security(bus): make authenticated peer provenance mandatory at the Transport/Inbound seam

[hartsock]

Problem

agent_mesh_bus::Inbound carries a signed envelope and an opaque reply route, but no evidence identifying the peer authenticated by the transport session. The iroh implementation currently performs signer/session matching inside accept_conn, while the shared Transport seam does not require that check and the in-memory transport can bypass envelope verification entirely.

That makes transport authentication an implementation convention instead of a bus invariant: a new transport can hand an unbound envelope to the inbox, which then reconstructs RequestContext from the envelope alone.

Found while reviewing #77; this is the transport-neutral residual from #75.

Scope

• Add a typed authenticated-peer/delivery-provenance value to Inbound.
• Verify every envelope at the common bus admission boundary before replay state or dispatch is mutated.
• For direct delivery, require the envelope signer and user root to match the transport-authenticated peer and the local same-user policy.
• Represent missing binding explicitly and reject it by default.
• Keep carrier identity distinct from original signer identity so a future authorized-relay design cannot accidentally conflate them.
• Move the iroh session check into this shared contract; make the in-memory transport produce honest peer evidence rather than bypassing verification.

Acceptance

• Transport::recv cannot deliver a direct envelope without typed authenticated-peer evidence.
• The common receive boundary rejects unbound, signer-mismatched, stranger-rooted, bad-signature, and CID-mismatched envelopes before replay/sequence state changes.
• Iroh binds conn.remote_id() to the handshake certificate and supplies the resulting peer evidence to the bus.
• Existing request/reply behavior remains green for same-user, correctly bound peers.
• Real-boundary negative tests prove a valid envelope relayed over another peer's session is rejected.
• In-memory tests cannot pass while skipping SignedEnvelope::verify().
• just check and just cov-ci pass.

Related

• spike(transport): does the handshake expose a transcript hash for SAS binding? #30 — QUIC channel-binding/exporter analysis
• feat(protocol): cross-signing trust graph + identity pinning for multi-host agents #44 — root/host pinning and graded provenance (different layer)
• spike(transport): russh dual-role SSH proxy round-trip — operator → airship bastion → newt embedded sshd (cert auth both hops, no-PTY subsystem) #49 — SSH transport spike
• design: mesh exposes decision surfaces (first-contact pinning, caveat grants) — no TUI in library crates #65 / enrollment & delegation: SAS pairing ceremony + chain-to-principal pinning (ceremony-contract §5.4/§2.1) #66 — first-contact decision and enrollment ceremony
• bus: handle_requests_with_context — expose the verified caller principal #75 — verified caller context and the current iroh-local session check
• feat(transport): authenticate SSH-carried mesh sessions #77 — review that exposed the transport-contract gap

Out of scope

• Production SSH ingress.
• Human enrollment UI or SAS rendering.
• Persistent trust-graph/pin storage from feat(protocol): cross-signing trust graph + identity pinning for multi-host agents #44.