chore: clean cut experiments

[titouantanguy]

Description of changes

This moves all experiments and bechmarks (mostly needed for NIST) binaries into the old threshold-fhe (now threshold-experiment crate).
Also removes dependancy to threshold-fhe/experiments of all other crates, as it's now a "binary only" crate (i.e. not a lib anymore).

Wondering whether threshold-experiments is the best name, especially since there are non-threshold test/kats/benches in it ...

Maybe just experiments ?
Also thinking about renaming threshold-experimental to threshold-bgv cause I find experimental a bit vague (but then my issue is that there's no explicit threshold-tfhe crate as it's part of threshold-execution...).

Also, features are a mess.

Issue ticket number and link

Closes https://github.com/zama-ai/kms-internal/issues/2973

PR Checklist

I attest that all checked items are satisfied. Any deviation is clearly justified above.

• Title follows conventional commits (e.g. chore: ...).
• Tests added for every new pub item and test coverage has not decreased.
• Public APIs and non-obvious logic documented; unfinished work marked as TODO(#issue).
• unwrap/expect/panic only in tests or for invariant bugs (documented if present).
• No dependency version changes OR (if changed) only minimal required fixes.
• No architectural protocol changes OR linked spec PR/issue provided.
• No breaking deployment config changes OR devops label + infra notified + infra-team reviewer assigned.
• No breaking gRPC / serialized data changes OR commit marked with ! and affected teams notified.
• No modifications to existing versionized structs OR backward compatibility tests updated.
• No critical business logic / crypto changes OR ≥2 reviewers assigned.
• No new sensitive data fields added OR Zeroize + ZeroizeOnDrop implemented.
• No new public storage data OR data is verifiable (signature / digest).
• No unsafe; if unavoidable: minimal, justified, documented, and test/fuzz covered.
• Strongly typed boundaries: typed inputs validated at the edge; no untyped values or errors cross modules.
• Self-review completed.

Dependency Update Questionnaire (only if deps changed or added)

Answer in the Cargo.toml next to the dependency (or here if updating):

1. Ownership changes or suspicious concentration?
2. Low popularity?
3. Unusual version jump?
4. Lacking documentation?
5. Missing CI?
6. No security / disclosure policy?
7. Significant size increase?

More details and explanations for the checklist and dependency updates can be found in CONTRIBUTING.md

[github-actions]

Vulnerability Scan Results

Details

Report Summary

┌───────────────────────────────────┬────────────┬─────────────────┬─────────┐
│              Target               │    Type    │ Vulnerabilities │ Secrets │
├───────────────────────────────────┼────────────┼─────────────────┼─────────┤
│ base:latest (chainguard 20230214) │ chainguard │        0        │    -    │
├───────────────────────────────────┼────────────┼─────────────────┼─────────┤
│ usr/bin/yq                        │  gobinary  │        6        │    -    │
└───────────────────────────────────┴────────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


usr/bin/yq (gobinary)
=====================
Total: 6 (HIGH: 6, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬─────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                            Title                            │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼─────────────────────────────────────────────────────────────┤
│ stdlib  │ CVE-2026-25679 │ HIGH     │ fixed  │ v1.26.0           │ 1.25.8, 1.26.1 │ net/url: Incorrect parsing of IPv6 host literals in net/url │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-25679                  │
│         ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│         │ CVE-2026-27137 │          │        │                   │ 1.26.1         │ crypto/x509: Incorrect enforcement of email constraints in  │
│         │                │          │        │                   │                │ crypto/x509                                                 │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-27137                  │
│         ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│         │ CVE-2026-32280 │          │        │                   │ 1.25.9, 1.26.2 │ crypto/x509: crypto/tls: golang: Go: Denial of Service      │
│         │                │          │        │                   │                │ vulnerability in certificate chain building...              │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-32280                  │
│         ├────────────────┤          │        │                   │                ├─────────────────────────────────────────────────────────────┤
│         │ CVE-2026-32281 │          │        │                   │                │ crypto/x509: golang: Go crypto/x509: Denial of Service via  │
│         │                │          │        │                   │                │ inefficient certificate chain validation...                 │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-32281                  │
│         ├────────────────┤          │        │                   │                ├─────────────────────────────────────────────────────────────┤
│         │ CVE-2026-32283 │          │        │                   │                │ If one side of the TLS connection sends multiple key update │
│         │                │          │        │                   │                │ messages...                                                 │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-32283                  │
│         ├────────────────┤          │        │                   ├────────────────┼─────────────────────────────────────────────────────────────┤
│         │ CVE-2026-33810 │          │        │                   │ 1.26.2         │ crypto/x509: golang: Go crypto/x509: Certificate validation │
│         │                │          │        │                   │                │ bypass due to incorrect DNS constraint...                   │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2026-33810                  │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴─────────────────────────────────────────────────────────────┘

[github-actions]

Consolidated Tests Results 2026-04-27 - 09:46:18

Test Results

11 passed

Details

11 tests
not captured
junit-to-ctrf
build-and-test test-reporter #1675
chore: clean cut experiments #524

test-reporter: Run #1675

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
11	11	0	0	0	0	0	not captured

🎉 All tests passed!

Tests

View All Tests

Test Name	Status	Flaky	Duration
nightly_full_gen_tests_k8s_default_threshld_sequential_crs	✅		33.1s
test_k8s_threshld_insecure	✅		1m 59s
k8s_test_crs_uniqueness	✅		33.1s
k8s_test_insecure_keygen_encrypt_and_public_decrypt	✅		2m 6s
k8s_test_insecure_keygen_encrypt_multiple_types	✅		2m 21s
k8s_test_keygen_and_crs	✅		1m 58s
k8s_test_keygen_uniqueness	✅		5m 9s
nightly_full_gen_tests_k8s_default_centralzd_sequential_crs	✅		1.8s
test_k8s_centralzd_insecure	✅		1m 36s
k8s_test_centralized_insecure	✅		1m 1s
nightly_full_gen_tests_default_k8s_centralized_sequential_crs	✅		1.8s

_{🍂 No flaky tests in this run.}

Github Test Reporter by CTRF 💚

🔄 This comment has been updated

[Copilot]

Pull request overview

This PR restructures the workspace by removing the former core/threshold (threshold-fhe) crate and consolidating experiment/benchmark binaries and related support code into a new core/threshold-experiments crate, while updating documentation, build tooling, and dependencies accordingly.

Changes:

• Replace threshold-fhe with threshold-experiments in the workspace and update references across docs, CI, Docker, and scripts.
• Move/gather experiment, KAT, and benchmark utilities under core/threshold-experiments, and refactor choreography helpers into shared modules.
• Relocate TLS certificate generation helpers into threshold-networking and adjust core/service + client usage.

Reviewed changes

Copilot reviewed 84 out of 131 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/generate-test-material/Cargo.toml	Swap dependency to threshold-execution for feature unification
docs/guides/threshold-benchmark.md	Update paths to core/threshold-experiments
docs/guides/kms-server-bin.md	Update kms-gen-keys feature flags
docs/explanations/node.md	Update Threshold Service README link
docs/explanations/network_doc.md	Update insecure-mode wording/paths
docker/core/service/Dockerfile	Remove threshold-fhe/testing build flag
core/threshold/src/lib.rs	Remove old threshold-fhe lib entrypoint
core/threshold/src/grpc/mod.rs	Remove old grpc module stub
core/threshold/Cargo.toml	Remove old threshold-fhe manifest
core/threshold-types/Cargo.toml	Drop unused deps (aes-prng, rand)
core/threshold-networking/src/tls.rs	Adjust CN/issuer validation to support core certificates
core/threshold-networking/src/lib.rs	Export tls_certs module
core/threshold-networking/Cargo.toml	Add deps needed for tls_certs (clap/rcgen/tokio fs)
core/threshold-experiments/tests/integration_redis.rs	Serialize tests; remove cfg gating on imports/tests
core/threshold-experiments/test_scripts/tfhe_test_small_session.sh	Remove explicit choreographer feature from build
core/threshold-experiments/test_scripts/tfhe_test_large_session.sh	Remove explicit choreographer feature from build
core/threshold-experiments/test_scripts/tfhe_reproducible_small_session.sh	Remove explicit choreographer feature from build
core/threshold-experiments/test_scripts/bgv_test_script_real_dkg.sh	Remove explicit choreographer feature from build
core/threshold-experiments/test_scripts/bgv_test_script_fake_dkg.sh	Remove explicit choreographer feature from build
core/threshold-experiments/src/zk_utils.rs	Add shared ZK-PoK utilities for KATs/benches
core/threshold-experiments/src/utils.rs	Add SHA-256 hash checking helper
core/threshold-experiments/src/tests/config/error_conf.toml	Add intentionally-invalid config fixture
core/threshold-experiments/src/tests/config/ddec_test.toml	Add config fixture for PartyConf tests
core/threshold-experiments/src/tests/config/ddec_no_peers.toml	Add config fixture without peers
core/threshold-experiments/src/lib.rs	New crate lib module exports
core/threshold-experiments/src/conf/party.rs	Party configuration + TLS helper code
core/threshold-experiments/src/conf/mod.rs	Make choreo module unconditional
core/threshold-experiments/src/conf/choreo.rs	Define NetworkTopology locally
core/threshold-experiments/src/choreography/tfhe_rs/strategies.rs	Refactor routing helper + secure choreography alias
core/threshold-experiments/src/choreography/tfhe_rs/requests.rs	Define TFHE choreography request DTOs
core/threshold-experiments/src/choreography/tfhe_rs/mod.rs	TFHE choreography module layout
core/threshold-experiments/src/choreography/tfhe_rs/grpc.rs	Refactor grpc service; move shared helpers to server_utils
core/threshold-experiments/src/choreography/tfhe_rs/choreographer.rs	Refactor client runtime usage into shared utility
core/threshold-experiments/src/choreography/server_utils.rs	New shared network/memory stats + session helpers
core/threshold-experiments/src/choreography/server.rs	Server runner refactor + remove duplicated alias
core/threshold-experiments/src/choreography/mod.rs	New choreography top-level module map
core/threshold-experiments/src/choreography/client_utils.rs	Shared client runtime + status check loop
core/threshold-experiments/src/choreography/bgv/strategies.rs	BGV routing helper for experimental choreography
core/threshold-experiments/src/choreography/bgv/requests.rs	Update BGV request types to use threshold-experimental
core/threshold-experiments/src/choreography/bgv/mod.rs	Add BGV strategies module
core/threshold-experiments/src/choreography/bgv/grpc.rs	Port BGV choreography service off threshold-fhe
core/threshold-experiments/src/choreography/bgv/choreographer.rs	Use shared ChoreoRuntime + new imports
core/threshold-experiments/src/bin/threshold-tfhe/mobygo.rs	Update imports to threshold-experiments choreography layout
core/threshold-experiments/src/bin/threshold-tfhe/moby.rs	Update server runner and allocator path
core/threshold-experiments/src/bin/threshold-gen-tls-certs.rs	Use threshold_networking::tls_certs
core/threshold-experiments/src/bin/threshold-bgv/stairwayctl.rs	Use threshold-experiments client utils + requests
core/threshold-experiments/src/bin/threshold-bgv/stairway.rs	Add BGV MPC party binary
core/threshold-experiments/src/bin/non-threshold/zk-pok-kat.rs	Update imports to new shared zk/hash utils
core/threshold-experiments/src/bin/non-threshold/tfhe-kat.rs	Update hash util import
core/threshold-experiments/src/bin/benches/gen-experiment.rs	Add templated experiment config generator
core/threshold-experiments/src/allocator.rs	Add shared peak allocator holder
core/threshold-experiments/experiments/templates/otel-collector-config.yaml	Add otel collector template
core/threshold-experiments/experiments/templates/docker-compose.yml.j2	Update hostnames/cert paths for core cert model
core/threshold-experiments/experiments/templates/conf.toml.j2	Update logical addresses to core1.*
core/threshold-experiments/examples/distributed_decryption.rs	Update crate name in example docs
core/threshold-experiments/docker/scripts/wan.sh	Add netem WAN script
core/threshold-experiments/docker/scripts/runinallcontainers.sh	Helper to exec across containers
core/threshold-experiments/docker/scripts/off.sh	Remove qdisc helper
core/threshold-experiments/docker/scripts/lan10.sh	Add LAN 10G netem script
core/threshold-experiments/docker/scripts/lan1.sh	Add LAN 1G netem script
core/threshold-experiments/docker/nist_testing.dockerfile	Install bins from core/threshold-experiments
core/threshold-experiments/docker/local.dockerfile	Install bins from core/threshold-experiments
core/threshold-experiments/coverage.sh	Update crate name parsing for coverage artifacts
core/threshold-experiments/config/mobygo.toml	Add example choreographer config
core/threshold-experiments/config/moby.toml	Add example moby party config
core/threshold-experiments/benches/non-threshold/utilities.rs	Update allocator import path
core/threshold-experiments/benches/non-threshold/tfhe-zk-pok/speed.rs	Update zk_utils import path
core/threshold-experiments/benches/non-threshold/tfhe-zk-pok/memory.rs	Update zk_utils + allocator import path
core/threshold-experiments/benches/non-threshold/tfhe-rs/speed/keygen.rs	Add TFHE keygen bench
core/threshold-experiments/benches/non-threshold/tfhe-rs/speed/erc20.rs	Add TFHE ERC20-style bench
core/threshold-experiments/benches/non-threshold/tfhe-rs/speed/basic_ops.rs	Add TFHE basic ops bench
core/threshold-experiments/benches/non-threshold/tfhe-rs/memory/keygen.rs	Add TFHE keygen memory bench
core/threshold-experiments/benches/non-threshold/tfhe-rs/memory/erc20.rs	Add TFHE ERC20 memory bench
core/threshold-experiments/benches/non-threshold/tfhe-rs/memory/basic_ops.rs	Add TFHE basic ops memory bench
core/threshold-experiments/benches/non-threshold/bgv/speed/keygen.rs	Add BGV keygen speed bench
core/threshold-experiments/benches/non-threshold/bgv/speed/basic_ops.rs	Add BGV basic ops speed bench
core/threshold-experiments/benches/non-threshold/bgv/memory/keygen.rs	Add BGV keygen memory bench
core/threshold-experiments/benches/non-threshold/bgv/memory/basic_ops.rs	Add BGV basic ops memory bench
core/threshold-experiments/benches/decoding.rs	Add decoding/error-correction benchmarks
core/threshold-experiments/benches/ddec.rs	Add distributed decryption benches
core/threshold-experiments/benches/ceremony.rs	Add CRS ceremony bench
core/threshold-experiments/benches/bit_dec.rs	Add bit decomposition benches
core/threshold-experiments/benches/bgv.rs	Add BGV benches and conversions bench
core/threshold-experiments/benches/bench_switch_and_squash.rs	Add switch-and-squash bench
core/threshold-experiments/benches/bench_prss.rs	Add PRSS bench
core/threshold-experiments/benches/algebra.rs	Add interpolation/Lagrange benches
core/threshold-experiments/README.md	Add minimal crate README
core/threshold-experiments/NIST_scripts/non-threshold-zk-pok-bench.sh	Update run-from path
core/threshold-experiments/NIST_scripts/non-threshold-tfhe-bench.sh	Update benches path reference
core/threshold-experiments/NIST_scripts/non-threshold-kat.sh	Update TFHE KAT binary name
core/threshold-experiments/NIST_scripts/build.sh	Update install path to new crate
core/threshold-experiments/NIST_scripts/.gitignore	Ignore bench/KAT outputs
core/threshold-experiments/Makefile.toml	Update docker build features/flags + cert generation args
core/threshold-experiments/Cargo.toml	Add new crate manifest
core/threshold-experiments/.gitignore	Add crate-local ignores
core/threshold-experiments/.dockerignore	Add crate-local docker ignores
core/threshold-experiments/.cargo/config.toml	Force git fetch with CLI
core/threshold-experimental/src/lib.rs	Remove choreographer module exports
core/threshold-experimental/src/constants.rs	Export INPUT_PARTY_ID publicly
core/threshold-experimental/src/bgv/utils.rs	Make gen_key_set public
core/threshold-experimental/src/bgv/ddec.rs	Make noise_flood_decryption public
core/threshold-experimental/benches/non-threshold/utilities.rs	Remove old bench utilities file
core/threshold-experimental/Cargo.toml	Drop bins/benches previously tied to choreographer features
core/threshold-execution/src/online/triple.rs	Gate multi-degree tests behind slow_tests
core/threshold-execution/src/online/preprocessing/orchestration/producers/triples_producer.rs	Gate multi-degree tests behind slow_tests
core/threshold-execution/src/online/preprocessing/orchestration/producers/randoms_producer.rs	Gate multi-degree tests behind slow_tests
core/threshold-execution/src/online/preprocessing/orchestration/producers/bits_producer.rs	Gate multi-degree tests behind slow_tests
core/threshold-execution/src/online/gen_bits.rs	Gate multi-degree tests behind slow_tests
core/threshold-execution/src/malicious_execution/mod.rs	Remove degree-specific cfg on module
core/threshold-execution/src/large_execution/single_sharing.rs	Gate expensive tests behind slow_tests
core/threshold-execution/src/endpoints/reshare_sk.rs	Gate multi-degree tests behind slow_tests
core/threshold-execution/src/endpoints/keygen.rs	Gate multi-degree tests behind slow_tests
core/threshold-execution/src/endpoints/decryption_non_wasm.rs	Gate multi-degree tests behind slow_tests
core/threshold-execution/Cargo.toml	Simplify features; enable all degrees via dev-dep
core/service/tests/integration_test.rs	Remove cert path integration test tied to removed crate
core/service/src/util/key_setup/mod.rs	Use threshold_networking::tls_certs
core/service/src/engine/threshold/service/kms_impl.rs	Update log wording to new path/name
core/service/src/client/test_tools.rs	Update comments to new path/name
core/service/src/client/js_api.rs	Update wasm note to new path/name
core/service/src/bin/kms-gen-tls-certs.rs	Use threshold_networking::tls_certs
core/service/Cargo.toml	Remove threshold-fhe dep; tweak features and wasm deps
core-client/src/mpc_context.rs	Use threshold_networking::tls_certs
core-client/Cargo.toml	Adjust deps/features; drop threshold-fhe
bc2wrap/src/lib.rs	Update comment referencing new constant location
Cargo.toml	Replace member + workspace deps (threshold-experiments, rename threshold-experimental key)
Cargo.lock	Lockfile updates following crate move/dep changes
.github/workflows/main.yml	Point threshold job to new crate path/name and args
.github/workflows/README.md	Update CI docs to new path

Comments suppressed due to low confidence (1)

core/threshold-experiments/NIST_scripts/build.sh:62

• The TARGET_DIR assignment is missing a closing quote (and currently includes a newline), which will make the script fail to run. Fix the quoting so TARGET_DIR is a valid string path (and consider normalizing the trailing slash).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dvdplm]

I like it.

[dd23]

LGTM, modulo the small open points.

[dd23]

Great work!