fix(rekey): complete relay-path session rekey (#91) - #92

Merged

vxfemboy merged 21 commits into

mainfrom

feat/rekey-9a-relay-completion

Jul 22, 2026

Commits on Jul 19, 2026

docs(rekey.9a): design spec — classical session rekey (~120s) + epoch handling
vxfemboy
committed
docs(rekey.9a): implementation plan (5 tasks, subagent-driven)
vxfemboy
committed
feat(rekey.9a): EpochSet state machine (current/next/previous, WireGuard confirmed-switch)
vxfemboy
committed
test(rekey.9a): assert promotion refreshes current_created_ms (Task 1 review)
vxfemboy
committed
refactor(rekey.9a): PeerState::Established carries an EpochSet; route in/out through current epoch
vxfemboy
committed
fix(rekey.9a): EpochInbound::Send carries EgressDatagram (preserve dst+fate for relay peers)
vxfemboy
committed
feat(rekey.9a): schedule mid-session rekey in tick (winner-initiates, one-in-flight, loser-fallback)
vxfemboy
committed
feat(rekey.9a): complete rekey — initiator promote on Resp, responder install_next on Init
vxfemboy
committed
fix(rekey.9a): don't schedule rekey for relay peers (completion is direct-only; avoid never-completing churn)
vxfemboy
committed
test(rekey.9a): netns money test — loss-free rotation + on-wire conn_tag rotation
vxfemboy
committed
test(rekey.9a): witness tool errors cleanly on malformed pcap instead of panicking (review)
vxfemboy
committed
fix(rekey.9a): idempotent responder rekey reply (converge on one session under Init retransmit/Resp reorder)
vxfemboy
committed
docs(rekey.9a): lockstep note on init_ephemeral offset vs HandshakeInit framing (review)
vxfemboy
committed
docs(rekey.91): design spec — relay-path session rekey completion
vxfemboy
committed
docs(rekey.91): implementation plan (4 tasks, subagent-driven)
vxfemboy
committed
refactor(rekey.91): extract rekey_init_core/rekey_resp_core (via_relay) — Direct path unchanged
vxfemboy
committed
fix(rekey.91): preserve FEC fate on the rekey prime-emit; None path leaves egress untouched
vxfemboy
committed
feat(rekey.91): complete relay-path rekey (relayed_handshake_init/resp → cores)
vxfemboy
committed
feat(rekey.91): schedule + relay-wrap rekey Init for relay peers (remove the gate)
vxfemboy
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(rekey): complete relay-path session rekey (#91) - #92

fix(rekey): complete relay-path session rekey (#91)#92
vxfemboy merged 21 commits into
mainfrom
feat/rekey-9a-relay-completion

Commits on Jul 19, 2026

docs(rekey.9a): design spec — classical session rekey (~120s) + epoch handling

docs(rekey.9a): implementation plan (5 tasks, subagent-driven)

feat(rekey.9a): EpochSet state machine (current/next/previous, WireGuard confirmed-switch)

test(rekey.9a): assert promotion refreshes current_created_ms (Task 1 review)

refactor(rekey.9a): PeerState::Established carries an EpochSet; route in/out through current epoch

fix(rekey.9a): EpochInbound::Send carries EgressDatagram (preserve dst+fate for relay peers)

feat(rekey.9a): schedule mid-session rekey in tick (winner-initiates, one-in-flight, loser-fallback)

feat(rekey.9a): complete rekey — initiator promote on Resp, responder install_next on Init

fix(rekey.9a): don't schedule rekey for relay peers (completion is direct-only; avoid never-completing churn)

test(rekey.9a): netns money test — loss-free rotation + on-wire conn_tag rotation

test(rekey.9a): witness tool errors cleanly on malformed pcap instead of panicking (review)

fix(rekey.9a): idempotent responder rekey reply (converge on one session under Init retransmit/Resp reorder)

docs(rekey.9a): lockstep note on init_ephemeral offset vs HandshakeInit framing (review)

docs(rekey.91): design spec — relay-path session rekey completion

docs(rekey.91): implementation plan (4 tasks, subagent-driven)

refactor(rekey.91): extract rekey_init_core/rekey_resp_core (via_relay) — Direct path unchanged

fix(rekey.91): preserve FEC fate on the rekey prime-emit; None path leaves egress untouched

feat(rekey.91): complete relay-path rekey (relayed_handshake_init/resp → cores)

feat(rekey.91): schedule + relay-wrap rekey Init for relay peers (remove the gate)

Commits on Jul 20, 2026

test(rekey.91): netns relay-forced money test — loss-free rotation over the relay

fix(rekey.91): gate rekey completion on peers[idx].relay — path-consistent (final review)