fix: session-lifecycle hardening — path-switch re-handshake (#36) + cert revocation (#41)#95

Merged

vxfemboy merged 15 commits into

mainfrom

feat/session-lifecycle-hardening

Jul 23, 2026

Commits on Jul 22, 2026

docs(hardening): design spec — session-lifecycle hardening (#36 + #41)
vxfemboy
committed
docs(hardening): implementation plan — session-lifecycle hardening (#36 + #41)
vxfemboy
committed
fix(hardening.36): preserve the in-flight ephemeral across a path re-target
vxfemboy
committed
docs(hardening.36): add responder-side relay adoption (close the headline punch->relay scenario)
vxfemboy
committed
fix(hardening.36): responder-side relay adoption on a relayed cold-start retransmit
vxfemboy
committed
fix(hardening.36): review follow-ups — relay-field doc, last_sent_ms reset, spec tradeoff precision
vxfemboy
committed
fix(hardening.41): re-verify cert on rekey Init, drop session on failure
vxfemboy
committed
fix(hardening.41): re-admission cert gate for tabled mesh peers (roots exempt)
vxfemboy
committed
fix(hardening.41): exempt roots from rekey cert re-verify (shared is_root helper)
vxfemboy
committed

Commits on Jul 23, 2026