Reject recovery member changes during recovery

[Copilot]

Closes #4573.

Recovery member changes during public recovery can re-share current ledger secrets, but cannot rekey the at-recovery secrets users depend on. This makes adding/removing recovery members, changing threshold, or refreshing shares during recovery misleading and now rejected.

• Governance validation

  • Reject set_member during recovery when the input includes an encryption key or the existing member has one.
  • Reject remove_member during recovery when the target member has an encryption key.
  • Reject set_recovery_threshold, trigger_recovery_shares_refresh, and trigger_ledger_rekey while recovering.

• Native enforcement

  • Reject activating recovery members via /ack during recovery.
  • Reject native recovery-share refresh and JS-triggered share refresh/rekey while the service is recovering.

• Coverage and docs

  • Added an e2e recovery test for validate-time and apply-time rejection paths.
  • Documented the recovery-member limitation in the governance FAQ.
  • Added a CHANGELOG entry.

[achamayou]

@copilot fix formatting and update changelog to clarify which constitution actions users are expected to update, and that making these changes during recovery was always potentially unsafe, and that the change in behaviour is that they now correctly trigger an error.

[Copilot]

@copilot fix formatting and update changelog to clarify which constitution actions users are expected to update, and that making these changes during recovery was always potentially unsafe, and that t...

Addressed in d73da2c: applied C++ formatting and expanded the changelog entry to identify the custom constitution actions to update and clarify that the unsafe behavior now correctly errors.

[Copilot]

@achamayou I've opened a new pull request, #7984, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

Pull request overview

This PR hardens recovery workflows by rejecting governance operations that would (misleadingly) appear to succeed during public recovery, specifically changes to recovery members/shares/threshold that cannot safely affect “at-recovery” secrets.

Changes:

• Adds validation in the sample constitutions to reject recovery-member changes and recovery-share operations while the service is recovering.
• Adds native enforcement in C++ to block recovery share refresh, recovery-member activation via /ack, and recovery-threshold updates during recovery.
• Adds an e2e recovery test, documents the limitation in the governance FAQ, and records the behavior change in the changelog.

Custom instructions used:

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/suite/test_suite.py	Adds new recovery test to the membership recovery suite.
tests/recovery.py	New e2e test covering proposal creation/acceptance/ack rejection during recovery.
src/service/internal_tables_access.h	Introduces is_service_recovering() helper and uses it to block threshold changes during recovery.
src/node/node_state.h	Blocks native recovery-share refresh during recovery.
src/node/gov/handlers/acks.h	Rejects activation of recovery members via /ack during recovery.
src/js/extensions/ccf/node.cpp	Adds native JS extension guards to block share refresh / ledger rekey during recovery.
samples/minimal_ccf/app/actions.js	Updates sample constitution actions to reject recovery-member/share operations while recovering.
samples/constitutions/default/actions.js	Same as above for the default constitution.
doc/governance/common_member_operations.rst	Adds FAQ entry documenting the recovery-member limitation during recovery.
CHANGELOG.md	Records user-visible behavior change with PR reference.

[achamayou]

@copilot fix formatting

[Copilot]

@copilot fix formatting

Fixed in the latest commit: bumped python/pyproject.toml to 7.0.7 to match the new CHANGELOG section, which was causing the release notes CI check to fail.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.