Add slashing protection strict mode for external signers

[ayaanoncrypto]

PR Description

Fixed Issue(s)

Documentation

• I thought about documentation and added the doc-change-required label to this PR if updates are required.

Changelog

• I thought about adding a changelog entry, and added one if I deemed necessary.

---

Note

Medium Risk
Changes when signing is allowed in the slashing-protection path; misconfiguration could block duties or weaken protection, though default remains the prior auto-create behavior.

Overview
Adds an opt-in --slashing-protection-strict-mode-enabled flag (default off) so Teku refuses block and attestation signing when there is no existing slashing protection file for a validator, instead of auto-creating an empty record on first sign.

Both LocalSlashingProtector and LocalSlashingProtectorConcurrentAccess take the setting via ValidatorConfig and ValidatorClientService. The concurrent path tracks whether a record was newly synthesized with LocalSlashingProtectionRecord.isNew() and treats that like a missing file when strict mode is on. Tests cover strict vs non-strict behavior for blocks and attestations.

^{Reviewed by Cursor Bugbot for commit 75767ed. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

ayaanoncrypto seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 75767ed. Configure here.}

[cursor]

Strict mode caches missing records permanently

Medium Severity

When strict mode is enabled, getSigningRecordForSigning inserts a record via computeIfAbsent before checking isNew. Because isNew is immutable, a first miss is remembered for the process lifetime, so later slashing-protection files are ignored and signing stays refused until restart.

Additional Locations (1)

• ethereum/spec/src/main/java/tech/pegasys/teku/spec/signatures/LocalSlashingProtectionRecord.java#L30-L42

 

^{Reviewed by Cursor Bugbot for commit 75767ed. Configure here.}