fix(mc-host): authenticate daemon version transcripts

[ahrav]

Summary

Daemon version metadata is now authenticated in both handshake directions. The proof transcript length-prefixes the UTF-8 version, and Rust, TypeScript, raw-client, and fake-peer vectors share the same construction.

Verification

• cargo test -p mc-host auth --lib --tests
• bun test packages/plugin/src/shared/mc-host-client/auth.test.ts packages/plugin/src/shared/mc-host-client/client.test.ts

Stack

1. fix(mc-host): authenticate daemon version transcripts #58 authentication transcript
2. fix(mc-host): bind runtime execution to verified identity #59 native runtime identity
3. fix(plugin): fence lifecycle compatibility by daemon #60 client compatibility
4. test(release): bind lifecycle evidence to attested runs #61 release evidence
5. fix(ci): restore portable lifecycle source checks #62 CI portability

Stacked on #46.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: fec2112b-b600-4bf9-8093-fd5377e13135

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (6 files)

• crates/mc-host/src/auth.rs
• crates/mc-host/tests/protocol_vectors.rs
• crates/mc-host/tests/support/raw_client.rs
• packages/plugin/src/shared/mc-host-client/auth.test.ts
• packages/plugin/src/shared/mc-host-client/auth.ts
• packages/plugin/src/shared/mc-host-client/test-support/fake-peer.ts

---

_{Reviewed by gemini-3.7-flash · Input: 315.9K · Output: 24.1K · Cached: 1.4M}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0be6776def

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Version the changed authentication transcript

When an updated client encounters an already-running daemon from the preceding release (or an older client encounters the updated daemon), both peers still advertise wire_version: 2 and use the same subc-*-v1 domains, but they now calculate different HMACs because only one side includes daemon_ver; the handshake therefore fails with proof_mismatch before compatibility policy can inspect the daemon version. Introduce a separately identifiable proof/wire version or an explicit migration path so mixed-generation upgrades remain operable.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Update the normative wire protocol with the new transcript

This comment says the new construction is defined by wire-doc Section 5.2, but docs/mc-host-wire-protocol.md:196-206 still publishes the old proof arrays and HMAC(... || server_nonce || daemon_id) formula. Because that document declares itself the direct-only wire authority, an independent implementation or conformance vector built from it will reject the updated Rust and TypeScript peers; update the canonical formula and both literal proof vectors in the same change.

Useful? React with 👍 / 👎.