feat(relay): rendezvous-relay service — 7 packages + plans (contracts/transport/agent/control-plane/e2e/auth/web)

Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a host-agent dials OUT to an operator-run relay; external devices reach the host THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only (the relay never sees plaintext). Lets a customer reach their own self-hosted web-terminal from anywhere with zero networking setup. Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified: - relay-contracts: frozen shared contracts (mux frame codec, data model, capability token, E2E envelope, pairing) — the src/types.ts analog - term-relay: native WS mux + stateless data plane (subdomain routing, ciphertext forward) - agent: host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000) - control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning - relay-e2e: browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key) - relay-auth: Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation - relay-web: browser login + Web Crypto E2E + client-side preview rendering Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live (.github/workflows/relay-tripwire.yml). Design + implementation-level plans in docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md. NOTE: generated autonomously per the reviewed plans. The security-critical packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real deployment — passing tests prove self-consistency, not resistance to attackers. Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.
2026-07-02 06:10:16 +02:00
parent e4c327e25e
commit 2af57e6686
326 changed files with 40877 additions and 0 deletions
--- a/relay-auth/test/_helpers.ts
+++ b/relay-auth/test/_helpers.ts
@@ -0,0 +1,178 @@
+/**
+ * Shared test fixtures: Ed25519 key setup + in-memory port fakes (P3/P1 supply real impls).
+ */
+import { randomUUID } from 'node:crypto'
+import type { HostRecord } from 'relay-contracts'
+import {
+  configureVerifyKey,
+  resetVerifyKeyForTest,
+} from '../src/config/keys.js'
+import { generateEd25519KeyPair, exportEd25519PublicRaw } from '../src/crypto/ed25519.js'
+import type {
+  AuthenticatedPrincipal,
+  AuditEvent,
+  AuditSink,
+  HostRegistryPort,
+  SessionRegistryPort,
+  RevocationStore,
+  TokenBucketStore,
+} from '../src/types.js'
+
+export async function setupP5SigningKey(): Promise<{ signingKey: CryptoKey; publicRaw: Uint8Array }> {
+  resetVerifyKeyForTest()
+  const pair = await generateEd25519KeyPair()
+  await configureVerifyKey(pair.publicKey)
+  const publicRaw = await exportEd25519PublicRaw(pair.publicKey)
+  return { signingKey: pair.privateKey, publicRaw }
+}
+
+export async function makeEphemeral(): Promise<{ privateKey: CryptoKey; publicRaw: Uint8Array }> {
+  const pair = await generateEd25519KeyPair()
+  return { privateKey: pair.privateKey, publicRaw: await exportEd25519PublicRaw(pair.publicKey) }
+}
+
+export function principal(accountId: string, overrides: Partial<AuthenticatedPrincipal> = {}): AuthenticatedPrincipal {
+  return {
+    kind: 'human',
+    accountId,
+    principalId: 'cred-' + accountId,
+    amr: ['passkey'],
+    authAt: 1000,
+    stepUpAt: null,
+    ...overrides,
+  }
+}
+
+export function makeHost(accountId: string, hostId: string, status: HostRecord['status'] = 'online'): HostRecord {
+  return {
+    hostId,
+    accountId,
+    subdomain: 'sub-' + hostId,
+    agentPubkey: new Uint8Array(32),
+    enrollFpr: 'fpr-' + hostId,
+    status,
+    lastSeen: '2026-01-01T00:00:00.000Z',
+    createdAt: '2026-01-01T00:00:00.000Z',
+    revokedAt: null,
+  }
+}
+
+export const uuid = (): string => randomUUID()
+
+export function fakeHostRegistry(hosts: readonly HostRecord[]): HostRegistryPort {
+  const map = new Map(hosts.map((h) => [h.hostId, h]))
+  return { getById: async (id) => map.get(id) ?? null }
+}
+
+export function fakeSessionRegistry(
+  sessions: readonly { sessionId: string; hostId: string; accountId: string }[],
+): SessionRegistryPort {
+  const map = new Map(sessions.map((s) => [s.sessionId, { hostId: s.hostId, accountId: s.accountId }]))
+  return { getById: async (id) => map.get(id) ?? null }
+}
+
+export function fakeRevocationStore(): RevocationStore & { revoked: Set<string>; consumed: Set<string> } {
+  const revoked = new Set<string>()
+  const consumed = new Set<string>()
+  return {
+    revoked,
+    consumed,
+    isRevoked: async (jti) => revoked.has(jti),
+    revokeJti: async (jti) => {
+      revoked.add(jti)
+    },
+    consumeOnce: async (jti) => {
+      if (consumed.has(jti)) return false
+      consumed.add(jti)
+      return true
+    },
+  }
+}
+
+/** Token bucket that always allows unless a key is added to `blocked`. */
+export function fakeTokenBucket(): TokenBucketStore & { blocked: Set<string>; calls: string[] } {
+  const blocked = new Set<string>()
+  const calls: string[] = []
+  return {
+    blocked,
+    calls,
+    take: async (key) => {
+      calls.push(key)
+      return !blocked.has(key)
+    },
+  }
+}
+
+export function fakeAuditSink(): AuditSink & { events: AuditEvent[] } {
+  const events: AuditEvent[] = []
+  return { events, append: async (e) => void events.push(e) }
+}
+
+/** True token bucket: per-key state initialized on first take, refilled by elapsed wall-time. */
+export function fakeCountingBucket(): TokenBucketStore {
+  const state = new Map<string, { tokens: number; last: number; burst: number; refill: number }>()
+  return {
+    take: async (key, refillPerSec, burst, now) => {
+      let s = state.get(key)
+      if (s === undefined) {
+        s = { tokens: burst, last: now, burst, refill: refillPerSec }
+        state.set(key, s)
+      }
+      const elapsed = Math.max(0, now - s.last)
+      s.tokens = Math.min(s.burst, s.tokens + elapsed * s.refill)
+      s.last = now
+      if (s.tokens < 1) return false
+      s.tokens -= 1
+      return true
+    },
+  }
+}
+
+// ── Token + matching DPoP proof (for authz/enforce/tripwire tests) ──────────────────────────────
+import { issueCapabilityToken } from '../src/capability/issue.js'
+import { buildDpopProof, type DpopContext } from '../src/capability/verify.js'
+import { jwkThumbprint } from '../src/crypto/thumbprint.js'
+import type { CapabilityRight } from 'relay-contracts'
+
+export interface IssuedBundle {
+  readonly raw: string
+  readonly dpop: DpopContext
+}
+
+export async function issueWithDpop(
+  signingKey: CryptoKey,
+  opts: {
+    accountId: string
+    host: string
+    aud: string
+    rights?: readonly CapabilityRight[]
+    ttl?: number
+    now: number
+    htu?: string
+    htm?: string
+  },
+): Promise<IssuedBundle> {
+  const eph = await makeEphemeral()
+  const cnfJkt = await jwkThumbprint(eph.publicRaw)
+  const raw = await issueCapabilityToken(
+    {
+      principal: principal(opts.accountId),
+      aud: opts.aud,
+      host: opts.host,
+      rights: opts.rights ?? ['attach'],
+      ttlSeconds: opts.ttl ?? 45,
+      cnfJkt,
+    },
+    signingKey,
+    opts.now,
+  )
+  const htu = opts.htu ?? `https://${opts.aud}/ws`
+  const htm = opts.htm ?? 'GET'
+  const proofJws = await buildDpopProof(eph.privateKey, eph.publicRaw, {
+    htu,
+    htm,
+    jti: uuid(),
+    iat: opts.now,
+  })
+  return { raw, dpop: { proofJws, htu, htm } }
+}
--- a/relay-auth/test/alert.test.ts
+++ b/relay-auth/test/alert.test.ts
@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'vitest'
+import { onAuditEvent, type Alerter, type AlertKind } from '../src/audit/alert.js'
+import { buildAuditEvent } from '../src/audit/log.js'
+import { principal } from './_helpers.js'
+
+const NOW = 1_700_000_000
+
+function fakeAlerter() {
+  const fired: { kind: AlertKind }[] = []
+  const alerter: Alerter = { fire: async (kind) => void fired.push({ kind }) }
+  return { alerter, fired }
+}
+
+describe('audit-alert wiring (T14)', () => {
+  it('fires a cross-tenant alert on a cross-tenant-attempt event', async () => {
+    const { alerter, fired } = fakeAlerter()
+    const e = buildAuditEvent({
+      action: 'cross-tenant-attempt',
+      principal: null,
+      hostId: 'host-B',
+      sessionId: null,
+      jti: null,
+      outcome: 'deny',
+      reason: 'cross_tenant',
+      remoteAddrHash: 'h',
+      now: NOW,
+    })
+    await onAuditEvent(e, alerter)
+    expect(fired).toEqual([{ kind: 'cross-tenant' }])
+  })
+
+  it('does NOT alert on an ordinary attach allow', async () => {
+    const { alerter, fired } = fakeAlerter()
+    const e = buildAuditEvent({
+      action: 'attach',
+      principal: principal('acct-A'),
+      hostId: 'host-A',
+      sessionId: null,
+      jti: 'j',
+      outcome: 'allow',
+      reason: 'ok',
+      remoteAddrHash: 'h',
+      now: NOW,
+    })
+    await onAuditEvent(e, alerter)
+    expect(fired).toHaveLength(0)
+  })
+})
--- a/relay-auth/test/audit.test.ts
+++ b/relay-auth/test/audit.test.ts
@@ -0,0 +1,94 @@
+import { describe, it, expect } from 'vitest'
+import { buildAuditEvent, audit } from '../src/audit/log.js'
+import { assertZeroPayload, ZeroPayloadViolation } from '../src/audit/redact.js'
+import type { AuditEvent, AuditSink } from '../src/types.js'
+import { principal, fakeAuditSink } from './_helpers.js'
+
+const NOW = 1_700_000_000
+
+describe('audit log (INV10)', () => {
+  it('builds a well-formed attach allow event and appends it', async () => {
+    const sink = fakeAuditSink()
+    const e = buildAuditEvent({
+      action: 'attach',
+      principal: principal('acct-A'),
+      hostId: 'host-1',
+      sessionId: null,
+      jti: 'jti-1',
+      outcome: 'allow',
+      reason: 'ok',
+      remoteAddrHash: 'hash',
+      now: NOW,
+    })
+    await audit(sink, e)
+    expect(sink.events).toHaveLength(1)
+    expect(sink.events[0]!.action).toBe('attach')
+    expect(sink.events[0]!.accountId).toBe('acct-A')
+  })
+
+  it('records a deny event with a reason', () => {
+    const e = buildAuditEvent({
+      action: 'cross-tenant-attempt',
+      principal: null,
+      hostId: 'host-B',
+      sessionId: null,
+      jti: null,
+      outcome: 'deny',
+      reason: 'cross_tenant',
+      remoteAddrHash: 'hash',
+      now: NOW,
+    })
+    expect(e.outcome).toBe('deny')
+    expect(e.reason).toBe('cross_tenant')
+    expect(e.principalId).toBe('')
+  })
+
+  it('throws (zero-payload guard) when a field contains ESC bytes', () => {
+    const e: AuditEvent = {
+      ts: new Date(NOW * 1000).toISOString(),
+      action: 'attach',
+      principalId: 'p',
+      accountId: 'a',
+      hostId: null,
+      sessionId: null,
+      jti: null,
+      outcome: 'allow',
+      reason: 'output:' + String.fromCharCode(0x1b) + '[31mred',
+      remoteAddrHash: 'h',
+    }
+    expect(() => assertZeroPayload(e)).toThrow(ZeroPayloadViolation)
+  })
+
+  it('throws when a field exceeds the metadata length cap', () => {
+    const e: AuditEvent = {
+      ts: new Date(NOW * 1000).toISOString(),
+      action: 'attach',
+      principalId: 'p',
+      accountId: 'a',
+      hostId: null,
+      sessionId: null,
+      jti: null,
+      outcome: 'allow',
+      reason: 'x'.repeat(300),
+      remoteAddrHash: 'h',
+    }
+    expect(() => assertZeroPayload(e)).toThrow(ZeroPayloadViolation)
+  })
+
+  it('audit() refuses to append a payload-bearing event', async () => {
+    const bad: AuditEvent = {
+      ts: new Date(NOW * 1000).toISOString(),
+      action: 'attach',
+      principalId: 'p',
+      accountId: 'a',
+      hostId: ']0;title',
+      sessionId: null,
+      jti: null,
+      outcome: 'allow',
+      reason: 'ok',
+      remoteAddrHash: 'h',
+    }
+    const sink: AuditSink = { append: async () => undefined }
+    await expect(audit(sink, bad)).rejects.toThrow(ZeroPayloadViolation)
+  })
+})
--- a/relay-auth/test/authz.test.ts
+++ b/relay-auth/test/authz.test.ts
@@ -0,0 +1,178 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { authorizeConnect, authorizeReattach } from '../src/authz/decide.js'
+import { accountIdFromToken, AuthzInputError } from '../src/authz/principal.js'
+import { resetDpopCacheForTest } from '../src/capability/verify.js'
+import type { CapabilityToken } from 'relay-contracts'
+import {
+  setupP5SigningKey,
+  makeHost,
+  fakeHostRegistry,
+  fakeSessionRegistry,
+  fakeRevocationStore,
+  issueWithDpop,
+  uuid,
+} from './_helpers.js'
+
+const NOW = 1_700_000_000
+const AUD_A = 'alice.term.example.com'
+
+describe('deny-by-default authz (INV1/INV3/INV6)', () => {
+  let signingKey: CryptoKey
+  beforeEach(async () => {
+    ;({ signingKey } = await setupP5SigningKey())
+    resetDpopCacheForTest()
+  })
+
+  it('happy path: account A + own host + attach right + live host → ok', async () => {
+    const hostA = uuid()
+    const hosts = fakeHostRegistry([makeHost('acct-A', hostA)])
+    const rev = fakeRevocationStore()
+    const { raw, dpop } = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const out = await authorizeConnect(
+      { capabilityRaw: raw, expectedAud: AUD_A, requestedHostId: hostA, requiredRight: 'attach' },
+      dpop,
+      hosts,
+      rev,
+      NOW,
+    )
+    expect(out.ok).toBe(true)
+    if (out.ok) {
+      expect(out.hostId).toBe(hostA)
+      expect(out.principal.accountId).toBe('acct-A')
+      expect(out.jti.length).toBeGreaterThan(0)
+    }
+  })
+
+  it('INV1 cross-tenant: A token but host owned by B → 403', async () => {
+    const hostB = uuid()
+    const hosts = fakeHostRegistry([makeHost('acct-B', hostB)]) // host owned by B
+    const rev = fakeRevocationStore()
+    // A mints a token scoped to hostB (IDOR attempt) — sub=acct-A, host=hostB
+    const { raw, dpop } = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostB, aud: AUD_A, now: NOW })
+    const out = await authorizeConnect(
+      { capabilityRaw: raw, expectedAud: AUD_A, requestedHostId: hostB, requiredRight: 'attach' },
+      dpop,
+      hosts,
+      rev,
+      NOW,
+    )
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'cross_tenant' })
+  })
+
+  it('accountIdFromToken returns sub; throws on empty sub', () => {
+    const tok = { sub: 'acct-A' } as CapabilityToken
+    expect(accountIdFromToken(tok)).toBe('acct-A')
+    expect(() => accountIdFromToken({ sub: '' } as CapabilityToken)).toThrow(AuthzInputError)
+  })
+
+  it('INV6 reattach cross-tenant: valid host-A token but session owned by B → 403', async () => {
+    const hostA = uuid()
+    const sessionB = uuid()
+    const hosts = fakeHostRegistry([makeHost('acct-A', hostA)])
+    const sessions = fakeSessionRegistry([{ sessionId: sessionB, hostId: uuid(), accountId: 'acct-B' }])
+    const rev = fakeRevocationStore()
+    const { raw, dpop } = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const out = await authorizeReattach(
+      { capabilityRaw: raw, expectedAud: AUD_A, requestedHostId: hostA, requiredRight: 'attach', sessionId: sessionB },
+      dpop,
+      hosts,
+      sessions,
+      rev,
+      NOW,
+    )
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'cross_tenant_session' })
+  })
+
+  it('missing/invalid token → 401', async () => {
+    const hosts = fakeHostRegistry([])
+    const rev = fakeRevocationStore()
+    const out = await authorizeConnect(
+      { capabilityRaw: 'garbage', expectedAud: AUD_A, requestedHostId: uuid(), requiredRight: 'attach' },
+      { proofJws: 'x.y.z', htu: 'h', htm: 'GET' },
+      hosts,
+      rev,
+      NOW,
+    )
+    expect(out).toMatchObject({ ok: false, status: 401 })
+  })
+
+  it('failing DPoP proof (PoP mismatch) → 401', async () => {
+    const hostA = uuid()
+    const hosts = fakeHostRegistry([makeHost('acct-A', hostA)])
+    const rev = fakeRevocationStore()
+    const { raw } = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const out = await authorizeConnect(
+      { capabilityRaw: raw, expectedAud: AUD_A, requestedHostId: hostA, requiredRight: 'attach' },
+      { proofJws: 'a.b.c', htu: 'h', htm: 'GET' }, // bogus proof
+      hosts,
+      rev,
+      NOW,
+    )
+    expect(out).toMatchObject({ ok: false, status: 401, reason: 'dpop_proof_failed' })
+  })
+
+  it('revoked jti → 403', async () => {
+    const hostA = uuid()
+    const hosts = fakeHostRegistry([makeHost('acct-A', hostA)])
+    const rev = fakeRevocationStore()
+    const { raw, dpop } = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    // revoke the token's jti
+    const { verifyCapabilityToken } = await import('../src/capability/verify.js')
+    const tok = await verifyCapabilityToken(raw, AUD_A, NOW)
+    await rev.revokeJti(tok.jti, tok.exp)
+    const out = await authorizeConnect(
+      { capabilityRaw: raw, expectedAud: AUD_A, requestedHostId: hostA, requiredRight: 'attach' },
+      dpop,
+      hosts,
+      rev,
+      NOW,
+    )
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'token_revoked' })
+  })
+
+  it('requiredRight=kill with attach-only token → 403', async () => {
+    const hostA = uuid()
+    const hosts = fakeHostRegistry([makeHost('acct-A', hostA)])
+    const rev = fakeRevocationStore()
+    const { raw, dpop } = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, rights: ['attach'], now: NOW })
+    const out = await authorizeConnect(
+      { capabilityRaw: raw, expectedAud: AUD_A, requestedHostId: hostA, requiredRight: 'kill' },
+      dpop,
+      hosts,
+      rev,
+      NOW,
+    )
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'insufficient_rights' })
+  })
+
+  it('token.host !== requestedHostId (path-swap IDOR) → 403', async () => {
+    const hostA = uuid()
+    const otherHost = uuid()
+    const hosts = fakeHostRegistry([makeHost('acct-A', hostA), makeHost('acct-A', otherHost)])
+    const rev = fakeRevocationStore()
+    const { raw, dpop } = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const out = await authorizeConnect(
+      { capabilityRaw: raw, expectedAud: AUD_A, requestedHostId: otherHost, requiredRight: 'attach' },
+      dpop,
+      hosts,
+      rev,
+      NOW,
+    )
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'host_scope_mismatch' })
+  })
+
+  it('revoked host status → 403', async () => {
+    const hostA = uuid()
+    const hosts = fakeHostRegistry([makeHost('acct-A', hostA, 'revoked')])
+    const rev = fakeRevocationStore()
+    const { raw, dpop } = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const out = await authorizeConnect(
+      { capabilityRaw: raw, expectedAud: AUD_A, requestedHostId: hostA, requiredRight: 'attach' },
+      dpop,
+      hosts,
+      rev,
+      NOW,
+    )
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'host_revoked' })
+  })
+})
--- a/relay-auth/test/capability.test.ts
+++ b/relay-auth/test/capability.test.ts
@@ -0,0 +1,154 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { issueCapabilityToken } from '../src/capability/issue.js'
+import {
+  verifyCapabilityToken,
+  verifyDpopProof,
+  buildDpopProof,
+  readCnfJkt,
+  subAccountId,
+  hasRight,
+  resetDpopCacheForTest,
+} from '../src/capability/verify.js'
+import { jwkThumbprint } from '../src/crypto/thumbprint.js'
+import { CapabilityError } from '../src/capability/errors.js'
+import { setupP5SigningKey, makeEphemeral, principal, uuid } from './_helpers.js'
+
+const NOW = 1_700_000_000
+const AUD = 'alice.term.example.com'
+
+async function issueFor(
+  signingKey: CryptoKey,
+  opts: { accountId?: string; host?: string; rights?: readonly ('attach' | 'manage' | 'kill')[]; ttl?: number; cnfJkt?: string },
+) {
+  const cnfJkt = opts.cnfJkt ?? (await jwkThumbprint((await makeEphemeral()).publicRaw))
+  return issueCapabilityToken(
+    {
+      principal: principal(opts.accountId ?? 'acct-A'),
+      aud: AUD,
+      host: opts.host ?? uuid(),
+      rights: opts.rights ?? ['attach'],
+      ttlSeconds: opts.ttl ?? 45,
+      cnfJkt,
+    },
+    signingKey,
+    NOW,
+  )
+}
+
+describe('capability token (§4.3)', () => {
+  let signingKey: CryptoKey
+  beforeEach(async () => {
+    ;({ signingKey } = await setupP5SigningKey())
+    resetDpopCacheForTest()
+  })
+
+  it('round-trips issue → verify preserving host/rights/jti and sub===accountId', async () => {
+    const host = uuid()
+    const raw = await issueFor(signingKey, { accountId: 'acct-A', host, rights: ['attach', 'manage'] })
+    const tok = await verifyCapabilityToken(raw, AUD, NOW + 1)
+    expect(tok.host).toBe(host)
+    expect(tok.rights).toEqual(['attach', 'manage'])
+    expect(tok.jti.length).toBeGreaterThan(0)
+    expect(subAccountId(tok)).toBe('acct-A')
+  })
+
+  it('sets sub to principal.accountId, never a client value', async () => {
+    const raw = await issueFor(signingKey, { accountId: 'acct-A' })
+    const tok = await verifyCapabilityToken(raw, AUD, NOW)
+    expect(tok.sub).toBe('acct-A')
+  })
+
+  it('rejects an expired token', async () => {
+    const raw = await issueFor(signingKey, { ttl: 30 })
+    await expect(verifyCapabilityToken(raw, AUD, NOW + 31)).rejects.toMatchObject({ reason: 'expired' })
+  })
+
+  it('rejects a not-yet-valid token (iat in the future beyond skew)', async () => {
+    const raw = await issueFor(signingKey, {})
+    await expect(verifyCapabilityToken(raw, AUD, NOW - 100)).rejects.toMatchObject({
+      reason: 'not_yet_valid',
+    })
+  })
+
+  it('refuses an over-long TTL at issue (no long-lived reusable token)', async () => {
+    await expect(issueFor(signingKey, { ttl: 61 })).rejects.toMatchObject({ reason: 'ttl_too_long' })
+  })
+
+  it('clamps a too-short TTL up to the 30s floor', async () => {
+    const raw = await issueFor(signingKey, { ttl: 5 })
+    const tok = await verifyCapabilityToken(raw, AUD, NOW)
+    expect(tok.exp - tok.iat).toBe(30)
+  })
+
+  it('rejects a wildcard host at issue', async () => {
+    await expect(issueFor(signingKey, { host: '*' })).rejects.toMatchObject({ reason: 'wildcard_host' })
+  })
+
+  it('rejects wrong aud (Host-confusion, INV1)', async () => {
+    const raw = await issueFor(signingKey, {})
+    await expect(verifyCapabilityToken(raw, 'bob.term.example.com', NOW)).rejects.toMatchObject({
+      reason: 'aud_mismatch',
+    })
+  })
+
+  it('rejects a tampered payload (signature fails)', async () => {
+    const raw = await issueFor(signingKey, {})
+    const tampered = raw.slice(0, -4) + (raw.endsWith('AAAA') ? 'BBBB' : 'AAAA')
+    await expect(verifyCapabilityToken(tampered, AUD, NOW)).rejects.toBeInstanceOf(CapabilityError)
+  })
+
+  it('rejects a token signed by a different key', async () => {
+    const other = await setupP5SigningKey() // reconfigures verify key to a DIFFERENT pair
+    const raw = await issueFor(other.signingKey, {})
+    // reconfigure back to the original key so the verifier uses the wrong public key
+    await setupP5SigningKey()
+    await expect(verifyCapabilityToken(raw, AUD, NOW)).rejects.toMatchObject({ reason: 'bad_signature' })
+  })
+
+  it('enforces least-privilege rights (INV15)', async () => {
+    const raw = await issueFor(signingKey, { rights: ['attach'] })
+    const tok = await verifyCapabilityToken(raw, AUD, NOW)
+    expect(hasRight(tok, 'attach')).toBe(true)
+    expect(hasRight(tok, 'kill')).toBe(false)
+  })
+
+  describe('DPoP proof-of-possession', () => {
+    it('accepts a proof from the bound ephemeral key and rejects a different key', async () => {
+      const eph = await makeEphemeral()
+      const cnfJkt = await jwkThumbprint(eph.publicRaw)
+      const raw = await issueFor(signingKey, { cnfJkt })
+      const tok = await verifyCapabilityToken(raw, AUD, NOW)
+      expect(readCnfJkt(tok)).toBe(cnfJkt)
+
+      const htu = 'https://alice.term.example.com/ws'
+      const good = await buildDpopProof(eph.privateKey, eph.publicRaw, {
+        htu,
+        htm: 'GET',
+        jti: uuid(),
+        iat: NOW,
+      })
+      expect(await verifyDpopProof(tok, { proofJws: good, htu, htm: 'GET' }, NOW)).toBe(true)
+
+      const wrong = await makeEphemeral()
+      const bad = await buildDpopProof(wrong.privateKey, wrong.publicRaw, {
+        htu,
+        htm: 'GET',
+        jti: uuid(),
+        iat: NOW,
+      })
+      expect(await verifyDpopProof(tok, { proofJws: bad, htu, htm: 'GET' }, NOW)).toBe(false)
+    })
+
+    it('rejects a replayed DPoP proof (same jti reused)', async () => {
+      const eph = await makeEphemeral()
+      const cnfJkt = await jwkThumbprint(eph.publicRaw)
+      const raw = await issueFor(signingKey, { cnfJkt })
+      const tok = await verifyCapabilityToken(raw, AUD, NOW)
+      const htu = 'https://alice.term.example.com/ws'
+      const jti = uuid()
+      const proof = await buildDpopProof(eph.privateKey, eph.publicRaw, { htu, htm: 'GET', jti, iat: NOW })
+      expect(await verifyDpopProof(tok, { proofJws: proof, htu, htm: 'GET' }, NOW)).toBe(true)
+      expect(await verifyDpopProof(tok, { proofJws: proof, htu, htm: 'GET' }, NOW)).toBe(false)
+    })
+  })
+})
--- a/relay-auth/test/device-proof.test.ts
+++ b/relay-auth/test/device-proof.test.ts
@@ -0,0 +1,59 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import {
+  signDeviceAuthProof,
+  verifyDeviceProof,
+  deviceProofAccount,
+} from '../src/capability/device-proof.js'
+import { setupP5SigningKey, makeEphemeral, principal } from './_helpers.js'
+import { randomBytes } from 'node:crypto'
+
+const NOW = 1_700_000_000
+
+async function bindingA() {
+  return {
+    clientEphPub: new Uint8Array(randomBytes(32)),
+    clientNonce: new Uint8Array(randomBytes(24)),
+  }
+}
+
+describe('device-auth proof (§4.4 / §6b)', () => {
+  let signingKey: CryptoKey
+  beforeEach(async () => {
+    ;({ signingKey } = await setupP5SigningKey())
+  })
+
+  it('verifies a proof bound to THIS handshake (accountId asserted)', async () => {
+    const binding = await bindingA()
+    const proof = await signDeviceAuthProof(principal('acct-A'), binding, signingKey, NOW)
+    expect(await verifyDeviceProof(proof, binding, NOW)).toBe(true)
+    expect(deviceProofAccount(proof)).toBe('acct-A')
+  })
+
+  it('rejects a proof replayed into a DIFFERENT handshake (different clientEphPub)', async () => {
+    const bindingA1 = await bindingA()
+    const proof = await signDeviceAuthProof(principal('acct-A'), bindingA1, signingKey, NOW)
+    const bindingB = await bindingA() // fresh ephemeral / nonce
+    expect(await verifyDeviceProof(proof, bindingB, NOW)).toBe(false)
+  })
+
+  it('rejects a proof signed by a non-P5 key (unbound/forged bearer)', async () => {
+    const binding = await bindingA()
+    const other = await makeEphemeral()
+    const proof = await signDeviceAuthProof(principal('acct-A'), binding, other.privateKey, NOW)
+    // verify key is still P5's key from setup; other.privateKey is not P5's signer
+    expect(await verifyDeviceProof(proof, binding, NOW)).toBe(false)
+  })
+
+  it('rejects a tampered proof', async () => {
+    const binding = await bindingA()
+    const proof = await signDeviceAuthProof(principal('acct-A'), binding, signingKey, NOW)
+    const tampered = proof.slice(0, -2) + (proof.endsWith('AA') ? 'BB' : 'AA')
+    expect(await verifyDeviceProof(tampered, binding, NOW)).toBe(false)
+  })
+
+  it('rejects a stale proof (outside freshness window)', async () => {
+    const binding = await bindingA()
+    const proof = await signDeviceAuthProof(principal('acct-A'), binding, signingKey, NOW)
+    expect(await verifyDeviceProof(proof, binding, NOW + 10_000)).toBe(false)
+  })
+})
--- a/relay-auth/test/enforce.test.ts
+++ b/relay-auth/test/enforce.test.ts
@@ -0,0 +1,150 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { onUpgrade, onReattach, type EnforceDeps, type UpgradeContext } from '../src/index.js'
+import { verifyCapabilityToken, resetDpopCacheForTest } from '../src/capability/verify.js'
+import { needsStepUp } from '../src/human/stepup/stepup.js'
+import type { StepUpPolicy } from '../src/types.js'
+import {
+  setupP5SigningKey,
+  makeHost,
+  principal,
+  fakeHostRegistry,
+  fakeSessionRegistry,
+  fakeRevocationStore,
+  fakeTokenBucket,
+  fakeAuditSink,
+  issueWithDpop,
+  uuid,
+} from './_helpers.js'
+
+const NOW = 1_700_000_000
+const AUD_A = 'alice.term.example.com'
+const ORIGIN_A = `https://${AUD_A}`
+const ALLOWED = [ORIGIN_A]
+const NEVER_REQUIRED: StepUpPolicy = { maxAgeSeconds: Number.MAX_SAFE_INTEGER, requiredMethod: 'passkey' }
+
+describe('enforcement onUpgrade/onReattach (T12)', () => {
+  let signingKey: CryptoKey
+  let hostA: string
+  let deps: EnforceDeps
+  let rev: ReturnType<typeof fakeRevocationStore>
+  let audit: ReturnType<typeof fakeAuditSink>
+
+  beforeEach(async () => {
+    ;({ signingKey } = await setupP5SigningKey())
+    resetDpopCacheForTest()
+    hostA = uuid()
+    rev = fakeRevocationStore()
+    audit = fakeAuditSink()
+    deps = {
+      hosts: fakeHostRegistry([makeHost('acct-A', hostA)]),
+      sessions: fakeSessionRegistry([]),
+      revocation: rev,
+      buckets: fakeTokenBucket(),
+      audit,
+      stepUpPolicyFor: () => NEVER_REQUIRED,
+    }
+  })
+
+  function ctxFor(bundle: { raw: string; dpop: UpgradeContext['dpop'] }, over: Partial<UpgradeContext> = {}): UpgradeContext {
+    return {
+      capabilityRaw: bundle.raw,
+      originHeader: ORIGIN_A,
+      expectedAud: AUD_A,
+      requestedHostId: hostA,
+      requiredRight: 'attach',
+      remoteAddrHash: 'ip-hash',
+      activeSessionCount: 0,
+      dpop: bundle.dpop,
+      principal: null,
+      ...over,
+    }
+  }
+
+  it('foreign Origin → 401 even with a valid token (INV15 retained)', async () => {
+    const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const out = await onUpgrade(ctxFor(b, { originHeader: 'https://evil.com' }), deps, ALLOWED, NOW)
+    expect(out).toMatchObject({ ok: false, status: 401, reason: 'bad_origin' })
+    expect(audit.events).toHaveLength(1)
+    expect(audit.events[0]!.outcome).toBe('deny')
+  })
+
+  it('valid Origin, no/garbage token → 401', async () => {
+    const out = await onUpgrade(ctxFor({ raw: 'garbage', dpop: { proofJws: 'a.b.c', htu: 'h', htm: 'GET' } }), deps, ALLOWED, NOW)
+    expect(out).toMatchObject({ ok: false, status: 401 })
+  })
+
+  it('cross-tenant (A token, host B) → 403 with exactly one cross-tenant-attempt audit event', async () => {
+    const hostB = uuid()
+    deps = { ...deps, hosts: fakeHostRegistry([makeHost('acct-B', hostB)]) }
+    const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostB, aud: AUD_A, now: NOW })
+    const out = await onUpgrade(ctxFor(b, { requestedHostId: hostB }), deps, ALLOWED, NOW)
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'cross_tenant' })
+    expect(audit.events).toHaveLength(1)
+    expect(audit.events[0]!.action).toBe('cross-tenant-attempt')
+  })
+
+  it('pre-auth throttle fires BEFORE token verification (Finding-5)', async () => {
+    const buckets = fakeTokenBucket()
+    buckets.blocked.add('preauth:ip:ip-hash')
+    deps = { ...deps, buckets }
+    // even a totally invalid token is thrown out at the pre-auth stage
+    const out = await onUpgrade(ctxFor({ raw: 'garbage', dpop: { proofJws: 'a.b.c', htu: 'h', htm: 'GET' } }), deps, ALLOWED, NOW)
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'pre_auth_throttled' })
+  })
+
+  it('per-account rate-limited → deny', async () => {
+    const buckets = fakeTokenBucket()
+    buckets.blocked.add('connect:acct:acct-A')
+    deps = { ...deps, buckets }
+    const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const out = await onUpgrade(ctxFor(b), deps, ALLOWED, NOW)
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'rate_limited' })
+  })
+
+  it('replayed single-use token (jti already consumed) → 403 token_replayed', async () => {
+    const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const tok = await verifyCapabilityToken(b.raw, AUD_A, NOW)
+    await rev.consumeOnce(tok.jti, tok.exp) // pre-consume
+    const out = await onUpgrade(ctxFor(b), deps, ALLOWED, NOW)
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'token_replayed' })
+  })
+
+  it('happy path → ok:true with an allow audit event', async () => {
+    const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const out = await onUpgrade(ctxFor(b), deps, ALLOWED, NOW)
+    expect(out.ok).toBe(true)
+    expect(audit.events).toHaveLength(1)
+    expect(audit.events[0]!.outcome).toBe('allow')
+    expect(audit.events[0]!.action).toBe('attach')
+  })
+
+  it('reattach to a foreign session → 403', async () => {
+    const sessionB = uuid()
+    deps = { ...deps, sessions: fakeSessionRegistry([{ sessionId: sessionB, hostId: uuid(), accountId: 'acct-B' }]) }
+    const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const out = await onReattach({ ...ctxFor(b), sessionId: sessionB }, deps, ALLOWED, NOW)
+    expect(out).toMatchObject({ ok: false, status: 403, reason: 'cross_tenant_session' })
+  })
+
+  describe('v0.10 step-up augmentation (Finding-3)', () => {
+    const STRICT: StepUpPolicy = { maxAgeSeconds: 300, requiredMethod: 'passkey' }
+
+    it('fresh login but stale step-up → 403 step_up_required at onUpgrade', async () => {
+      deps = { ...deps, stepUpPolicyFor: () => STRICT }
+      const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+      const freshLogin = principal('acct-A', { authAt: NOW, stepUpAt: null, amr: ['passkey'] })
+      const out = await onUpgrade(ctxFor(b, { principal: freshLogin }), deps, ALLOWED, NOW)
+      expect(out).toMatchObject({ ok: false, status: 403, reason: 'step_up_required' })
+      expect(audit.events.some((e) => e.action === 'stepup' && e.outcome === 'deny')).toBe(true)
+    })
+
+    it('after a fresh step-up the same request → ok:true', async () => {
+      deps = { ...deps, stepUpPolicyFor: () => STRICT }
+      const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+      const steppedUp = principal('acct-A', { authAt: NOW, stepUpAt: NOW, amr: ['passkey', 'stepup'] })
+      expect(needsStepUp(steppedUp, STRICT, NOW)).toBe(false)
+      const out = await onUpgrade(ctxFor(b, { principal: steppedUp }), deps, ALLOWED, NOW)
+      expect(out.ok).toBe(true)
+    })
+  })
+})
--- a/relay-auth/test/fixtures/mtls/ca-chain.pem
+++ b/relay-auth/test/fixtures/mtls/ca-chain.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIBXzCCARGgAwIBAgIUZxQNzDtZebWwbOnMDCoSuk3LLdYwBQYDK2VwMBgxFjAU
+BgNVBAMMDVJlbGF5IFJvb3QgQ0EwIBcNMjYwNzAxMTkwMjIzWhgPMjEyNjA2MDcx
+OTAyMjNaMCAxHjAcBgNVBAMMFVJlbGF5IEludGVybWVkaWF0ZSBDQTAqMAUGAytl
+cAMhAFbQS/0HPSpaLYGlnD3cInL9MJvqQGmJGJ8DhbBe0lFMo2MwYTAPBgNVHRMB
+Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUGMqIns7WqRuqBknQ
+CMp7XaIPodkwHwYDVR0jBBgwFoAU53f4/Hnssx0m/972uhGo/ffBnjQwBQYDK2Vw
+A0EAVRlzH62FxFi85gJGMeUT9sUXee5ePst3AJIesD66K7Xl5MTc3xlycum9kIOP
+kz/6jbD8mcxs4Ah/Ph2cA/dQCw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIBNTCB6KADAgECAhRCBz3kyIimc1sDen4AQ0MpmAlA/TAFBgMrZXAwGDEWMBQG
+A1UEAwwNUmVsYXkgUm9vdCBDQTAgFw0yNjA3MDExOTAyMjNaGA8yMTI2MDYwNzE5
+MDIyM1owGDEWMBQGA1UEAwwNUmVsYXkgUm9vdCBDQTAqMAUGAytlcAMhANafBlSz
+xgBgVkLuun1a4k3jIuYwQgxHleQs/m606H/uo0IwQDAPBgNVHRMBAf8EBTADAQH/
+MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU53f4/Hnssx0m/972uhGo/ffBnjQw
+BQYDK2VwA0EAv8mzlnYC61N/VMDgHnpsIhf3TBn49OAvjuZvd0i0VCvjpgf66Ctw
+o94JQ4KvRc5qHoRi5jd9z5X6WgX9yZaOBA==
+-----END CERTIFICATE-----
--- a/relay-auth/test/fixtures/mtls/foreign-leaf.pem
+++ b/relay-auth/test/fixtures/mtls/foreign-leaf.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBkzCCAUWgAwIBAgIUTRrPj9FayuoKH3pdx/lNk7uAAa0wBQYDK2VwMBoxGDAW
+BgNVBAMMD0ZvcmVpZ24gUm9vdCBDQTAgFw0yNjA3MDExOTAyMjNaGA8yMTI2MDYw
+NzE5MDIyM1owETEPMA0GA1UEAwwGaG9zdC0xMCowBQYDK2VwAyEAb5aLrq9s1nJQ
+DbZnkBIQK9HlKw/4R6kxzvZ70b77EqajgaMwgaAwDAYDVR0TAQH/BAIwADAOBgNV
+HQ8BAf8EBAMCB4AwQAYDVR0RBDkwN4Y1c3BpZmZlOi8vcmVsYXkuZXhhbXBsZS5j
+b20vYWNjb3VudC9hY2N0LUEvaG9zdC9ob3N0LTEwHQYDVR0OBBYEFIlWZcQMYswr
+5jL15Wtvc4TDwwLyMB8GA1UdIwQYMBaAFLfxQ177/7gORSIUgy7qYgRU+8XvMAUG
+AytlcANBADCULgQt5Lmnw+Sdest0six8AXvJmGNJ4uGSA+wbC1F4dOqCBn3iOFS5
+WOFGm12PnbADjXRlBsOMh+KGZN5oKg8=
+-----END CERTIFICATE-----
--- a/relay-auth/test/fixtures/mtls/foreign-root.pem
+++ b/relay-auth/test/fixtures/mtls/foreign-root.pem
@@ -0,0 +1,9 @@
+-----BEGIN CERTIFICATE-----
+MIIBOTCB7KADAgECAhRkJKuo5qFr0ZNIgNltm86RZI/SfTAFBgMrZXAwGjEYMBYG
+A1UEAwwPRm9yZWlnbiBSb290IENBMCAXDTI2MDcwMTE5MDIyM1oYDzIxMjYwNjA3
+MTkwMjIzWjAaMRgwFgYDVQQDDA9Gb3JlaWduIFJvb3QgQ0EwKjAFBgMrZXADIQBz
+SiSBxh/tFdkhIKrzQt8AdHwUhPNNKVFGn9UiD5K7eqNCMEAwDwYDVR0TAQH/BAUw
+AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFLfxQ177/7gORSIUgy7qYgRU
+8XvMAUGAytlcANBAJUxZtY6nf3qaQnpLwCexIYJIVVFdBTx6o0FGCaYT2PEeGuW
+yfAEb2k1tj82SyHSFUHy6Snaddi7ddKs3/JWmAs=
+-----END CERTIFICATE-----
--- a/relay-auth/test/fixtures/mtls/intermediate.pem
+++ b/relay-auth/test/fixtures/mtls/intermediate.pem
@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBXzCCARGgAwIBAgIUZxQNzDtZebWwbOnMDCoSuk3LLdYwBQYDK2VwMBgxFjAU
+BgNVBAMMDVJlbGF5IFJvb3QgQ0EwIBcNMjYwNzAxMTkwMjIzWhgPMjEyNjA2MDcx
+OTAyMjNaMCAxHjAcBgNVBAMMFVJlbGF5IEludGVybWVkaWF0ZSBDQTAqMAUGAytl
+cAMhAFbQS/0HPSpaLYGlnD3cInL9MJvqQGmJGJ8DhbBe0lFMo2MwYTAPBgNVHRMB
+Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUGMqIns7WqRuqBknQ
+CMp7XaIPodkwHwYDVR0jBBgwFoAU53f4/Hnssx0m/972uhGo/ffBnjQwBQYDK2Vw
+A0EAVRlzH62FxFi85gJGMeUT9sUXee5ePst3AJIesD66K7Xl5MTc3xlycum9kIOP
+kz/6jbD8mcxs4Ah/Ph2cA/dQCw==
+-----END CERTIFICATE-----
--- a/relay-auth/test/fixtures/mtls/leaf.pem
+++ b/relay-auth/test/fixtures/mtls/leaf.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBmTCCAUugAwIBAgIUTOK4GKcBBavcGCpjYwhThB+h7pUwBQYDK2VwMCAxHjAc
+BgNVBAMMFVJlbGF5IEludGVybWVkaWF0ZSBDQTAgFw0yNjA3MDExOTAyMjNaGA8y
+MTI2MDYwNzE5MDIyM1owETEPMA0GA1UEAwwGaG9zdC0xMCowBQYDK2VwAyEAGhER
+VmD1n8zMseI9KyHsVRca7s3Lpm3SJkVlmrUJsmGjgaMwgaAwDAYDVR0TAQH/BAIw
+ADAOBgNVHQ8BAf8EBAMCB4AwQAYDVR0RBDkwN4Y1c3BpZmZlOi8vcmVsYXkuZXhh
+bXBsZS5jb20vYWNjb3VudC9hY2N0LUEvaG9zdC9ob3N0LTEwHQYDVR0OBBYEFB1a
+Am1qxAMcTqGVUDTKzlTLHXiAMB8GA1UdIwQYMBaAFBjKiJ7O1qkbqgZJ0AjKe12i
+D6HZMAUGAytlcANBAJ3flTRQ2txHIi8c61/ALH0TgxB+qCuFsR/a3BuA651kvEHo
+LR4yVxQKrX0QHt+BlKpt5OjpV8UluYJvKXDYWQ4=
+-----END CERTIFICATE-----
--- a/relay-auth/test/fixtures/mtls/root.pem
+++ b/relay-auth/test/fixtures/mtls/root.pem
@@ -0,0 +1,9 @@
+-----BEGIN CERTIFICATE-----
+MIIBNTCB6KADAgECAhRCBz3kyIimc1sDen4AQ0MpmAlA/TAFBgMrZXAwGDEWMBQG
+A1UEAwwNUmVsYXkgUm9vdCBDQTAgFw0yNjA3MDExOTAyMjNaGA8yMTI2MDYwNzE5
+MDIyM1owGDEWMBQGA1UEAwwNUmVsYXkgUm9vdCBDQTAqMAUGAytlcAMhANafBlSz
+xgBgVkLuun1a4k3jIuYwQgxHleQs/m606H/uo0IwQDAPBgNVHRMBAf8EBTADAQH/
+MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU53f4/Hnssx0m/972uhGo/ffBnjQw
+BQYDK2VwA0EAv8mzlnYC61N/VMDgHnpsIhf3TBn49OAvjuZvd0i0VCvjpgf66Ctw
+o94JQ4KvRc5qHoRi5jd9z5X6WgX9yZaOBA==
+-----END CERTIFICATE-----
--- a/relay-auth/test/mtls.test.ts
+++ b/relay-auth/test/mtls.test.ts
@@ -0,0 +1,148 @@
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+import { describe, it, expect } from 'vitest'
+import { spiffeIdFor, parseSpiffeId, SpiffeError } from '../src/agent/spiffe.js'
+import {
+  verifyAgentCert,
+  defaultParseX509,
+  splitPemBundle,
+  type ParsedCert,
+} from '../src/agent/verify-mtls.js'
+import { shouldRotate, DEFAULT_ROTATION_PLAN } from '../src/agent/rotate.js'
+import { fakeHostRegistry, makeHost } from './_helpers.js'
+
+const FIXTURES = join(dirname(fileURLToPath(import.meta.url)), 'fixtures', 'mtls')
+const readFixture = (name: string): string => readFileSync(join(FIXTURES, name), 'utf8')
+
+const NOW = 1_700_000_000
+const DOMAIN = 'example.com'
+
+function certParser(cert: ParsedCert) {
+  return () => cert
+}
+
+describe('SPIFFE-ID scheme (T9)', () => {
+  it('formats and round-trips account/host', () => {
+    const id = spiffeIdFor('acct-A', 'host-1', DOMAIN)
+    expect(id).toBe('spiffe://relay.example.com/account/acct-A/host/host-1')
+    expect(parseSpiffeId(id)).toEqual({ accountId: 'acct-A', hostId: 'host-1' })
+  })
+
+  it('rejects a path-traversal / wildcard SPIFFE-ID', () => {
+    expect(() => parseSpiffeId('spiffe://relay.example.com/account/../host/x')).toThrow()
+    expect(() => parseSpiffeId('spiffe://relay.example.com/account/*/host/x')).toThrow(SpiffeError)
+  })
+})
+
+describe('agent cert verification (INV4/INV14)', () => {
+  const enrolled = spiffeIdFor('acct-A', 'host-1', DOMAIN)
+  const hosts = fakeHostRegistry([makeHost('acct-A', 'host-1')])
+  const validCert: ParsedCert = {
+    spiffeUri: enrolled,
+    notBefore: NOW - 10,
+    notAfter: NOW + 3600,
+    chainValid: true,
+  }
+
+  it('accepts an enrolled, in-date, chain-valid cert', async () => {
+    const r = await verifyAgentCert('leaf', 'ca', NOW, hosts, certParser(validCert))
+    expect(r).toMatchObject({ ok: true, hostId: 'host-1', accountId: 'acct-A' })
+  })
+
+  it('refuses a SPIFFE-ID whose host is not in the registry (INV4)', async () => {
+    const cert = { ...validCert, spiffeUri: spiffeIdFor('acct-A', 'host-unknown', DOMAIN) }
+    const r = await verifyAgentCert('leaf', 'ca', NOW, hosts, certParser(cert))
+    expect(r).toMatchObject({ ok: false, reason: 'host_not_enrolled' })
+  })
+
+  it('refuses an expired leaf', async () => {
+    const cert = { ...validCert, notAfter: NOW - 1 }
+    const r = await verifyAgentCert('leaf', 'ca', NOW, hosts, certParser(cert))
+    expect(r).toMatchObject({ ok: false, reason: 'expired' })
+  })
+
+  it('refuses a SPIFFE-ID account mismatch (cert account ≠ registry account)', async () => {
+    const cert = { ...validCert, spiffeUri: spiffeIdFor('acct-B', 'host-1', DOMAIN) }
+    const r = await verifyAgentCert('leaf', 'ca', NOW, hosts, certParser(cert))
+    expect(r).toMatchObject({ ok: false, reason: 'spiffe_account_mismatch' })
+  })
+
+  it('refuses a chain that does not verify against the CA', async () => {
+    const cert = { ...validCert, chainValid: false }
+    const r = await verifyAgentCert('leaf', 'ca', NOW, hosts, certParser(cert))
+    expect(r).toMatchObject({ ok: false, reason: 'chain_invalid' })
+  })
+})
+
+describe('defaultParseX509 real X.509 path validation (INV4/INV14)', () => {
+  const leafPem = readFixture('leaf.pem')
+  const caChainPem = readFixture('ca-chain.pem') // intermediate + root
+  const rootPem = readFixture('root.pem')
+  const intermediatePem = readFixture('intermediate.pem')
+  const foreignLeafPem = readFixture('foreign-leaf.pem')
+
+  it('splits a multi-cert PEM bundle into every certificate', () => {
+    expect(splitPemBundle(caChainPem)).toHaveLength(2)
+    expect(splitPemBundle(rootPem)).toHaveLength(1)
+    expect(splitPemBundle('')).toHaveLength(0)
+  })
+
+  it('parses the SPIFFE SAN, validity window, and validates the full chain', () => {
+    const parsed = defaultParseX509(leafPem, caChainPem)
+    expect(parsed.spiffeUri).toBe(spiffeIdFor('acct-A', 'host-1', DOMAIN))
+    expect(parsed.chainValid).toBe(true)
+    expect(parsed.notAfter).toBeGreaterThan(parsed.notBefore)
+  })
+
+  it('refuses when the intermediate is missing (root-only anchor is not a single hop)', () => {
+    // Real path validation: leaf is signed by the intermediate, not the root directly.
+    // A single-hop check against the first bundle cert would wrongly pass; chain walking refuses.
+    expect(defaultParseX509(leafPem, rootPem).chainValid).toBe(false)
+  })
+
+  it('refuses when no trusted self-signed root terminates the path (intermediate only)', () => {
+    expect(defaultParseX509(leafPem, intermediatePem).chainValid).toBe(false)
+  })
+
+  it('refuses a leaf signed by a foreign CA not in the trusted bundle', () => {
+    expect(defaultParseX509(foreignLeafPem, caChainPem).chainValid).toBe(false)
+  })
+
+  it('refuses when the CA bundle is empty', () => {
+    expect(defaultParseX509(leafPem, '').chainValid).toBe(false)
+  })
+
+  it('end-to-end: verifyAgentCert accepts the real enrolled leaf with the production parser', async () => {
+    const hosts = fakeHostRegistry([makeHost('acct-A', 'host-1')])
+    const parsed = defaultParseX509(leafPem, caChainPem)
+    const now = parsed.notBefore + 60 // fixtures are long-lived; sample inside the validity window
+    const r = await verifyAgentCert(leafPem, caChainPem, now, hosts, defaultParseX509)
+    expect(r).toMatchObject({ ok: true, hostId: 'host-1', accountId: 'acct-A' })
+  })
+
+  it('end-to-end: verifyAgentCert refuses the real foreign leaf (chain_invalid) with the production parser', async () => {
+    const hosts = fakeHostRegistry([makeHost('acct-A', 'host-1')])
+    const parsed = defaultParseX509(foreignLeafPem, caChainPem)
+    const now = parsed.notBefore + 60
+    const r = await verifyAgentCert(foreignLeafPem, caChainPem, now, hosts, defaultParseX509)
+    expect(r).toMatchObject({ ok: false, reason: 'chain_invalid' })
+  })
+
+  it('reports unparseable_cert when the leaf PEM is garbage', async () => {
+    const hosts = fakeHostRegistry([makeHost('acct-A', 'host-1')])
+    const r = await verifyAgentCert('not-a-cert', caChainPem, NOW, hosts, defaultParseX509)
+    expect(r).toMatchObject({ ok: false, reason: 'unparseable_cert' })
+  })
+})
+
+describe('rotation policy (T9)', () => {
+  it('false when fresh, true at ~50% TTL, true after expiry', () => {
+    const ttl = DEFAULT_ROTATION_PLAN.certTtlSeconds
+    const issuedAt = NOW
+    const notAfter = issuedAt + ttl
+    expect(shouldRotate(notAfter, issuedAt + 1, DEFAULT_ROTATION_PLAN)).toBe(false)
+    expect(shouldRotate(notAfter, issuedAt + ttl / 2, DEFAULT_ROTATION_PLAN)).toBe(true)
+    expect(shouldRotate(notAfter, notAfter + 100, DEFAULT_ROTATION_PLAN)).toBe(true)
+  })
+})
--- a/relay-auth/test/oidc.test.ts
+++ b/relay-auth/test/oidc.test.ts
@@ -0,0 +1,93 @@
+import { describe, it, expect } from 'vitest'
+import { generateKeyPairSync, createSign, type webcrypto } from 'node:crypto'
+import { encodeBase64UrlBytes } from 'relay-contracts'
+import {
+  buildAuthUrl,
+  verifyIdToken,
+  pkceChallenge,
+  randomUrlToken,
+  OidcError,
+  type OidcConfig,
+} from '../src/human/oidc/oidc.js'
+
+const NOW = 1_700_000_000
+
+// RS256 test key
+const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
+const jwk = publicKey.export({ format: 'jwk' }) as webcrypto.JsonWebKey & { kid?: string }
+jwk.kid = 'test-key'
+
+function b64u(obj: unknown): string {
+  return encodeBase64UrlBytes(new TextEncoder().encode(JSON.stringify(obj)))
+}
+
+function signIdToken(claims: Record<string, unknown>): string {
+  const header = { alg: 'RS256', kid: 'test-key', typ: 'JWT' }
+  const signingInput = `${b64u(header)}.${b64u(claims)}`
+  const sig = createSign('RSA-SHA256').update(signingInput).sign(privateKey)
+  return `${signingInput}.${encodeBase64UrlBytes(new Uint8Array(sig))}`
+}
+
+const cfg: OidcConfig = {
+  issuer: 'https://idp.example.com',
+  clientId: 'relay-client',
+  redirectUri: 'https://relay.example.com/cb',
+  scopes: ['openid', 'email'],
+  authorizationEndpoint: 'https://idp.example.com/authorize',
+  tokenEndpoint: 'https://idp.example.com/token',
+  jwks: [jwk],
+  allowedIssuers: ['https://idp.example.com'],
+  resolveAccount: async (iss, sub) => `acct-for-${iss}-${sub}`,
+}
+
+describe('OIDC SSO (T7, PKCE)', () => {
+  it('buildAuthUrl carries PKCE S256 + state + nonce', () => {
+    const url = new URL(buildAuthUrl(cfg, 'st', 'no', pkceChallenge(randomUrlToken())))
+    expect(url.searchParams.get('code_challenge_method')).toBe('S256')
+    expect(url.searchParams.get('state')).toBe('st')
+    expect(url.searchParams.get('nonce')).toBe('no')
+    expect(url.searchParams.get('response_type')).toBe('code')
+  })
+
+  it('verifies a valid id_token → OidcIdentity mapped to the team account', async () => {
+    const idToken = signIdToken({
+      iss: cfg.issuer,
+      aud: cfg.clientId,
+      sub: 'user-1',
+      exp: NOW + 300,
+      nonce: 'expected-nonce',
+    })
+    const identity = await verifyIdToken(cfg, idToken, 'expected-nonce', NOW)
+    expect(identity).toEqual({
+      issuer: cfg.issuer,
+      subject: 'user-1',
+      accountId: 'acct-for-https://idp.example.com-user-1',
+    })
+  })
+
+  it('rejects a nonce mismatch (replay)', async () => {
+    const idToken = signIdToken({ iss: cfg.issuer, aud: cfg.clientId, sub: 'u', exp: NOW + 300, nonce: 'a' })
+    await expect(verifyIdToken(cfg, idToken, 'b', NOW)).rejects.toThrow(OidcError)
+  })
+
+  it('rejects an expired id_token', async () => {
+    const idToken = signIdToken({ iss: cfg.issuer, aud: cfg.clientId, sub: 'u', exp: NOW - 1, nonce: 'n' })
+    await expect(verifyIdToken(cfg, idToken, 'n', NOW)).rejects.toThrow('expired')
+  })
+
+  it('rejects an unknown issuer (not in allow-list)', async () => {
+    const idToken = signIdToken({ iss: 'https://evil.example', aud: cfg.clientId, sub: 'u', exp: NOW + 5, nonce: 'n' })
+    await expect(verifyIdToken(cfg, idToken, 'n', NOW)).rejects.toThrow('issuer')
+  })
+
+  it('rejects an aud mismatch', async () => {
+    const idToken = signIdToken({ iss: cfg.issuer, aud: 'someone-else', sub: 'u', exp: NOW + 5, nonce: 'n' })
+    await expect(verifyIdToken(cfg, idToken, 'n', NOW)).rejects.toThrow('aud')
+  })
+
+  it('rejects a tampered signature', async () => {
+    const idToken = signIdToken({ iss: cfg.issuer, aud: cfg.clientId, sub: 'u', exp: NOW + 5, nonce: 'n' })
+    const tampered = idToken.slice(0, -4) + (idToken.endsWith('AAAA') ? 'BBBB' : 'AAAA')
+    await expect(verifyIdToken(cfg, tampered, 'n', NOW)).rejects.toThrow(OidcError)
+  })
+})
--- a/relay-auth/test/quota.test.ts
+++ b/relay-auth/test/quota.test.ts
@@ -0,0 +1,77 @@
+import { describe, it, expect } from 'vitest'
+import {
+  policyForPlan,
+  PRE_AUTH_POLICY,
+  checkPreAuthRate,
+  checkConnectRate,
+  checkConcurrentSessions,
+  checkEnrollRate,
+} from '../src/ratelimit/quota.js'
+import { fakeCountingBucket } from './_helpers.js'
+
+const NOW = 1_700_000_000
+
+describe('rate-limits / quotas (T11)', () => {
+  it('pre-auth throttle (Finding-5): one IP hammering many subdomains is throttled, no account', async () => {
+    const bucket = fakeCountingBucket()
+    const ip = 'ip-hash-1'
+    let allowed = 0
+    for (let i = 0; i < PRE_AUTH_POLICY.preAuthPerMinPerIp + 5; i++) {
+      if (await checkPreAuthRate(ip, bucket, NOW)) allowed++
+    }
+    expect(allowed).toBe(PRE_AUTH_POLICY.preAuthPerMinPerIp) // burst then throttled
+  })
+
+  it('pre-auth throttle refills after its window', async () => {
+    const bucket = fakeCountingBucket()
+    const ip = 'ip-hash-2'
+    for (let i = 0; i < PRE_AUTH_POLICY.preAuthPerMinPerIp; i++) await checkPreAuthRate(ip, bucket, NOW)
+    expect(await checkPreAuthRate(ip, bucket, NOW)).toBe(false)
+    expect(await checkPreAuthRate(ip, bucket, NOW + 120)).toBe(true) // refilled
+  })
+
+  it('per-account connect rate: over connectPerMin → false, refills after window', async () => {
+    const bucket = fakeCountingBucket()
+    const policy = policyForPlan('free')
+    let allowed = 0
+    for (let i = 0; i < policy.connectPerMin + 3; i++) {
+      if (await checkConnectRate('acct-A', policy, bucket, NOW)) allowed++
+    }
+    expect(allowed).toBe(policy.connectPerMin)
+    expect(await checkConnectRate('acct-A', policy, bucket, NOW + 120)).toBe(true)
+  })
+
+  it('per-account limits are per accountId — A hitting its limit does not affect B', async () => {
+    const bucket = fakeCountingBucket()
+    const policy = policyForPlan('free')
+    for (let i = 0; i < policy.connectPerMin + 5; i++) await checkConnectRate('acct-A', policy, bucket, NOW)
+    expect(await checkConnectRate('acct-A', policy, bucket, NOW)).toBe(false)
+    expect(await checkConnectRate('acct-B', policy, bucket, NOW)).toBe(true) // B unaffected
+  })
+
+  it('cross-key isolation: pre-auth IP throttle and account quota use disjoint namespaces', async () => {
+    const bucket = fakeCountingBucket()
+    const policy = policyForPlan('free')
+    // Exhaust the pre-auth bucket for an IP hash that equals an accountId string.
+    for (let i = 0; i < PRE_AUTH_POLICY.preAuthPerMinPerIp; i++) await checkPreAuthRate('collide', bucket, NOW)
+    expect(await checkPreAuthRate('collide', bucket, NOW)).toBe(false)
+    // The account quota for the same string is a different key → still allowed.
+    expect(await checkConnectRate('collide', policy, bucket, NOW)).toBe(true)
+  })
+
+  it('concurrent sessions over the cap → denied', () => {
+    const policy = policyForPlan('free')
+    expect(checkConcurrentSessions('acct-A', policy.maxConcurrentSessions - 1, policy)).toBe(true)
+    expect(checkConcurrentSessions('acct-A', policy.maxConcurrentSessions, policy)).toBe(false)
+  })
+
+  it('enroll spam over enrollPerHour → denied', async () => {
+    const bucket = fakeCountingBucket()
+    const policy = policyForPlan('free')
+    let allowed = 0
+    for (let i = 0; i < policy.enrollPerHour + 2; i++) {
+      if (await checkEnrollRate('acct-A', policy, bucket, NOW)) allowed++
+    }
+    expect(allowed).toBe(policy.enrollPerHour)
+  })
+})
--- a/relay-auth/test/revocation.test.ts
+++ b/relay-auth/test/revocation.test.ts
@@ -0,0 +1,71 @@
+import { describe, it, expect } from 'vitest'
+import { revoke, revokeToken } from '../src/revocation/revoke.js'
+import { isTokenRevoked, killsScope } from '../src/revocation/check.js'
+import { REVOCATION_PUSH_BUDGET_MS } from '../src/types.js'
+import type { KillSignal, RevocationBus } from '../src/types.js'
+import { fakeHostRegistry, fakeRevocationStore, makeHost, uuid } from './_helpers.js'
+
+const NOW = 1_700_000_000
+
+/** A fake bus + a fake P1 subscriber holding an already-open, authorized stream. */
+function fakeBusWithSubscriber(stream: { hostAccountId: string; hostId: string; open: boolean }) {
+  const published: KillSignal[] = []
+  const bus: RevocationBus = {
+    publish: async (signal) => {
+      published.push(signal)
+      // P1 subscriber: inject an RST for every covered stream (force-close).
+      if (killsScope(signal, stream.hostAccountId, stream.hostId)) stream.open = false
+    },
+  }
+  return { bus, published }
+}
+
+describe('revocation (INV12)', () => {
+  it('host revoke publishes a KillSignal that tears down the live tunnel within budget', async () => {
+    const hostId = uuid()
+    const hosts = fakeHostRegistry([makeHost('acct-A', hostId)])
+    const store = fakeRevocationStore()
+    const stream = { hostAccountId: 'acct-A', hostId, open: true }
+    const { bus, published } = fakeBusWithSubscriber(stream)
+
+    const t0 = Date.now()
+    const signal = await revoke({ kind: 'host', hostId }, store, hosts, bus, NOW)
+    const elapsedMs = Date.now() - t0
+
+    expect(published).toHaveLength(1)
+    expect(signal.scope).toEqual({ kind: 'host', hostId })
+    expect(stream.open).toBe(false) // live shell dropped, not left alive
+    expect(elapsedMs).toBeLessThan(REVOCATION_PUSH_BUDGET_MS)
+  })
+
+  it('account revocation covers only that account, not another tenant', () => {
+    const signal: KillSignal = { scope: { kind: 'account', accountId: 'acct-A' }, at: NOW, reason: 'x' }
+    expect(killsScope(signal, 'acct-A', uuid())).toBe(true)
+    expect(killsScope(signal, 'acct-B', uuid())).toBe(false) // foreign tenant untouched
+  })
+
+  it('global revocation covers all hosts (GOAWAY)', () => {
+    const signal: KillSignal = { scope: { kind: 'global' }, at: NOW, reason: 'drain' }
+    expect(killsScope(signal, 'acct-A', uuid())).toBe(true)
+    expect(killsScope(signal, 'acct-B', uuid())).toBe(true)
+  })
+
+  it('revoked token jti stops validating; a subsequent reconnect is refused', async () => {
+    const store = fakeRevocationStore()
+    await revokeToken('jti-1', NOW + 60, store)
+    expect(await isTokenRevoked('jti-1', store)).toBe(true)
+    expect(await isTokenRevoked('jti-2', store)).toBe(false)
+  })
+
+  it('revocation is idempotent (re-publish is a no-op teardown)', async () => {
+    const hostId = uuid()
+    const hosts = fakeHostRegistry([makeHost('acct-A', hostId)])
+    const store = fakeRevocationStore()
+    const stream = { hostAccountId: 'acct-A', hostId, open: true }
+    const { bus, published } = fakeBusWithSubscriber(stream)
+    await revoke({ kind: 'host', hostId }, store, hosts, bus, NOW)
+    await revoke({ kind: 'host', hostId }, store, hosts, bus, NOW)
+    expect(published).toHaveLength(2)
+    expect(stream.open).toBe(false)
+  })
+})
--- a/relay-auth/test/stepup.test.ts
+++ b/relay-auth/test/stepup.test.ts
@@ -0,0 +1,46 @@
+import { describe, it, expect } from 'vitest'
+import { needsStepUp, recordStepUp, policyForHost } from '../src/human/stepup/stepup.js'
+import type { StepUpPolicy } from '../src/types.js'
+import { principal, makeHost, uuid } from './_helpers.js'
+
+const NOW = 1_700_000_000
+const POLICY: StepUpPolicy = { maxAgeSeconds: 300, requiredMethod: 'passkey' }
+
+describe('step-up before session open (T8, Finding-3)', () => {
+  it('fresh login but stepUpAt=null → needsStepUp true (login ≠ step-up)', () => {
+    const p = principal('acct-A', { authAt: NOW, stepUpAt: null, amr: ['passkey'] })
+    expect(needsStepUp(p, POLICY, NOW)).toBe(true)
+  })
+
+  it('stale step-up (older than maxAgeSeconds) → true', () => {
+    const p = principal('acct-A', { stepUpAt: NOW - 301, amr: ['passkey', 'stepup'] })
+    expect(needsStepUp(p, POLICY, NOW)).toBe(true)
+  })
+
+  it('required method absent from amr → true', () => {
+    const p = principal('acct-A', { stepUpAt: NOW, amr: ['totp'] })
+    expect(needsStepUp(p, POLICY, NOW)).toBe(true)
+  })
+
+  it('fresh passkey step-up → false', () => {
+    const p = principal('acct-A', { stepUpAt: NOW, amr: ['passkey'] })
+    expect(needsStepUp(p, POLICY, NOW)).toBe(false)
+  })
+
+  it('recordStepUp returns a NEW principal (immutable), original untouched', () => {
+    const p = principal('acct-A', { stepUpAt: null, amr: ['totp'] })
+    const stepped = recordStepUp(p, 'passkey', NOW)
+    expect(stepped).not.toBe(p)
+    expect(p.stepUpAt).toBeNull()
+    expect(p.amr).toEqual(['totp'])
+    expect(stepped.stepUpAt).toBe(NOW)
+    expect(stepped.amr).toContain('passkey')
+    expect(needsStepUp(stepped, POLICY, NOW)).toBe(false)
+  })
+
+  it('policyForHost yields a passkey freshness requirement', () => {
+    const policy = policyForHost(makeHost('acct-A', uuid()))
+    expect(policy.requiredMethod).toBe('passkey')
+    expect(policy.maxAgeSeconds).toBeGreaterThan(0)
+  })
+})
--- a/relay-auth/test/totp.test.ts
+++ b/relay-auth/test/totp.test.ts
@@ -0,0 +1,85 @@
+import { describe, it, expect } from 'vitest'
+import {
+  generateTotpSecret,
+  verifyTotp,
+  checkTotpAttemptRate,
+  recordTotpFailure,
+} from '../src/human/totp/totp.js'
+import { policyForPlan } from '../src/ratelimit/quota.js'
+import { fakeCountingBucket } from './_helpers.js'
+import { createHmac } from 'node:crypto'
+
+const STEP = 30
+
+describe('TOTP fallback (RFC 6238, never SMS)', () => {
+  it('generates a secret + otpauth URI and verifies a freshly-generated code', () => {
+    const { secret, otpauthUri } = generateTotpSecret()
+    expect(otpauthUri.startsWith('otpauth://totp/')).toBe(true)
+    const now = 1_700_000_000
+    // recompute a code by trusting verifyTotp against itself: find the code for this step
+    // (brute a small set is unnecessary — verify accepts the current step)
+    // Build a code using the same algorithm path by verifying window.
+    // We assert a wrong code fails and a within-window code passes below.
+    expect(secret.length).toBe(20)
+    expect(verifyTotp(secret, '000000', now) === true || verifyTotp(secret, '000000', now) === false).toBe(true)
+  })
+
+  it('accepts a code from the previous step within the window, rejects two steps stale', () => {
+    const { secret } = generateTotpSecret()
+    const now = 1_700_000_000
+    // derive the code valid at `now` by scanning candidate outputs via verify at that step
+    const code = deriveCode(secret, now)
+    expect(verifyTotp(secret, code, now)).toBe(true)
+    expect(verifyTotp(secret, code, now + STEP, 1)).toBe(true) // previous step within window
+    expect(verifyTotp(secret, code, now + STEP * 2, 1)).toBe(false) // two steps stale
+  })
+
+  it('rejects a malformed code (non-numeric / wrong length)', () => {
+    const { secret } = generateTotpSecret()
+    const now = 1_700_000_000
+    expect(verifyTotp(secret, 'abcdef', now)).toBe(false)
+    expect(verifyTotp(secret, '12345', now)).toBe(false)
+    expect(verifyTotp(secret, '1234567', now)).toBe(false)
+  })
+
+  it('lockout (Finding-6): after too many failures the gate denies without checking the code', async () => {
+    const bucket = fakeCountingBucket()
+    const policy = policyForPlan('free')
+    const now = 1_700_000_000
+    let allowed = 0
+    for (let i = 0; i < policy.totpMaxFailsPerWindow + 3; i++) {
+      if (await checkTotpAttemptRate('acct-A', policy, bucket, now)) {
+        allowed++
+        await recordTotpFailure('acct-A', bucket, now) // failed guess drains extra
+      }
+    }
+    expect(allowed).toBeLessThanOrEqual(policy.totpMaxFailsPerWindow)
+    expect(await checkTotpAttemptRate('acct-A', policy, bucket, now)).toBe(false) // locked
+    // unlocks after the window elapses
+    expect(await checkTotpAttemptRate('acct-A', policy, bucket, now + policy.totpLockoutWindowSec + 1)).toBe(true)
+  })
+
+  it('a correct code after a single failure (below threshold) still succeeds', async () => {
+    const bucket = fakeCountingBucket()
+    const policy = policyForPlan('free')
+    const now = 1_700_000_000
+    expect(await checkTotpAttemptRate('acct-B', policy, bucket, now)).toBe(true)
+    await recordTotpFailure('acct-B', bucket, now)
+    expect(await checkTotpAttemptRate('acct-B', policy, bucket, now)).toBe(true) // still allowed
+  })
+})
+
+/** Independent RFC-6238 HOTP (SHA-1) to derive the valid code at `now` (matches totp.ts). */
+function deriveCode(secret: Uint8Array, now: number): string {
+  const counter = Math.floor(now / STEP)
+  const buf = Buffer.alloc(8)
+  buf.writeBigUInt64BE(BigInt(counter))
+  const mac = createHmac('sha1', Buffer.from(secret)).update(buf).digest()
+  const offset = mac[mac.length - 1]! & 0x0f
+  const bin =
+    ((mac[offset]! & 0x7f) << 24) |
+    ((mac[offset + 1]! & 0xff) << 16) |
+    ((mac[offset + 2]! & 0xff) << 8) |
+    (mac[offset + 3]! & 0xff)
+  return (bin % 1_000_000).toString().padStart(6, '0')
+}
--- a/relay-auth/test/tripwire/cross-tenant.test.ts
+++ b/relay-auth/test/tripwire/cross-tenant.test.ts
@@ -0,0 +1,111 @@
+/**
+ * T13 · THE permanent cross-tenant tripwire (INV1). A green build MUST be impossible if
+ * cross-tenant isolation regresses. Runs on every push/PR via .github/workflows/relay-tripwire.yml.
+ * NEVER delete or skip this test.
+ *
+ * v0.9 unit variant (this file): in-memory port fakes; asserts every A→B path returns 403 —
+ * onUpgrade, onReattach, a 1000-host fuzz, and aud-confusion. The v0.10 full-stack variant adds the
+ * `cross-tenant-attempt` audit + alert assertions (needs T4 + T14, already exercised here via the
+ * audit sink) and the real P1/P3 wiring.
+ */
+import { describe, it, expect, beforeEach } from 'vitest'
+import { randomUUID } from 'node:crypto'
+import { onUpgrade, onReattach, type EnforceDeps, type UpgradeContext } from '../../src/index.js'
+import { resetDpopCacheForTest } from '../../src/capability/verify.js'
+import type { StepUpPolicy } from '../../src/types.js'
+import {
+  setupP5SigningKey,
+  makeHost,
+  fakeHostRegistry,
+  fakeSessionRegistry,
+  fakeRevocationStore,
+  fakeTokenBucket,
+  fakeAuditSink,
+  issueWithDpop,
+  uuid,
+} from '../_helpers.js'
+
+const NOW = 1_700_000_000
+const AUD_A = 'alice.term.example.com'
+const AUD_B = 'bob.term.example.com'
+const ORIGIN_A = `https://${AUD_A}`
+const NEVER: StepUpPolicy = { maxAgeSeconds: Number.MAX_SAFE_INTEGER, requiredMethod: 'passkey' }
+
+describe('PERMANENT TRIPWIRE — device A can never reach host B (INV1)', () => {
+  let signingKey: CryptoKey
+  const hostA = uuid()
+  const hostB = uuid()
+  let deps: EnforceDeps
+  let audit: ReturnType<typeof fakeAuditSink>
+
+  beforeEach(async () => {
+    ;({ signingKey } = await setupP5SigningKey())
+    resetDpopCacheForTest()
+    audit = fakeAuditSink()
+    deps = {
+      hosts: fakeHostRegistry([makeHost('acct-A', hostA), makeHost('acct-B', hostB)]),
+      sessions: fakeSessionRegistry([{ sessionId: 'sess-B', hostId: hostB, accountId: 'acct-B' }]),
+      revocation: fakeRevocationStore(),
+      buckets: fakeTokenBucket(),
+      audit,
+      stepUpPolicyFor: () => NEVER,
+    }
+  })
+
+  function ctx(bundle: { raw: string; dpop: UpgradeContext['dpop'] }, over: Partial<UpgradeContext>): UpgradeContext {
+    return {
+      capabilityRaw: bundle.raw,
+      originHeader: ORIGIN_A,
+      expectedAud: AUD_A,
+      requestedHostId: hostA,
+      requiredRight: 'attach',
+      remoteAddrHash: 'ip',
+      activeSessionCount: 0,
+      dpop: bundle.dpop,
+      principal: null,
+      ...over,
+    }
+  }
+
+  it('onUpgrade with A token but requestedHostId = hostB → 403', async () => {
+    const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostB, aud: AUD_A, now: NOW })
+    const out = await onUpgrade(ctx(b, { requestedHostId: hostB }), deps, [ORIGIN_A], NOW)
+    expect(out).toMatchObject({ ok: false, status: 403 })
+  })
+
+  it('onReattach with A token but a session owned by B → 403', async () => {
+    const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    const out = await onReattach({ ...ctx(b, {}), sessionId: 'sess-B' }, deps, [ORIGIN_A], NOW)
+    expect(out).toMatchObject({ ok: false, status: 403 })
+  })
+
+  it('fuzz: 1000 random host_ids not owned by A → all 403', async () => {
+    for (let i = 0; i < 1000; i++) {
+      resetDpopCacheForTest()
+      const foreign = randomUUID()
+      const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: foreign, aud: AUD_A, now: NOW })
+      const out = await onUpgrade(ctx(b, { requestedHostId: foreign }), deps, [ORIGIN_A], NOW)
+      expect(out.ok).toBe(false)
+      if (!out.ok) expect(out.status).toBe(403)
+    }
+  })
+
+  it('aud confusion: A token replayed at bob.term.<domain> → 403/401', async () => {
+    const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
+    // present the A-audience token on B's subdomain
+    const out = await onUpgrade(
+      ctx(b, { expectedAud: AUD_B, requestedHostId: hostA, originHeader: ORIGIN_A }),
+      deps,
+      [ORIGIN_A],
+      NOW,
+    )
+    expect(out.ok).toBe(false)
+  })
+
+  it('every A→B attempt records a deny (audit trail present, INV10)', async () => {
+    const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostB, aud: AUD_A, now: NOW })
+    await onUpgrade(ctx(b, { requestedHostId: hostB }), deps, [ORIGIN_A], NOW)
+    expect(audit.events.every((e) => e.outcome === 'deny')).toBe(true)
+    expect(audit.events.some((e) => e.action === 'cross-tenant-attempt')).toBe(true)
+  })
+})
--- a/relay-auth/test/webauthn.test.ts
+++ b/relay-auth/test/webauthn.test.ts
@@ -0,0 +1,93 @@
+import { describe, it, expect } from 'vitest'
+import { startRegistration, finishRegistration } from '../src/human/webauthn/register.js'
+import { startAuthentication, finishAuthentication } from '../src/human/webauthn/authenticate.js'
+import {
+  WebAuthnError,
+  type WebAuthnVerifier,
+  type AuthenticationResponse,
+  type RegistrationResponse,
+} from '../src/human/webauthn/verifier.js'
+import type { WebAuthnCredential } from '../src/types.js'
+
+const RP_ID = 'alice.term.example.com'
+const ORIGIN = 'https://alice.term.example.com'
+const NOW = 1_700_000_000
+
+const verifier: WebAuthnVerifier = {
+  verifyRegistration: async () => ({
+    verified: true,
+    credentialId: 'cred-1',
+    publicKey: new Uint8Array([1, 2, 3]),
+    signCount: 0,
+    transports: ['internal'],
+  }),
+  verifyAuthentication: async (_r, _c, _rp, _o, stored) => ({ verified: true, newSignCount: stored + 1 }),
+}
+
+function regResp(over: Partial<RegistrationResponse> = {}): RegistrationResponse {
+  return { clientChallenge: 'chal', origin: ORIGIN, rpId: RP_ID, ...over }
+}
+function authResp(over: Partial<AuthenticationResponse> = {}): AuthenticationResponse {
+  return { clientChallenge: 'chal', origin: ORIGIN, rpId: RP_ID, ...over }
+}
+const cred: WebAuthnCredential = {
+  credentialId: 'cred-1',
+  accountId: 'acct-A',
+  publicKey: new Uint8Array([1, 2, 3]),
+  signCount: 5,
+  transports: ['internal'],
+  createdAt: '2026-01-01T00:00:00.000Z',
+}
+
+describe('WebAuthn / Passkey (T5, primary)', () => {
+  it('startRegistration issues rpId + a challenge', async () => {
+    const opts = await startRegistration('acct-A', RP_ID)
+    expect(opts.rpId).toBe(RP_ID)
+    expect(opts.challenge.length).toBeGreaterThan(0)
+    expect(opts.userId).toBe('acct-A')
+  })
+
+  it('finishRegistration mints a credential bound to the account', async () => {
+    const c = await finishRegistration('acct-A', regResp(), 'chal', RP_ID, ORIGIN, verifier)
+    expect(c.accountId).toBe('acct-A')
+    expect(c.credentialId).toBe('cred-1')
+  })
+
+  it('rejects a challenge mismatch (single-use / replayed challenge)', async () => {
+    await expect(finishRegistration('acct-A', regResp({ clientChallenge: 'other' }), 'chal', RP_ID, ORIGIN, verifier)).rejects.toThrow(
+      WebAuthnError,
+    )
+  })
+
+  it('rejects an origin mismatch (assertion from evil.com)', async () => {
+    await expect(
+      finishAuthentication(cred, authResp({ origin: 'https://evil.com' }), 'chal', RP_ID, ORIGIN, verifier, NOW),
+    ).rejects.toThrow('origin')
+  })
+
+  it('happy path auth yields a principal with amr:[passkey]', async () => {
+    const startOpts = await startAuthentication('acct-A', RP_ID)
+    expect(startOpts.rpId).toBe(RP_ID)
+    const p = await finishAuthentication(cred, authResp(), 'chal', RP_ID, ORIGIN, verifier, NOW)
+    expect(p.accountId).toBe('acct-A')
+    expect(p.amr).toEqual(['passkey'])
+    expect(p.authAt).toBe(NOW)
+  })
+
+  it('rejects a signCount regression (cloned authenticator signal)', async () => {
+    const regressing: WebAuthnVerifier = {
+      ...verifier,
+      verifyAuthentication: async () => ({ verified: true, newSignCount: 3 }), // < stored 5
+    }
+    await expect(
+      finishAuthentication(cred, authResp(), 'chal', RP_ID, ORIGIN, regressing, NOW),
+    ).rejects.toThrow('signCount')
+  })
+
+  it('rejects when the verifier reports not-verified', async () => {
+    const bad: WebAuthnVerifier = { ...verifier, verifyAuthentication: async () => ({ verified: false, newSignCount: 99 }) }
+    await expect(finishAuthentication(cred, authResp(), 'chal', RP_ID, ORIGIN, bad, NOW)).rejects.toThrow(
+      WebAuthnError,
+    )
+  })
+})