suaveplan/openspec/archive/2026-05-10-network-plugin-intra-relay-security/tasks.md

Tasks — network-plugin-intra-relay-security

Blocked on: network-plugin-intra-relay (core), network-plugin-crypto-messages.

1. Implementation

• 1.1 Append three codes to NETWORK_INTRA_RELAY_CODES: RELAY_SIGNATURE_INVALID, RELAY_PEER_UNTRUSTED, RELAY_RATE_LIMIT_EXCEEDED.
• 1.2 src/security/relay-security-manager.ts — RelaySecurityManager.
• 1.3 Authenticate relay nodes using PeerIdentityVerifier from @suaveplan/network-plugin-crypto-messages.
• 1.4 Validate relay-message signatures.
• 1.5 Token-bucket rate limit per peer + global.
• 1.6 RelayAuthPolicy + RelayRateLimit types in src/types/security.types.ts.
• 1.7 Wire IntraRelayPlugin.security getter.

2. Tests

• 2.1 src/security/relay-security-manager.spec-conformance.test.ts — auth, signature, rate limit, allowlist, signature-required toggle.

3. Verify

• 3.1 bunx turbo lint typecheck test --filter=@suaveplan/network-plugin-intra-relay green.
• 3.2 bunx turbo test:coverage --filter=@suaveplan/network-plugin-intra-relay 100/100/100/100.
• 3.3 bun scripts/openspec-conformance.ts @suaveplan/network-plugin-intra-relay PASS.