archy/docs/security/2.1-beta-identity-peer-remediation.md

2.1 Beta identity, peer and resource-bound remediation

Source work against accepted base 3c1008e93417f3d9bf71e9c1b29e05181da422bc. Addresses the source defects described by P0-1, P0-2, P0-3, P0-4, H-2 and H-7 in AUDIT-2.0.3-alpha.md (audit proposal commit 351fd8bf9bdfadb2ea72d9c7ff49d03fa370a892). This is not release acceptance.

• P0-1/P0-2: legacy node-key backup and challenge signing call the existing fail-closed onboarding gate before inspecting parameters or key material. A valid session does not reopen those legacy endpoints after provisioning.
• H-2: identity creation is omitted from the unconditional public allowlist. Only fresh onboarding without a session takes the public path. Provisioned requests require session, administrator record, dashboard origin when present, and CSRF, including remember-token restoration. The write handler repeats the onboarding/session check to cover setup completing during dispatch.
• P0-3: all /dwn and /dwn/* requests return 410 before reading the body or opening storage. Public processing and the old unprotected peer synchronization client are removed. Owner-side DWN RPCs retain their authorization. Existing DWN records and sync state are preserved. dwn.sync explicitly reports that the public transport is disabled. Normal federation uses its independent signed federation.get-state RPC, not DWN; deployment transport acceptance remains open.
• P0-4: outgoing messages encrypt without silent plaintext fallback, and sign a purpose/version-tagged tuple covering sender, recipient, name, ciphertext, encryption mode, message ID and timestamp. Incoming messages require this envelope, matching destination and a short freshness window. Connection acceptance additionally requires an existing one-use outbound UUID and exact expected peer key/onion. Pending authorization is claimed before peer writes. Signed incoming requests populate the owner's pending queue, capped at 128 records. Legacy pending files are preserved but cannot be accepted as signed requests. Both peers must speak this protocol; no unsigned compatibility bypass is retained. Outbound pending records expire for authorization after seven days; records are not silently deleted. A claimed record left by a crash requires a new owner request, rather than reopening its old authorization.
• H-7: RPC and generic peer requests stream into a 2 MiB cap. Authenticated blob/share uploads retain the existing 64 MiB cap, with authentication before buffering. Bodies have a 30-second total read deadline, 16 concurrent admissions and a shared 128 MiB reservation budget retained through dispatch. Existing specialized purchase/gateway routes keep their own streaming bounds. Collector and local periodic telemetry writers share limits: 16 KiB/report, 16 retained history entries, 128 nodes, and 32 MiB aggregate storage. Remote reports additionally have a global 60/minute budget and a persisted per-node one/minute bound. Collector data remains explicitly unverified; a signature or a public key alone would not authorize a node to impersonate federation data. Malformed or oversized existing histories are preserved and refused.

Verification status and pending acceptance

rustfmt parsed the changed Rust sources and git diff --check passed locally. No backend runtime tests were executed in this worktree: expensive compilation was deliberately reserved for the parent's integrated tree and retained cache. Execute only through scripts/test-backend-isolated.sh (never unrestricted cargo test). The focused security_ filter covers the new behavior cases; onboarding_gate and collector_provenance_tests retain the adjacent regressions.

New regressions exercise real RPC/HTTP handlers for provisioned export/signing refusal, fresh signing and backup restoration, identity session/CSRF/origin/role, owner DWN authorization, public DWN refusal with unchanged record bytes, peer signature and correlation failures with unchanged peers.json, valid peer acceptance and replay refusal, chunked/advertised body overflow, an incomplete body deadline, telemetry flood/size/count/history bounds and data preservation. They are authored coverage, not claimed passes until the isolated runner succeeds.

Still required: integrated compilation and focused/full backend tests; independent review; maintainer UI/UX UAT of onboarding, identity creation, connected nodes, DWN disabled-state messaging, fleet history and upload errors; mixed-version peer qualification and valid handshake over actual Tor/FIPS; deployed HTTP/HTTPS pre-auth checks. No live node, wallet, install, artifact, publication or release acceptance was performed or implied.