refactor(forks/lstar): move multi-signature types out of crypto layer

packages/testing/src/consensus_testing/keys.py

@@ -43,7 +43,6 @@
 from lean_spec.config import LEAN_ENV
 from lean_spec.spec.crypto.koalabear import Fp
 from lean_spec.spec.crypto.merkleization import hash_tree_root
-from lean_spec.spec.crypto.xmss.aggregation import TypeOneMultiSignature
 from lean_spec.spec.crypto.xmss.constants import TARGET_CONFIG
 from lean_spec.spec.crypto.xmss.containers import (
     PublicKey,
@@ -63,7 +62,11 @@
     Randomness,
 )
 from lean_spec.spec.forks import Slot, ValidatorIndex
-from lean_spec.spec.forks.lstar.containers import AggregatedAttestations, AttestationData
+from lean_spec.spec.forks.lstar.containers import (
+    AggregatedAttestations,
+    AttestationData,
+    TypeOneMultiSignature,
+)
 from lean_spec.spec.ssz import Bytes32, Uint64
 
 KeyRole = Literal["attestation", "proposal"]

packages/testing/src/consensus_testing/test_fixtures/state_transition.py

@@ -5,7 +5,6 @@
 from pydantic import ConfigDict, PrivateAttr, field_serializer
 
 from lean_spec.spec.crypto.merkleization import hash_tree_root
-from lean_spec.spec.crypto.xmss.aggregation import TypeOneMultiSignature
 from lean_spec.spec.forks import ValidatorIndices
 from lean_spec.spec.forks.lstar.containers import (
     AggregatedAttestation,
@@ -14,6 +13,7 @@
     Block,
     BlockBody,
     State,
+    TypeOneMultiSignature,
 )
 from lean_spec.spec.forks.lstar.spec import LstarSpec
 from lean_spec.spec.ssz import Bytes32

packages/testing/src/consensus_testing/test_types/aggregated_attestation_spec.py

@@ -3,14 +3,14 @@
 from __future__ import annotations
 
 from lean_spec.base import CamelModel
-from lean_spec.spec.crypto.xmss.aggregation import TypeOneMultiSignature
 from lean_spec.spec.forks import Checkpoint, Slot, ValidatorIndex, ValidatorIndices
 from lean_spec.spec.forks.lstar.containers import (
     AggregatedAttestation,
     AggregatedAttestations,
     AttestationData,
     Block,
     State,
+    TypeOneMultiSignature,
 )
 from lean_spec.spec.ssz import ByteList512KiB, Bytes32
 

packages/testing/src/consensus_testing/test_types/block_spec.py

@@ -8,10 +8,6 @@
 from lean_spec.base import CamelModel
 from lean_spec.node.chain.clock import Interval
 from lean_spec.spec.crypto.merkleization import hash_tree_root
-from lean_spec.spec.crypto.xmss.aggregation import (
-    TypeOneMultiSignature,
-    TypeTwoMultiSignature,
-)
 from lean_spec.spec.crypto.xmss.containers import Signature
 from lean_spec.spec.forks import Slot, ValidatorIndex, ValidatorIndices
 from lean_spec.spec.forks.lstar.containers import (
@@ -24,6 +20,8 @@
     SignedAttestation,
     SignedBlock,
     State,
+    TypeOneMultiSignature,
+    TypeTwoMultiSignature,
 )
 from lean_spec.spec.forks.lstar.spec import LstarSpec
 from lean_spec.spec.forks.lstar.store import Store

packages/testing/src/consensus_testing/test_types/gossip_aggregated_attestation_spec.py

@@ -3,13 +3,13 @@
 from __future__ import annotations
 
 from lean_spec.base import CamelModel
-from lean_spec.spec.crypto.xmss.aggregation import TypeOneMultiSignature
 from lean_spec.spec.forks import Checkpoint, Slot, ValidatorIndex, ValidatorIndices
 from lean_spec.spec.forks.lstar.containers import (
     AttestationData,
     Block,
     SignedAggregatedAttestation,
     State,
+    TypeOneMultiSignature,
 )
 from lean_spec.spec.ssz import ByteList512KiB, Bytes32
 

src/lean_spec/node/sync/service.py

@@ -17,11 +17,6 @@
 from lean_spec.node.networking.transport.peer_id import PeerId
 from lean_spec.node.storage import Database
 from lean_spec.spec.crypto.merkleization import hash_tree_root
-from lean_spec.spec.crypto.xmss.aggregation import (
-    AggregationError,
-    TypeOneMultiSignature,
-    TypeTwoMultiSignature,
-)
 from lean_spec.spec.crypto.xmss.containers import PublicKey
 from lean_spec.spec.forks import (
     AttestationData,
@@ -33,6 +28,11 @@
     Slot,
     Store,
 )
+from lean_spec.spec.forks.lstar.containers import (
+    AggregationError,
+    TypeOneMultiSignature,
+    TypeTwoMultiSignature,
+)
 from lean_spec.spec.ssz import Bytes32
 from lean_spec.spec.ssz.exceptions import SSZError
 

src/lean_spec/node/validator/service.py

@@ -41,7 +41,6 @@
 from lean_spec.node.sync import SyncService
 from lean_spec.spec.crypto.merkleization import hash_tree_root
 from lean_spec.spec.crypto.xmss import TARGET_SIGNATURE_SCHEME
-from lean_spec.spec.crypto.xmss.aggregation import TypeOneMultiSignature, TypeTwoMultiSignature
 from lean_spec.spec.crypto.xmss.containers import PublicKey, Signature
 from lean_spec.spec.forks import (
     AttestationData,
@@ -52,6 +51,7 @@
     Slot,
     ValidatorIndex,
 )
+from lean_spec.spec.forks.lstar.containers import TypeOneMultiSignature, TypeTwoMultiSignature
 from lean_spec.spec.ssz import ByteList512KiB, Bytes32, Uint64
 
 from .constants import HYSTERESIS_BAND, NETWORK_STALL_THRESHOLD, SYNC_LAG_THRESHOLD

src/lean_spec/spec/crypto/xmss/__init__.py

@@ -7,9 +7,19 @@
       https://eprint.iacr.org/2026/016.pdf
 """
 
+from lean_multisig_py import setup_prover
+
+from lean_spec.config import LEAN_ENV
+
 from .containers import PublicKey, SecretKey
 from .interface import TARGET_SIGNATURE_SCHEME, GeneralizedXmssScheme
 
+# Side effect: configures the Rust prover for the lifetime of the process.
+# One call covers every aggregation, verification, split, and merge.
+# Per-call invocations then default to the mode established here.
+setup_prover(mode=LEAN_ENV)
+
+
 __all__ = [
     "GeneralizedXmssScheme",
     "PublicKey",