fix(validator): give each compose validator a distinct Golden secret share

bin/validator/src/storage_key.rs

@@ -386,6 +386,44 @@ pub(crate) mod tests {
         operator_keys().remove(0)
     }
 
+    /// Regenerates the committed insecure Golden storage-key fixture under
+    /// `scripts/testdata/insecure-golden-storage-key/`.
+    ///
+    /// The fixture holds a full two-of-three setup: one shared
+    /// `setup-context.wire` and `public-key-set.wire`, plus a *distinct*
+    /// `validator-<n>/secret-share.wire` for each participant. This lets the
+    /// docker-compose network give every validator its own share, which is
+    /// required for a real threshold recovery — mounting the same share into
+    /// all three validators makes any 2-of-3 combine collapse to a single
+    /// participant and fail.
+    ///
+    /// Ignored by default so it never runs in CI; regenerate the fixture with:
+    ///
+    /// ```text
+    /// cargo test -p miden-validator --lib storage_key::tests::write_insecure_golden_fixture -- --ignored
+    /// ```
+    #[test]
+    #[ignore = "writes fixture files; run explicitly to regenerate"]
+    fn write_insecure_golden_fixture() {
+        use std::path::Path;
+
+        let dir = Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../scripts/testdata/insecure-golden-storage-key");
+        fs_err::create_dir_all(&dir).unwrap();
+
+        let (setup_context, public_key_set, _) = values_for(participant(1));
+        fs_err::write(dir.join("setup-context.wire"), to_wire_bytes(&setup_context)).unwrap();
+        fs_err::write(dir.join("public-key-set.wire"), to_wire_bytes(&public_key_set)).unwrap();
+
+        for index in [1u32, 2, 3] {
+            let (.., secret_share) = values_for(participant(index));
+            let validator_dir = dir.join(format!("validator-{index}"));
+            fs_err::create_dir_all(&validator_dir).unwrap();
+            fs_err::write(validator_dir.join("secret-share.wire"), to_wire_bytes(&secret_share))
+                .unwrap();
+        }
+    }
+
     #[test]
     fn restart_bundle_round_trips() {
         let expected = operator_key();

compose/validator.yml

@@ -28,7 +28,7 @@ services:
       MIDEN_VALIDATOR_STORAGE_KEY_EPOCH: ${MIDEN_VALIDATOR_STORAGE_KEY_EPOCH:-0909090909090909090909090909090909090909090909090909090909090909}
       MIDEN_VALIDATOR_STORAGE_KEY_SETUP_CONTEXT: /storage-key/setup-context.wire
       MIDEN_VALIDATOR_STORAGE_KEY_PUBLIC_SET: /storage-key/public-key-set.wire
-      MIDEN_VALIDATOR_STORAGE_KEY_SECRET_SHARE: /storage-key/secret-share.wire
+      MIDEN_VALIDATOR_STORAGE_KEY_SECRET_SHARE: /storage-key/validator-1/secret-share.wire
       OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4317
       OTEL_RESOURCE_ATTRIBUTES: service.instance.id=validator-1
 
@@ -42,7 +42,7 @@ services:
       MIDEN_VALIDATOR_STORAGE_KEY_EPOCH: ${MIDEN_VALIDATOR_STORAGE_KEY_EPOCH:-0909090909090909090909090909090909090909090909090909090909090909}
       MIDEN_VALIDATOR_STORAGE_KEY_SETUP_CONTEXT: /storage-key/setup-context.wire
       MIDEN_VALIDATOR_STORAGE_KEY_PUBLIC_SET: /storage-key/public-key-set.wire
-      MIDEN_VALIDATOR_STORAGE_KEY_SECRET_SHARE: /storage-key/secret-share.wire
+      MIDEN_VALIDATOR_STORAGE_KEY_SECRET_SHARE: /storage-key/validator-2/secret-share.wire
       OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4317
       OTEL_RESOURCE_ATTRIBUTES: service.instance.id=validator-2
 
@@ -56,6 +56,6 @@ services:
       MIDEN_VALIDATOR_STORAGE_KEY_EPOCH: ${MIDEN_VALIDATOR_STORAGE_KEY_EPOCH:-0909090909090909090909090909090909090909090909090909090909090909}
       MIDEN_VALIDATOR_STORAGE_KEY_SETUP_CONTEXT: /storage-key/setup-context.wire
       MIDEN_VALIDATOR_STORAGE_KEY_PUBLIC_SET: /storage-key/public-key-set.wire
-      MIDEN_VALIDATOR_STORAGE_KEY_SECRET_SHARE: /storage-key/secret-share.wire
+      MIDEN_VALIDATOR_STORAGE_KEY_SECRET_SHARE: /storage-key/validator-3/secret-share.wire
       OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4317
       OTEL_RESOURCE_ATTRIBUTES: service.instance.id=validator-3

scripts/testdata/insecure-golden-storage-key/README.md

@@ -1,6 +1,29 @@
 # Insecure Golden storage key
 
-These files hold one deterministic share of a two-of-three Golden storage key. The benchmark smoke test uses it to start
-a validator and exercise threshold storage.
+These files hold a deterministic **two-of-three** Golden storage key used by the docker-compose network and the
+benchmark smoke test to exercise threshold storage.
+
+Layout:
+
+- `setup-context.wire`, `public-key-set.wire` — the shared public setup, the same for every validator.
+- `validator-1/secret-share.wire`, `validator-2/secret-share.wire`, `validator-3/secret-share.wire` — each participant's
+  **distinct** secret share. `compose/validator.yml` mounts this directory into all three validators and points each at
+  its own share.
+- `secret-share.wire` — participant 1's share (identical to `validator-1/secret-share.wire`), kept at the top level so
+  single-validator tooling such as the CI benchmark smoke test keeps working unchanged.
+
+Every validator must hold a **different** share. Mounting the same share into all three validators makes any 2-of-3
+recovery collapse to a single participant, which the combiner rejects — so threshold recovery would silently be
+impossible even though each validator stores encrypted records.
 
 This key is public and must not be used outside tests.
+
+## Regenerating
+
+The fixture is derived deterministically by `bin/validator/src/storage_key.rs` (`tests::values_for`). Regenerate it
+with:
+
+```sh
+cargo test -p miden-validator --lib \
+  storage_key::tests::write_insecure_golden_fixture -- --ignored
+```