fix(relay): close F6 replay K_content nonce reuse via per-generation epoch-in-key

The recoverable replay key was stable per (hostContentSecret, sessionId) while the
agent-side sealer resets its deterministic-nonce seq to 0 on every restart/re-attach
→ two sealer generations sealed distinct plaintext under the SAME (key, nonce).

Add a required 'epoch' to ReplayKeyParams, fold it into the K_content HKDF salt
(sessionId U+001F epoch), mint a fresh epoch per createReplaySealer generation and
expose it, and thread it through ReplaySource so the browser re-derives the matching
key. Fresh epoch per generation ⇒ fresh key ⇒ seq=0 can never collide; recoverability
within a generation is preserved.

Touches relay-contracts/relay-e2e/agent/relay-web. Green: contracts 81, e2e 78,
agent 133, web 99; tsc clean. Regression proves same seq-0 nonce, different key.

relay-e2e/src/replay-key.ts

@@ -21,12 +21,36 @@ import { openFrame, sealFrame } from './session.js'
 
 const encoder = new TextEncoder()
 
-/** HKDF(hostContentSecret, salt=sessionId, info=REPLAY_KDF_INFO) → per-session, per-host content key. */
+/**
+ * ASCII unit separator (0x1f). Domain-separates sessionId ‖ epoch inside the HKDF salt so
+ * distinct (sessionId, epoch) pairs can never alias via concatenation. Neither field contains
+ * it: sessionId is an opaque id and epoch is a generated non-secret diversifier.
+ */
+const SALT_FIELD_SEPARATOR = 0x1f
+
+/** salt = utf8(sessionId) ‖ 0x1f ‖ utf8(epoch) — unambiguous per-session, per-generation binding. */
+function replaySalt(sessionId: string, epoch: string): Uint8Array {
+  const sessionBytes = encoder.encode(sessionId)
+  const epochBytes = encoder.encode(epoch)
+  const salt = new Uint8Array(sessionBytes.length + 1 + epochBytes.length)
+  salt.set(sessionBytes, 0)
+  salt[sessionBytes.length] = SALT_FIELD_SEPARATOR
+  salt.set(epochBytes, sessionBytes.length + 1)
+  return salt
+}
+
+/**
+ * HKDF(hostContentSecret, salt=sessionId ‖ 0x1f ‖ epoch, info=REPLAY_KDF_INFO) → per-session,
+ * per-host, per-generation content key (F6). A fresh `epoch` per sealer generation yields a fresh
+ * key even for the same (hostContentSecret, sessionId), so a seq=0 reset after restart/re-attach
+ * can never collide with a prior generation's (key, nonce). Recoverability WITHIN one generation is
+ * preserved: same (secret, sessionId, alg, epoch) ⇒ byte-identical key.
+ */
 export function deriveContentKey(p: ReplayKeyParams): AeadKey {
   const raw = hkdf(
     sha256,
     p.hostContentSecret,
-    encoder.encode(p.sessionId),
+    replaySalt(p.sessionId, p.epoch),
     encoder.encode(REPLAY_KDF_INFO),
     AEAD_KEY_BYTES,
   )

relay-e2e/test/keystore.test.ts

@@ -37,8 +37,8 @@ describe('T11 multi-device adapters (authenticated channel, NOT a QR)', () => {
       expect(result.aead).toBe('xchacha20-poly1305')
       expect(label).toBeTruthy()
     }
-    const kA = deriveContentKey({ hostContentSecret: secret, sessionId: 's', alg: 'aes-256-gcm' })
-    const kB = deriveContentKey({ hostContentSecret: secret, sessionId: 's', alg: 'aes-256-gcm' })
+    const kA = deriveContentKey({ hostContentSecret: secret, sessionId: 's', alg: 'aes-256-gcm', epoch: 'gen-0' })
+    const kB = deriveContentKey({ hostContentSecret: secret, sessionId: 's', alg: 'aes-256-gcm', epoch: 'gen-0' })
     expect(bytesToHex(unwrapAeadKey(kA).raw)).toBe(bytesToHex(unwrapAeadKey(kB).raw))
   })
 

relay-e2e/test/replay-key.test.ts

@@ -6,10 +6,16 @@ import { AeadOpenError } from '../src/errors.js'
 import { deriveContentKey, openReplayCiphertext, sealReplayFrame } from '../src/replay-key.js'
 import { bytesToHex, fromUtf8, utf8 } from './helpers.js'
 
-const params = (secret: Uint8Array, sessionId: string, alg: AeadAlg = 'aes-256-gcm'): ReplayKeyParams => ({
+const params = (
+  secret: Uint8Array,
+  sessionId: string,
+  alg: AeadAlg = 'aes-256-gcm',
+  epoch = 'gen-0',
+): ReplayKeyParams => ({
   hostContentSecret: secret,
   sessionId,
   alg,
+  epoch,
 })
 
 describe('T10 recoverable replay content-key', () => {
@@ -48,6 +54,29 @@ describe('T10 recoverable replay content-key', () => {
     expect(() => openReplayCiphertext(deriveContentKey(params(secretA, 's2')), wire)).toThrow(AeadOpenError)
   })
 
+  it('F6: SAME (secret, sessionId) but DIFFERENT epoch ⇒ different raw key bytes (no seq=0 (key,nonce) reuse across generations)', () => {
+    const secret = new Uint8Array(32).fill(0x66)
+    // Two sealer generations (e.g. before/after an agent restart) that both reset seq to 0.
+    const kA = deriveContentKey(params(secret, 'sess-F6', 'aes-256-gcm', 'epoch-A'))
+    const kB = deriveContentKey(params(secret, 'sess-F6', 'aes-256-gcm', 'epoch-B'))
+    // Raw key bytes MUST differ, so sealFrame(kA, 0n) and sealFrame(kB, 0n) never share (key, nonce).
+    expect(bytesToHex(unwrapAeadKey(kA).raw)).not.toBe(bytesToHex(unwrapAeadKey(kB).raw))
+
+    // And a frame sealed under one epoch cannot be opened with the other epoch's key.
+    const wireA = encodeEnvelope(sealReplayFrame(kA, 0n, utf8('generation A, seq 0')))
+    expect(() => openReplayCiphertext(kB, wireA)).toThrow(AeadOpenError)
+  })
+
+  it('F6: SAME (secret, sessionId, epoch) ⇒ identical key — recoverability WITHIN a generation preserved', () => {
+    const secret = new Uint8Array(32).fill(0x67)
+    const kSeal = deriveContentKey(params(secret, 'sess-F6', 'aes-256-gcm', 'epoch-E'))
+    const wire = encodeEnvelope(sealReplayFrame(kSeal, 0n, utf8('same-epoch replay')))
+    // Browser re-derives the key for the SAME epoch E carried with the ring buffer.
+    const kReDerived = deriveContentKey(params(secret, 'sess-F6', 'aes-256-gcm', 'epoch-E'))
+    expect(bytesToHex(unwrapAeadKey(kSeal).raw)).toBe(bytesToHex(unwrapAeadKey(kReDerived).raw))
+    expect(fromUtf8(openReplayCiphertext(kReDerived, wire))).toBe('same-epoch replay')
+  })
+
   it('revocation (INV12): a revoked wrap yields no secret → no key derivable for that host going forward', () => {
     // The unwrap mechanism is P5/P2; P4 asserts derivation is GATED on having the unwrapped secret.
     const revokedUnwrap = (): Uint8Array => {