Status: FIXED — do not roll back.
What broke (the #48 failure class — strict-PQ activation outage)
config.pemBytesOrFile short-circuited when a *-content flag was set but empty: it returned empty bytes instead of falling through to the corresponding *-file path. For strict-PQ staking keys (--staking-mldsa-key-file-content / --staking-mldsa-key-file), a deploy whose env var or template rendered the -content flag to "" silently degraded the validator to a classical ECDSA NodeID — StakingMLDSAPub stayed empty, IsStrictPQ() was false, the node booted with no error, the genesis validator set never matched the live NodeIDs, and the P-chain produced 0 blocks.
Fix
Merged in #139 — a set-but-empty *-content flag is now treated identically to an absent one and falls through to the *-file path (the same helper also backs the ML-KEM handshake keys).
Why it can't silently roll back
config/staking_mldsa_test.go::TestLoadStakingMLDSA_EmptyContentFallsThroughToPath guards the exact failure. It runs in the Unit CI job (which executes CGO_ENABLED=0 go test ./config/). It is a proven guard — it fails on the buggy behavior (priv is nil) and passes with the fix. Any PR that reverts the config change turns the Unit job red, so the regression cannot land unnoticed.
If you are about to remove or weaken that test, or revert the pemBytesOrFile fall-through: stop. This is the strict-PQ activation outage. Do not roll it back.
Status: FIXED — do not roll back.
What broke (the #48 failure class — strict-PQ activation outage)
config.pemBytesOrFileshort-circuited when a*-contentflag was set but empty: it returned empty bytes instead of falling through to the corresponding*-filepath. For strict-PQ staking keys (--staking-mldsa-key-file-content/--staking-mldsa-key-file), a deploy whose env var or template rendered the-contentflag to""silently degraded the validator to a classical ECDSA NodeID —StakingMLDSAPubstayed empty,IsStrictPQ()was false, the node booted with no error, the genesis validator set never matched the live NodeIDs, and the P-chain produced 0 blocks.Fix
Merged in #139 — a set-but-empty
*-contentflag is now treated identically to an absent one and falls through to the*-filepath (the same helper also backs the ML-KEM handshake keys).Why it can't silently roll back
config/staking_mldsa_test.go::TestLoadStakingMLDSA_EmptyContentFallsThroughToPathguards the exact failure. It runs in the Unit CI job (which executesCGO_ENABLED=0 go test ./config/). It is a proven guard — it fails on the buggy behavior (privis nil) and passes with the fix. Any PR that reverts the config change turns the Unit job red, so the regression cannot land unnoticed.If you are about to remove or weaken that test, or revert the
pemBytesOrFilefall-through: stop. This is the strict-PQ activation outage. Do not roll it back.