fix(evolution): add key-hash governance voters to required signers (#479)

[Kshot3000]

Fixes #479

The bug

computeRequiredKeyHashesSync derives the signing keys from inputs, withdrawals and certificates, but never inspects votingProcedures (body key 19). The tx builder's Vote operation likewise only tracks redeemers for script voters and never adds a key-hash voter to requiredSigners. A governance vote cast by a key-hash DRep, a constitutional-committee member, or a stake pool was therefore never signed by the wallet, and the node rejects the under-signed transaction.

Reproduced first (all RED on main): a transaction whose only wallet-relevant field is a votingProcedures entry for a key-hash DRep voter equal to the seed wallet's stake credential makes signTx return an empty witness set. The committee and stake-pool cases fail the same way. On the builder side, a built vote transaction carries no requiredSigners entry for its key-hash voter.

The fix

Signing.ts — computeRequiredKeyHashesSync gains a votingProcedures branch that mirrors the certificate logic already in the same function:

• DRepVoter with a KeyHashDRep drep → matched against stakeKhHex (same as the RegDrepCert handling)
• ConstitutionalCommitteeVoter with a KeyHash credential → matched against stakeKhHex (same as the AuthCommitteeHotCert handling, which likewise matches the committee credential against the stake key hash)
• StakePoolVoter → poolKeyHash matched against paymentKhHex (same as the PoolRegistration/PoolRetirement handling)

Vote.ts — createVoteProgram collects the key hash of every key-hash voter (keyHashVoter: DRep key hash, committee key-hash credential, or the pool key hash as a KeyHash) and merges it into the builder state's requiredSigners, deduplicated with Equal.equals exactly like the AddSigner operation — so a transaction built by the SDK asks for the voter's witness in the body itself.

Deliberately left out

The issue also says to "apply the equivalent for proposalProcedures". A proposal procedure carries no voter, and none of its fields is a signing requirement the wallet derivation maps to in the way a voter is: its rewardAccount is the deposit-return account (receiving a refund is not a signing act), and the governance actions embed no voter identity either. Rather than invent a signer rule for it, I left proposals alone and would welcome maintainer direction on what the equivalent should be if I am misreading the ledger rule.

Tests

Two new files, 8 tests, each verified RED on main before the fix (controls PASS on both sides):

• Signing.GovernanceVoters.test.ts (5): seed wallet signs a DRep vote with the stake key, a committee vote with the stake key, and a stake-pool vote with the payment key — asserting the exact witness key hash in each case; script-hash DRep voter and unrelated key-hash DRep voter produce no witness (controls).
• TxBuilder.GovernanceRequiredSigners.test.ts (3): the built body's requiredSigners contains the voter's key hash for the DRep, committee, and stake-pool voters.

Full suite: 1686 passed / 75 skipped / 0 failed, test files 103 passed / 1 skipped of 104 — exactly main's 1678 baseline + the 8 new tests, and 101 baseline files + the 2 new files. tsc --noEmit clean, eslint clean, prettier parity with main on both source files (10 = 10 diff lines on Signing.ts, 0 = 0 on Vote.ts). Changeset added (patch).

---

Built by an independent Cardano developer — not affiliated with the Cardano Foundation, IOG, or Intersect.

@Kshot9000 (https://x.com/kshot9000) · ADA: addr1q8hnl6vl5a6k3rw3n5g3jtte696zcl76kfatzv7gpswa9r0dj7fma6klq55y4ffm7tf0em09udnyhuk4ah92pl5x9jpqjae44v

cc @cardano-foundation @IntersectMBO