# Tasks — network-plugin-intra-relay-security

> Blocked on: `network-plugin-intra-relay` (core), `network-plugin-crypto-messages`.

## 1. Implementation

- [x] 1.1 Append three codes to `NETWORK_INTRA_RELAY_CODES`: `RELAY_SIGNATURE_INVALID`, `RELAY_PEER_UNTRUSTED`, `RELAY_RATE_LIMIT_EXCEEDED`.
- [x] 1.2 `src/security/relay-security-manager.ts` — `RelaySecurityManager`.
- [x] 1.3 Authenticate relay nodes using `PeerIdentityVerifier` from `@suaveplan/network-plugin-crypto-messages`.
- [x] 1.4 Validate relay-message signatures.
- [x] 1.5 Token-bucket rate limit per peer + global.
- [x] 1.6 `RelayAuthPolicy` + `RelayRateLimit` types in `src/types/security.types.ts`.
- [x] 1.7 Wire `IntraRelayPlugin.security` getter.

## 2. Tests

- [x] 2.1 `src/security/relay-security-manager.spec-conformance.test.ts` — auth, signature, rate limit, allowlist, signature-required toggle.

## 3. Verify

- [x] 3.1 `bunx turbo lint typecheck test --filter=@suaveplan/network-plugin-intra-relay` green.
- [x] 3.2 `bunx turbo test:coverage --filter=@suaveplan/network-plugin-intra-relay` 100/100/100/100.
- [x] 3.3 `bun scripts/openspec-conformance.ts @suaveplan/network-plugin-intra-relay` PASS.