flvx/plans/evidence/070-relay-auth-validation.md

Relay authentication validation

Local darwin/arm64 checkout, base 3549fe5. No deploy/push/release or production credentials. Three pre-existing investigation tests were preserved.

Confirmed seam

Panel HTTP plus node/federation commands, using temporary SQLite repositories, loopback HTTP/WebSocket peers, and captured command data. Native data-plane auth matrix is recorded separately in the required-route validation evidence.

Vertical regression evidence

• New local tunnel: observed failure because generated relay connector/receiver authentication was absent; implemented purpose-separated endpoint credentials.
• Required tunnel configuration export: observed missing authentication-policy marker; exported marker added, credentials remain excluded. Configuration restore of protected tunnels explicitly rejects missing private state.
• Federation reserve/apply: observed missing capability advertisement; added versioned contract, receiver authentication, persistent state, and no-downgrade.
• Full dual-panel middle/exit tunnel: observed zero authenticated receivers; threaded receiving and next-target credentials through consumer requests.
• Federation strict middle policy: observed absent chain.strict; local and federation middle generators now set it while exits retain direct dialing.
• Insert a new middle before an existing middle: observed rejected update with hop-index credentials; receiver identity changed to tunnel/node/role, preserving the existing credential and assigning the new receiver a distinct credential.
• Direct-to-relay conversion: observed absent relay authentication; conversion now requires credentials while existing legacy relay tunnels remain explicit.
• Provider private JSON loss: observed successful reapply recreating protected state; separately persisted auth version now rejects missing private material.

Additional command-seam checks cover local update stability, reconnect followed by explicit public batch-redeploy (avoids the 30-second production debounce), missing consumer private state rejection, old peer refusal before reservation, legacy list visibility, matched per-hop credentials and secret-free list/export.

Results

Eight authentication contract tests with race detection, repeated three times: go test -race ./tests/contract -run '^(TestNewRelayTunnelEmitsMatchingPrivateEndpointAuthentication|TestFederatedRelayRequiresVersionedAuthAndRejectsDowngrade|TestNewFederatedTunnelAuthenticatesEveryRelayHop|TestRelayAuthenticationSurvivesInsertingBeforeExistingMiddle|TestConvertingDirectTunnelRequiresRelayAuthentication|TestBackupImportCannotSilentlyDowngradeRequiredRelay|TestNewRelayTunnelRefusesLegacyFederationBeforeReservation|TestLegacyRelayStateRemainsExplicitInList)$' -count=3

Earlier pass: 17.878 seconds. Final run after provider version guard and log redaction: PASS, 19.584 seconds. Focused non-TLS generation regression passes after narrowing its old overbroad no-metadata assertion. git diff --check passes.

Explicit limitations

• Authentication-only protection against anonymous relay clients, not credential confidentiality over raw TCP/unverified TLS/public-default KCP or insecure control-plane paths.
• Required mode is desired policy, not attestation of every participating agent. Old agent strict-route support requires upgrading the agent.
• Existing legacy relay tunnels remain unprotected. No automatic migration, credential rotation, or configuration-only credential recovery is implemented.
• SQLite/loopback verification only in this task; production topology, live upgrades, and PostgreSQL runtime checks are not exercised here.