Initial Commit

openspec/archive/2026-05-05-network-plugin-crypto-messages/tasks.md

@@ -0,0 +1,113 @@
+# Tasks — network-plugin-crypto-messages
+
+> Blocked on: `network-core`, `network-plugin-registry`.
+
+## 1. Scaffold
+
+- [x] 1.1 `packages/network/network-plugin-crypto-messages/` with `package.json`, `tsconfig.json`, `vitest.config.ts`, `README.md`.
+- [x] 1.2 Workspace deps: `@suaveplan/network`, `@suaveplan/error`, `@suaveplan/types`, `@suaveplan/events`, `@suaveplan/crypto-cipher`, `@suaveplan/crypto-hash`, `@suaveplan/crypto-keys`, `@suaveplan/timing`, `@opentelemetry/api`, `zod`.
+- [x] 1.3 `sideEffects: false`.
+
+## 2. Types
+
+- [x] 2.1 `src/types/token.types.ts` — `SessionToken`, `MeshToken`, `TokenPayload`.
+- [x] 2.2 `src/types/signature.types.ts` — `MessageSignature`, `SignedMessage`, `KeyPair`.
+- [x] 2.3 `src/types/identity.types.ts` — `IdentityChallenge`, `IdentityResponse`.
+- [x] 2.4 `src/error-codes.ts` — `defineCodes("NET_CRYPTO", [...])`.
+
+## 3. Message signer
+
+- [x] 3.1 `src/signer/message-signer.ts` — `MessageSigner`.
+- [x] 3.2 Signs outbound with Ed25519 private key.
+- [x] 3.3 Verifies inbound using peer public key from registry.
+
+## 4. Session token authority
+
+- [x] 4.1 `src/token/session-token-authority.ts` — `SessionTokenAuthority`.
+- [x] 4.2 Validates server Ed25519 signature on session tokens.
+- [x] 4.3 Rejects expired tokens, forged tokens, replayed tokens.
+- [x] 4.4 Emits `token:valid` / `token:invalid` on bus.
+
+## 5. Mesh token authority
+
+- [x] 5.1 `src/token/mesh-token-authority.ts` — `MeshTokenAuthority`.
+- [x] 5.2 Validates server signature on mesh creation tokens.
+
+## 6. Peer identity verifier
+
+- [x] 6.1 `src/identity/peer-identity-verifier.ts` — `PeerIdentityVerifier`.
+- [x] 6.2 Challenge-response during peer handshake.
+- [x] 6.3 Prevents peer ID spoofing.
+
+## 7. Log chain signer
+
+- [x] 7.1 `src/log-chain/log-chain-signer.ts` — `LogChainSigner`.
+- [x] 7.2 `entry[n] = sign(hash(entry[n-1]) + payload)`.
+- [x] 7.3 Tamper detection via hash chain break.
+
+## 8. Key rotation manager
+
+- [x] 8.1 `src/key-rotation/key-rotation-manager.ts` — `KeyRotationManager`.
+- [x] 8.2 Periodic rotation with configurable interval.
+- [x] 8.3 Grace period for old signatures.
+- [x] 8.4 Broadcasts new public key on bus.
+
+## 9. Plugin wrapper
+
+- [x] 9.1 `src/plugin/crypto-messages-plugin.ts` — `CryptoMessagesPlugin` implements `NetworkPlugin`.
+
+## 10. Spec
+
+- [x] 10.1 Update `openspec/specs/network/spec.md` with `NET-CRYPTO` requirements.
+
+## 11. Conformance tests
+
+- [x] 11.1 `src/signer/signer.spec-conformance.test.ts` — sign/verify, invalid rejection.
+- [x] 11.2 `src/session-token/session-token.spec-conformance.test.ts` — valid, expired, forged.
+- [x] 11.3 `src/mesh-token/mesh-token.spec-conformance.test.ts` — mesh token validation.
+- [x] 11.4 `src/identity/identity.spec-conformance.test.ts` — challenge-response, spoof.
+- [x] 11.5 `src/log-chain/log-chain.spec-conformance.test.ts` — chain integrity, tamper.
+- [x] 11.6 `src/key-rotation/key-rotation.spec-conformance.test.ts` — rotation, grace.
+- [x] 11.7 `src/error-codes.spec-conformance.test.ts` — frozen registry.
+
+## 12. Plugin security verifier
+
+- [ ] 12.1 `src/plugin-security/plugin-security-verifier.ts` — `PluginSecurityVerifier`, validates plugin integrity.
+- [ ] 12.2 `src/plugin-security/capability-validator.ts` — `PluginCapabilityValidator`, enforces declared capabilities.
+- [ ] 12.3 `src/plugin-security/activity-monitor.ts` — `PluginActivityMonitor`, detects anomalous patterns.
+- [ ] 12.4 `src/plugin-security/sandboxed-context.ts` — `SandboxedPluginContext`, restricts sensitive operations.
+
+## 13. Tier-specific security policies
+
+- [ ] 13.1 `src/policy/tier-security-policy.ts` — `TierSecurityPolicy`, rules per tier.
+- [ ] 13.2 Tier 0: full authority. Tier 1: relay + voting, no tokens. Tier 2: read-only sensitive ops.
+- [ ] 13.3 `src/policy/credential-delegation.ts` — `CredentialDelegation`, cross-tier delegation.
+- [ ] 13.4 `src/policy/geo-security-policy.ts` — `GeoSecurityPolicy`, optional regional restrictions.
+
+## 14. Spec
+
+- [ ] 14.1 Update `openspec/specs/network/spec.md` with `NET-47`, `NET-48`.
+
+## 15. Conformance tests
+
+- [ ] 15.1 `src/plugin-security/plugin-security.spec-conformance.test.ts` — integrity, capability enforcement.
+- [ ] 15.2 `src/plugin-security/activity.spec-conformance.test.ts` — anomaly detection, rate limits.
+- [ ] 15.3 `src/policy/tier-policy.spec-conformance.test.ts` — tier rules, delegation, geo restrictions.
+
+## 16. Verify
+
+- [x] 16.1 `bunx turbo lint typecheck test --filter=@suaveplan/network-plugin-crypto-messages` green.
+- [x] 16.2 `bunx turbo test:coverage --filter=@suaveplan/network-plugin-crypto-messages` 100/100/100/100.
+- [x] 16.3 `bun scripts/openspec-conformance.ts @suaveplan/network-plugin-crypto-messages` PASS.
+
+---
+
+## Audit Note (2026-05-05)
+
+**Status**: PARTIAL — core sections (1–11, 16) shipped at full quality (100/100/100/100 coverage, 100% docs, openspec-conformance PASS, 65 tests across 9 files). Stretch sections deferred to follow-up changes:
+
+- Section 12 (PluginSecurityVerifier / CapabilityValidator / ActivityMonitor / SandboxedPluginContext) → follow-up `network-plugin-crypto-messages-plugin-security`.
+- Section 13 (TierSecurityPolicy / CredentialDelegation / GeoSecurityPolicy) → follow-up `network-plugin-crypto-messages-tier-policy`.
+- Sections 14–15 conformance tests + spec entries (`NET-47`, `NET-48`) ship with the corresponding follow-up.
+
+The shipped core (`MessageSigner`, `SessionTokenAuthority`, `MeshTokenAuthority`, `PeerIdentityVerifier`, `LogChainSigner`, `KeyRotationManager`, `CryptoMessagesPlugin`) covers `NET-27` … `NET-30` from the network spec and is fully self-contained; the deferred follow-ups can be added without breaking the shipped surface.