Support external signers in ethfinalizer

[taylanpince]

ethfinalizer currently requires a concrete wallet, which prevents using a signer whose private key lives outside the process. Add a context-aware Signer interface for initial transactions and fee replacements, plus NewWalletSigner for local wallets.

Existing callers can continue setting FinalizerOptions.Wallet; callers using an external signer set Signer instead. Construction requires exactly one. Persisted signed transactions are rebroadcast without signing again.

Validation: go test -race ./ethfinalizer passed with Go 1.25.9. Added coverage for option compatibility, cancellation, signing failure before persistence, replacement signing, and rebroadcasting stored signatures.

[taylanpince]

🧞 Codegenie Review

Two verified configuration-validation issues can defer invalid signer setup to a panic during transaction submission.

Coverage

Reviewed 10/10 hunks.
Coverage levels: deep 8, normal 2, light 0, skip 0.

⚠️ Findings

🔵 Medium: Reject a nil wallet in NewWalletSigner

File: ethfinalizer/signer.go:22 ↗
Confidence: high

NewWalletSigner(nil) returns a non-nil Signer that passes FinalizerOptions validation, then panics when Send calls s.wallet.SignTransaction.

func NewWalletSigner(wallet *ethwallet.Wallet) Signer { return &walletSigner{wallet: wallet} }
...
return s.wallet.SignTransaction(tx, chainID)

Impact: A recoverable invalid configuration (Signer: NewWalletSigner(nil), no Wallet) becomes a runtime panic while submitting a transaction.

Suggested fix: Reject a nil wallet in NewWalletSigner (for example, return (Signer, error)), or return a nil Signer so existing finalizer validation rejects the configuration.

⚪ Low: Reject typed-nil Signer values during option validation

File: ethfinalizer/ethfinalizer.go:68 ↗
Confidence: high

FinalizerOptions.IsValid accepts a typed-nil Signer, allowing construction with no usable signer and deferring failure to Send.

if (o.Wallet == nil) == (o.Signer == nil) {
 return fmt.Errorf("exactly one of wallet or signer is required")
}

In Go, an interface holding a nil pointer is non-nil. NewFinalizer retains that interface, and Send invokes f.signer.Address() and f.signer.SignTransaction(...); pointer-backed implementations that dereference their receiver panic.

Suggested fix: Treat nil underlying values of nil-capable Signer implementations as absent during validation and signer selection, or use an option representation that cannot carry typed-nil signers.

Stats

• 🤖 Model: openai-codex gpt-5.6-terra high
• 🧞 Codegenie: v0.5.6 (a662388fde)
• Elapsed time: 2m 48s
• Git: 0xsequence/ethkit from master to codex/kms-finalizer-signer (8afd52cb73)
• Review completeness: complete.
• Usage: model calls 49, tokens 692609, cost $0.9751.
• Effective caps: tokens 8000000.
• Local context pressure: 41 tool-budget rejections, 29 degraded tool results, 5 degraded hunks.