Handshake anti-replay + authenticated endpoint (#34)#99

Merged

vxfemboy merged 12 commits into

mainfrom

feat/handshake-anti-replay-34

Jul 25, 2026

Commits on Jul 23, 2026

docs(anti-replay): design spec — handshake anti-replay + authenticated endpoint (#34)
vxfemboy
committed
docs(anti-replay.34): implementation plan (5 tasks, subagent-driven)
vxfemboy
committed
feat(anti-replay.34): TAI64N + msg1 payload framing helpers
vxfemboy
committed
feat(anti-replay.34): frame [ts||cert] into msg1; responder strips the ts
vxfemboy
committed
feat(anti-replay.34): ts freshness gate replaces the age gate; endpoint learned only on a fresh Init
vxfemboy
committed
test(anti-replay.34): cover the cold-start endpoint-hijack guard's defensive path
vxfemboy
committed
test(anti-replay.34): relay cold-start stale-Init rejection (review Minor)
vxfemboy
committed
feat(anti-replay.34): retire #36 — fresh-Init + freshness-gated rebuild; downgrade closed
vxfemboy
committed
test(anti-replay.34): netns — replay refused, restart recovery, #36 rebuild
vxfemboy
committed
docs(anti-replay.34): clarify the downgrade residual is on-path-only (final review M1)
vxfemboy
committed

Commits on Jul 25, 2026