suaveplan/openspec/archive/2026-05-05-network-plugin-crypto-messages/tasks.md

Tasks — network-plugin-crypto-messages

Blocked on: network-core, network-plugin-registry.

1. Scaffold

• 1.1 packages/network/network-plugin-crypto-messages/ with package.json, tsconfig.json, vitest.config.ts, README.md.
• 1.2 Workspace deps: @suaveplan/network, @suaveplan/error, @suaveplan/types, @suaveplan/events, @suaveplan/crypto-cipher, @suaveplan/crypto-hash, @suaveplan/crypto-keys, @suaveplan/timing, @opentelemetry/api, zod.
• 1.3 sideEffects: false.

2. Types

• 2.1 src/types/token.types.ts — SessionToken, MeshToken, TokenPayload.
• 2.2 src/types/signature.types.ts — MessageSignature, SignedMessage, KeyPair.
• 2.3 src/types/identity.types.ts — IdentityChallenge, IdentityResponse.
• 2.4 src/error-codes.ts — defineCodes("NET_CRYPTO", [...]).

3. Message signer

• 3.1 src/signer/message-signer.ts — MessageSigner.
• 3.2 Signs outbound with Ed25519 private key.
• 3.3 Verifies inbound using peer public key from registry.

4. Session token authority

• 4.1 src/token/session-token-authority.ts — SessionTokenAuthority.
• 4.2 Validates server Ed25519 signature on session tokens.
• 4.3 Rejects expired tokens, forged tokens, replayed tokens.
• 4.4 Emits token:valid / token:invalid on bus.

5. Mesh token authority

• 5.1 src/token/mesh-token-authority.ts — MeshTokenAuthority.
• 5.2 Validates server signature on mesh creation tokens.

6. Peer identity verifier

• 6.1 src/identity/peer-identity-verifier.ts — PeerIdentityVerifier.
• 6.2 Challenge-response during peer handshake.
• 6.3 Prevents peer ID spoofing.

7. Log chain signer

• 7.1 src/log-chain/log-chain-signer.ts — LogChainSigner.
• 7.2 entry[n] = sign(hash(entry[n-1]) + payload).
• 7.3 Tamper detection via hash chain break.

8. Key rotation manager

• 8.1 src/key-rotation/key-rotation-manager.ts — KeyRotationManager.
• 8.2 Periodic rotation with configurable interval.
• 8.3 Grace period for old signatures.
• 8.4 Broadcasts new public key on bus.

9. Plugin wrapper

• 9.1 src/plugin/crypto-messages-plugin.ts — CryptoMessagesPlugin implements NetworkPlugin.

10. Spec

• 10.1 Update openspec/specs/network/spec.md with NET-CRYPTO requirements.

11. Conformance tests

• 11.1 src/signer/signer.spec-conformance.test.ts — sign/verify, invalid rejection.
• 11.2 src/session-token/session-token.spec-conformance.test.ts — valid, expired, forged.
• 11.3 src/mesh-token/mesh-token.spec-conformance.test.ts — mesh token validation.
• 11.4 src/identity/identity.spec-conformance.test.ts — challenge-response, spoof.
• 11.5 src/log-chain/log-chain.spec-conformance.test.ts — chain integrity, tamper.
• 11.6 src/key-rotation/key-rotation.spec-conformance.test.ts — rotation, grace.
• 11.7 src/error-codes.spec-conformance.test.ts — frozen registry.

12. Plugin security verifier

• 12.1 src/plugin-security/plugin-security-verifier.ts — PluginSecurityVerifier, validates plugin integrity.
• 12.2 src/plugin-security/capability-validator.ts — PluginCapabilityValidator, enforces declared capabilities.
• 12.3 src/plugin-security/activity-monitor.ts — PluginActivityMonitor, detects anomalous patterns.
• 12.4 src/plugin-security/sandboxed-context.ts — SandboxedPluginContext, restricts sensitive operations.

13. Tier-specific security policies

• 13.1 src/policy/tier-security-policy.ts — TierSecurityPolicy, rules per tier.
• 13.2 Tier 0: full authority. Tier 1: relay + voting, no tokens. Tier 2: read-only sensitive ops.
• 13.3 src/policy/credential-delegation.ts — CredentialDelegation, cross-tier delegation.
• 13.4 src/policy/geo-security-policy.ts — GeoSecurityPolicy, optional regional restrictions.

14. Spec

• 14.1 Update openspec/specs/network/spec.md with NET-47, NET-48.

15. Conformance tests

• 15.1 src/plugin-security/plugin-security.spec-conformance.test.ts — integrity, capability enforcement.
• 15.2 src/plugin-security/activity.spec-conformance.test.ts — anomaly detection, rate limits.
• 15.3 src/policy/tier-policy.spec-conformance.test.ts — tier rules, delegation, geo restrictions.

16. Verify

• 16.1 bunx turbo lint typecheck test --filter=@suaveplan/network-plugin-crypto-messages green.
• 16.2 bunx turbo test:coverage --filter=@suaveplan/network-plugin-crypto-messages 100/100/100/100.
• 16.3 bun scripts/openspec-conformance.ts @suaveplan/network-plugin-crypto-messages PASS.

---

Audit Note (2026-05-05)

Status: PARTIAL — core sections (1–11, 16) shipped at full quality (100/100/100/100 coverage, 100% docs, openspec-conformance PASS, 65 tests across 9 files). Stretch sections deferred to follow-up changes:

• Section 12 (PluginSecurityVerifier / CapabilityValidator / ActivityMonitor / SandboxedPluginContext) → follow-up network-plugin-crypto-messages-plugin-security.
• Section 13 (TierSecurityPolicy / CredentialDelegation / GeoSecurityPolicy) → follow-up network-plugin-crypto-messages-tier-policy.
• Sections 14–15 conformance tests + spec entries (NET-47, NET-48) ship with the corresponding follow-up.

The shipped core (MessageSigner, SessionTokenAuthority, MeshTokenAuthority, PeerIdentityVerifier, LogChainSigner, KeyRotationManager, CryptoMessagesPlugin) covers NET-27 … NET-30 from the network spec and is fully self-contained; the deferred follow-ups can be added without breaking the shipped surface.