fix(ledger): fail closed on committee certificates

[wolf31o2]

Fixes #2142.

• preserves exact key and script committee credentials
• fails closed on unavailable, empty, or inconsistent committee state
• validates authorization, resignation, and committee voters against active membership
• reports committee voter lookup failures as CommitteeMemberLookupError, carrying the credential and its type rather than a bare provider error
• skips governance checks for phase-2-invalid transactions
• preserves released and exact-provider conformance coverage

The legacy conformance adapter reports a script credential as not a member: the released hash-only store cannot represent one, so answering it could only alias onto the key-hash entry of the same hash.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 0a4fa1e5-3424-402e-bdf1-401438e6b4e1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6bc5cd06-790d-406b-acb6-f764c3c1f3f6

📥 Commits

Reviewing files that changed from the base of the PR and between 9586efe and 374db6c.

📒 Files selected for processing (3)

• ledger/common/state.go
• ledger/conway/rules.go
• ledger/conway/rules_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The GovState interface now documents committee member resolution semantics. UtxoValidateCommitteeCertificates lazily caches committee state, propagates committee lookup errors, and rejects missing members for authorization and resignation certificates. Tests cover current and proposed members, empty committees, lookup failures, and unrelated certificates.

Merge Risk: 🔵 Low · up to 374db

Committee certificate validation now rejects unavailable or unknown committee state and recognizes pending committee members. The change is mergeable with owner awareness that ledger-state providers must consistently implement the current-and-pending membership contract and return stable results during validation.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: committee certificate handling now fails closed when committee state is empty or unavailable.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/2142-committee-authz

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

All reported issues were addressed across 6 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[arepala-uml]

Verified independently against the current checkout (build, vet, make lint, nilaway, go test -race ./ledger/..., and go test ./internal/test/conformance/...): all pass, 315/315 conformance vectors pass. CodeRabbit and Cubic have no actionable findings; all CI checks are green.

Traced the new common.CommitteeCredentialState capability across the dependency spine: ouroboros-mock's shared MockLedgerState already implements it (merged in ouroboros-mock#263), and Dingo's LedgerView has a matching structural implementation in progress (dingo#3745, open). Release sequencing note: don't let Dingo bump to a gouroboros release containing this fix before dingo#3745 merges, or committee certificates/CC votes will fail closed in production until that lands.

No merge-blocking findings.