skills/docs/networking/network/network-plugin-crypto-messages/README.md

@suaveplan/network-plugin-crypto-messages - Cryptographic integrity for the Suaveplan mesh: Ed25519 message signatures, server-signed session/mesh tokens, peer identity challenge-response, hash-chained signed logs, key rotation, plugin security verifier, tier-specific security policies

Summary

Cryptographic integrity layer for the Suaveplan mesh. Ed25519-backed MessageSigner (sign on send, verify against the registry on receive); SessionTokenAuthority and MeshTokenAuthority validating server-signed tokens with replay + expiry rejection; PeerIdentityVerifier running challenge-response handshakes to defeat peer-id spoofing; LogChainSigner producing tamper-evident hash-chained signed audit logs; KeyRotationManager periodically rotating signing keys with grace period and bus broadcast; PluginSecurityVerifier + PluginCapabilityValidator + PluginActivityMonitor + SandboxedPluginContext covering plugin-side integrity and capability containment; TierSecurityPolicy + CredentialDelegation + GeoSecurityPolicy for tier-aware and region-aware policy enforcement. Wrapped in a single CryptoMessagesPlugin satisfying the NetworkPlugin lifecycle.

Documentation tree

• identity — (no submodules)
  • peer-identity-verifier — (no submodules)
• key-rotation — (no submodules)
  • key-rotation-manager — (no submodules)
• log-chain — (no submodules)
  • log-chain-signer — (no submodules)
• plugin — (no submodules)
  • crypto-messages-plugin — (no submodules)
• signer — (no submodules)
  • message-signer — (no submodules)
• mesh-token-authority — Validates server-signed MeshTokens. Mirrors SessionTokenAuthority for the mesh-creation ceremony — same expiry / fo…
• session-token-authority — Validates server-signed SessionTokens. Rejects expired tokens (expiresAt <= now), forged tokens (Ed25519 verify fai…
• error-codes — Frozen registry of every error code raised by the crypto-messages package. Codes are namespaced under NET_CRYPTO and…

- [peer-identity-verifier](./src/identity/peer-identity-verifier.md) — _(no submodules)_- [key-rotation](./src/key-rotation/key-rotation-manager.md) — _(no submodules)_- [key-rotation-manager](./src/key-rotation/key-rotation-manager.md) — _(no submodules)_- [log-chain](./src/log-chain/log-chain-signer.md) — _(no submodules)_- [log-chain-signer](./src/log-chain/log-chain-signer.md) — _(no submodules)_- [plugin](./src/plugin/crypto-messages-plugin.md) — _(no submodules)_- [crypto-messages-plugin](./src/plugin/crypto-messages-plugin.md) — _(no submodules)_- [signer](./src/signer/message-signer.md) — _(no submodules)_- [message-signer](./src/signer/message-signer.md) — _(no submodules)_- [mesh-token-authority](./src/token/mesh-token-authority.md) — Validates server-signed `MeshToken`s. Mirrors `SessionTokenAuthority` for the mesh-creation ceremony — same expiry / fo…

• session-token-authority — Validates server-signed SessionTokens. Rejects expired tokens (expiresAt <= now), forged tokens (Ed25519 verify fai…
• error-codes — Frozen registry of every error code raised by the crypto-messages package. Codes are namespaced under NET_CRYPTO and…
• peer-identity-verifier — (no submodules)- key-rotation — (no submodules)- key-rotation-manager — (no submodules)- log-chain — (no submodules)- log-chain-signer — (no submodules)- plugin — (no submodules)- crypto-messages-plugin — (no submodules)- signer — (no submodules)- message-signer — (no submodules)- mesh-token-authority — Validates server-signed MeshTokens. Mirrors SessionTokenAuthority for the mesh-creation ceremony — same expiry / fo…
• session-token-authority — Validates server-signed SessionTokens. Rejects expired tokens (expiresAt <= now), forged tokens (Ed25519 verify fai…
• error-codes — Frozen registry of every error code raised by the crypto-messages package. Codes are namespaced under NET_CRYPTO and…
• peer-identity-verifier — (no submodules)- key-rotation — (no submodules)- key-rotation-manager — (no submodules)- log-chain — (no submodules)- log-chain-signer — (no submodules)- plugin — (no submodules)- crypto-messages-plugin — (no submodules)- signer — (no submodules)- message-signer — (no submodules)- mesh-token-authority — Validates server-signed MeshTokens. Mirrors SessionTokenAuthority for the mesh-creation ceremony — same expiry / fo…
• session-token-authority — Validates server-signed SessionTokens. Rejects expired tokens (expiresAt <= now), forged tokens (Ed25519 verify fai…
• error-codes — Frozen registry of every error code raised by the crypto-messages package. Codes are namespaced under NET_CRYPTO and…
• peer-identity-verifier — (no submodules)- key-rotation — (no submodules) - key-rotation-manager — (no submodules)- log-chain — (no submodules) - log-chain-signer — (no submodules)- plugin — (no submodules) - crypto-messages-plugin — (no submodules)- signer — (no submodules) - message-signer — (no submodules)- mesh-token-authority — Validates server-signed MeshTokens. Mirrors SessionTokenAuthority for the mesh-creation ceremony — same expiry / fo…
• session-token-authority — Validates server-signed SessionTokens. Rejects expired tokens (expiresAt <= now), forged tokens (Ed25519 verify fai…
• error-codes — Frozen registry of every error code raised by the crypto-messages package. Codes are namespaced under NET_CRYPTO and…