-types';
 import type { EthAddress } from '@aztec/foundation/eth-address';
+import { DateProvider } from '@aztec/foundation/timer';
+import {
+  type AttestationSigningContext,
+  type CheckpointProposalSigningContext,
+  DutyType,
+  type HAProtectedSigningContext,
+  type SigningContext,
+  type ValidatorHASignerConfig,
+  getBlockNumberFromSigningContext as getBlockNumberFromSigningContextFromStdlib,
+  getCheckpointNumberFromSigningContext as getCheckpointNumberFromSigningContextFromStdlib,
+  isHAProtectedContext,
+} from '@aztec/stdlib/ha-signing';
+import type { TelemetryClient } from '@aztec/telemetry-client';
 
 import type { Pool } from 'pg';
 
-import type { ValidatorHASignerConfig } from './config.js';
-import {
-  type BlockProposalDutyIdentifier,
-  type CheckAndRecordParams,
-  type DeleteDutyParams,
-  type DutyIdentifier,
-  DutyType,
-  type OtherDutyIdentifier,
-  type RecordSuccessParams,
-  type ValidatorDutyRecord,
+import type {
+  BlockProposalDutyIdentifier,
+  CheckAndRecordParams,
+  DeleteDutyParams,
+  DutyIdentifier,
+  DutyRow,
+  OtherDutyIdentifier,
+  RecordSuccessParams,
+  ValidatorDutyRecord,
 } from './db/types.js';
 
 export type {
+  AttestationSigningContext,
   BlockProposalDutyIdentifier,
   CheckAndRecordParams,
+  CheckpointProposalSigningContext,
   DeleteDutyParams,
   DutyIdentifier,
+  DutyRow,
+  HAProtectedSigningContext,
   OtherDutyIdentifier,
   RecordSuccessParams,
+  SigningContext,
   ValidatorDutyRecord,
   ValidatorHASignerConfig,
 };
 export { DutyStatus, DutyType, getBlockIndexFromDutyIdentifier, normalizeBlockIndex } from './db/types.js';
+export { isHAProtectedContext };
+export { getBlockNumberFromSigningContextFromStdlib as getBlockNumberFromSigningContext };
+export { getCheckpointNumberFromSigningContextFromStdlib as getCheckpointNumberFromSigningContext };
 
 /**
  * Result of tryInsertOrGetExisting operation
@@ -51,99 +66,20 @@ export interface CreateHASignerDeps {
    * If provided, databaseUrl and poolConfig are ignored
    */
   pool?: Pool;
-}
-
-/**
- * Base context for signing operations
- */
-interface BaseSigningContext {
-  /** Slot number for this duty */
-  slot: SlotNumber;
   /**
-   * Block or checkpoint number for this duty.
-   * For block proposals, this is the block number.
-   * For checkpoint proposals, this is the checkpoint number.
+   * Optional telemetry client for metrics
    */
-  blockNumber: BlockNumber | CheckpointNumber;
-}
-
-/**
- * Signing context for block proposals.
- * blockIndexWithinCheckpoint is REQUIRED and must be >= 0.
- */
-export interface BlockProposalSigningContext extends BaseSigningContext {
-  /** Block index within checkpoint (0, 1, 2...). Required for block proposals. */
-  blockIndexWithinCheckpoint: IndexWithinCheckpoint;
-  dutyType: DutyType.BLOCK_PROPOSAL;
-}
-
-/**
- * Signing context for non-block-proposal duties that require HA protection.
- * blockIndexWithinCheckpoint is not applicable (internally always -1).
- */
-export interface OtherSigningContext extends BaseSigningContext {
-  dutyType: DutyType.CHECKPOINT_PROPOSAL | DutyType.ATTESTATION | DutyType.ATTESTATIONS_AND_SIGNERS;
-}
-
-/**
- * Signing context for governance/slashing votes which only need slot for HA protection.
- * blockNumber is not applicable (internally always 0).
- */
-export interface VoteSigningContext {
-  slot: SlotNumber;
-  dutyType: DutyType.GOVERNANCE_VOTE | DutyType.SLASHING_VOTE;
-}
-
-/**
- * Signing context for duties which don't require slot/blockNumber
- * as they don't need HA protection (AUTH_REQUEST, TXS).
- */
-export interface NoHAProtectionSigningContext {
-  dutyType: DutyType.AUTH_REQUEST | DutyType.TXS;
-}
-
-/**
- * Signing contexts that require HA protection (excludes AUTH_REQUEST).
- * Used by the HA signer's signWithProtection method.
- */
-export type HAProtectedSigningContext = BlockProposalSigningContext | OtherSigningContext | VoteSigningContext;
-
-/**
- * Type guard to check if a SigningContext requires HA protection.
- * Returns true for contexts that need HA protection, false for AUTH_REQUEST and TXS.
- */
-export function isHAProtectedContext(context: SigningContext): context is HAProtectedSigningContext {
-  return context.dutyType !== DutyType.AUTH_REQUEST && context.dutyType !== DutyType.TXS;
-}
-
-/**
- * Gets the block number from a signing context.
- * - Vote duties (GOVERNANCE_VOTE, SLASHING_VOTE): returns BlockNumber(0)
- * - Other duties: returns the blockNumber from the context
- */
-export function getBlockNumberFromSigningContext(context: HAProtectedSigningContext): BlockNumber | CheckpointNumber {
-  // Check for duty types that have blockNumber
-  if (
-    context.dutyType === DutyType.BLOCK_PROPOSAL ||
-    context.dutyType === DutyType.CHECKPOINT_PROPOSAL ||
-    context.dutyType === DutyType.ATTESTATION ||
-    context.dutyType === DutyType.ATTESTATIONS_AND_SIGNERS
-  ) {
-    return context.blockNumber;
-  }
-  // Vote duties (GOVERNANCE_VOTE, SLASHING_VOTE) don't have blockNumber
-  return BlockNumber(0);
+  telemetryClient?: TelemetryClient;
+  /**
+   * Optional date provider for timestamps
+   */
+  dateProvider?: DateProvider;
 }
 
 /**
- * Context required for slashing protection during signing operations.
- * Uses discriminated union to enforce type safety:
- * - BLOCK_PROPOSAL duties MUST have blockIndexWithinCheckpoint >= 0
- * - Other duty types do NOT have blockIndexWithinCheckpoint (internally -1)
- * - Vote duties only need slot (blockNumber is internally 0)
- * - AUTH_REQUEST and TXS duties don't need slot/blockNumber (no HA protection needed)
+ * deps for creating a local signing protection signer
  */
-export type SigningContext = HAProtectedSigningContext | NoHAProtectionSigningContext;
+export type CreateLocalSignerWithProtectionDeps = Omit<CreateHASignerDeps, 'pool'>;
 
 /**
  * Database interface for slashing protection operations
@@ -170,6 +106,7 @@ export interface SlashingProtectionDatabase {
    * @returns true if the update succeeded, false if token didn't match or duty not found
    */
   updateDutySigned(
+    rollupAddress: EthAddress,
     validatorAddress: EthAddress,
     slot: SlotNumber,
     dutyType: DutyType,
@@ -186,6 +123,7 @@ export interface SlashingProtectionDatabase {
    * @returns true if the delete succeeded, false if token didn't match or duty not found
    */
   deleteDuty(
+    rollupAddress: EthAddress,
     validatorAddress: EthAddress,
     slot: SlotNumber,
     dutyType: DutyType,
@@ -199,6 +137,21 @@ export interface SlashingProtectionDatabase {
    */
   cleanupOwnStuckDuties(nodeId: string, maxAgeMs: number): Promise<number>;
 
+  /**
+   * Cleanup duties with outdated rollup address.
+   * Removes all duties where the rollup address doesn't match the current one.
+   * Used after a rollup upgrade to clean up duties for the old rollup.
+   * @returns the number of duties cleaned up
+   */
+  cleanupOutdatedRollupDuties(currentRollupAddress: EthAddress): Promise<number>;
+
+  /**
+   * Cleanup old signed duties.
+   * Removes only signed duties older than the specified age.
+   * @returns the number of duties cleaned up
+   */
+  cleanupOldDuties(maxAgeMs: number): Promise<number>;
+
   /**
    * Close the database connection.
    * Should be called during graceful shutdown.

package/src/validator_ha_signer.ts

@@ -6,18 +6,31 @@
  * node will sign for a given duty (slot + duty type).
  */
 import type { Buffer32 } from '@aztec/foundation/buffer';
-import type { EthAddress } from '@aztec/foundation/eth-address';
+import { EthAddress } from '@aztec/foundation/eth-address';
 import type { Signature } from '@aztec/foundation/eth-signature';
 import { type Logger, createLogger } from '@aztec/foundation/log';
-
-import type { ValidatorHASignerConfig } from './config.js';
-import { type DutyIdentifier, DutyType } from './db/types.js';
-import { SlashingProtectionService } from './slashing_protection_service.js';
+import { type DateProvider, executeTimeout } from '@aztec/foundation/timer';
 import {
+  type BaseSignerConfig,
+  DutyType,
   type HAProtectedSigningContext,
-  type SlashingProtectionDatabase,
   getBlockNumberFromSigningContext,
-} from './types.js';
+  getCheckpointNumberFromSigningContext,
+} from '@aztec/stdlib/ha-signing';
+
+import type { DutyIdentifier } from './db/types.js';
+import { SigningLockLostError } from './errors.js';
+import type { HASignerMetrics } from './metrics.js';
+import { DEFAULT_MAX_STUCK_DUTIES_AGE_MS, SlashingProtectionService } from './slashing_protection_service.js';
+import type { SlashingProtectionDatabase } from './types.js';
+
+export interface ValidatorHASignerDeps {
+  metrics: HASignerMetrics;
+  dateProvider: DateProvider;
+}
+
+/** Default hard timeout (ms) for a single signer call when not configured. */
+const DEFAULT_SIGNER_CALL_TIMEOUT_MS = 30_000;
 
 /**
  * Validator High Availability Signer
@@ -41,24 +54,47 @@ import {
 export class ValidatorHASigner {
   private readonly log: Logger;
   private readonly slashingProtection: SlashingProtectionService;
+  private readonly rollupAddress: EthAddress;
+
+  private readonly dateProvider: DateProvider;
+  private readonly metrics: HASignerMetrics;
+  private readonly signerCallTimeoutMs: number;
 
   constructor(
     db: SlashingProtectionDatabase,
-    private readonly config: ValidatorHASignerConfig,
+    private readonly config: BaseSignerConfig,
+    deps: ValidatorHASignerDeps,
   ) {
     this.log = createLogger('validator-ha-signer');
 
-    if (!config.haSigningEnabled) {
-      // this shouldn't happen, the validator should use different signer for non-HA setups
-      throw new Error('Validator HA Signer is not enabled in config');
-    }
+    this.metrics = deps.metrics;
+    this.dateProvider = deps.dateProvider;
+
+    // Clamp the signer-call timeout below half the stuck-duty max age. This maintains the
+    // invariant that an in-flight signing always times out and releases its SIGNING row well before
+    // stuck-duty cleanup could consider it stuck, so cleanup can never delete a live duty (only
+    // signWithProtection writes SIGNING rows, and every path through it is bounded by this timeout).
+    // If timers misbehave anyway, the recordSuccess-returns-false throw is the backstop: the duty
+    // fails instead of broadcasting an unprotected signature.
+    const maxStuckDutiesAgeMs = config.maxStuckDutiesAgeMs ?? DEFAULT_MAX_STUCK_DUTIES_AGE_MS;
+    this.signerCallTimeoutMs = Math.min(
+      config.signerCallTimeoutMs ?? DEFAULT_SIGNER_CALL_TIMEOUT_MS,
+      maxStuckDutiesAgeMs / 2,
+    );
 
     if (!config.nodeId || config.nodeId === '') {
       throw new Error('NODE_ID is required for high-availability setups');
     }
-    this.slashingProtection = new SlashingProtectionService(db, config);
+    this.rollupAddress = config.rollupAddress;
+    this.slashingProtection = new SlashingProtectionService(db, config, {
+      metrics: deps.metrics,
+      dateProvider: deps.dateProvider,
+    });
+
     this.log.info('Validator HA Signer initialized with slashing protection', {
       nodeId: config.nodeId,
+      rollupAddress: this.rollupAddress.toString(),
+      signerCallTimeoutMs: this.signerCallTimeoutMs,
     });
   }
 
@@ -85,9 +121,13 @@ export class ValidatorHASigner {
     context: HAProtectedSigningContext,
     signFn: (messageHash: Buffer32) => Promise<Signature>,
   ): Promise<Signature> {
+    const startTime = this.dateProvider.now();
+    const dutyType = context.dutyType;
+
     let dutyIdentifier: DutyIdentifier;
     if (context.dutyType === DutyType.BLOCK_PROPOSAL) {
       dutyIdentifier = {
+        rollupAddress: this.rollupAddress,
         validatorAddress,
         slot: context.slot,
         blockIndexWithinCheckpoint: context.blockIndexWithinCheckpoint,
@@ -95,6 +135,7 @@ export class ValidatorHASigner {
       };
     } else {
       dutyIdentifier = {
+        rollupAddress: this.rollupAddress,
         validatorAddress,
         slot: context.slot,
         dutyType: context.dutyType,
@@ -102,31 +143,56 @@ export class ValidatorHASigner {
     }
 
     // Acquire lock and get the token for ownership verification
+    // DutyAlreadySignedError and SlashingProtectionError may be thrown here and are recorded in the service
     const blockNumber = getBlockNumberFromSigningContext(context);
+    const checkpointNumber = getCheckpointNumberFromSigningContext(context);
     const lockToken = await this.slashingProtection.checkAndRecord({
       ...dutyIdentifier,
       blockNumber,
+      checkpointNumber,
       messageHash: messageHash.toString(),
       nodeId: this.config.nodeId,
     });
 
-    // Perform signing
+    // Perform signing under a hard timeout. If the signer hangs, executeTimeout aborts and rejects;
+    // the orphaned signFn promise resolving later is discarded (never broadcast). A timeout takes the
+    // same failure path as any signing error: release the lock so the duty can be retried safely.
     let signature: Signature;
     try {
-      signature = await signFn(messageHash);
+      signature = await executeTimeout(
+        () => signFn(messageHash),
+        this.signerCallTimeoutMs,
+        () =>
+          new Error(
+            `Signing operation for ${dutyType} at slot ${context.slot} timed out after ` +
+              `${this.signerCallTimeoutMs}ms`,
+          ),
+      );
     } catch (error: any) {
       // Delete duty to allow retry (only succeeds if we own the lock)
       await this.slashingProtection.deleteDuty({ ...dutyIdentifier, lockToken });
+      this.metrics.recordSigningError(dutyType);
       throw error;
     }
 
-    // Record success (only succeeds if we own the lock)
-    await this.slashingProtection.recordSuccess({
+    // Record success (only succeeds if we still own the lock).
+    // A false result means our SIGNING row is gone or no longer ours (e.g. deleted by stuck-duty
+    // cleanup while signing was slow). We must not broadcast this signature: without a protection
+    // record, a later attempt for the same duty with different data would sign freely (slashable).
+    // Do not delete the duty here - we no longer own it, and another node may legitimately hold it.
+    const recorded = await this.slashingProtection.recordSuccess({
       ...dutyIdentifier,
       signature,
       nodeId: this.config.nodeId,
       lockToken,
     });
+    if (!recorded) {
+      this.metrics.recordSigningError(dutyType);
+      throw new SigningLockLostError(context.slot, dutyType, this.config.nodeId);
+    }
+
+    const duration = this.dateProvider.now() - startTime;
+    this.metrics.recordSigningSuccess(dutyType, duration);
 
     return signature;
   }
@@ -142,8 +208,8 @@ export class ValidatorHASigner {
    * Start the HA signer background tasks (cleanup of stuck duties).
    * Should be called after construction and before signing operations.
    */
-  start() {
-    this.slashingProtection.start();
+  async start() {
+    await this.slashingProtection.start();
   }
 
   /**