Onboarding core: setup payloads, enrollment tickets, scan-to-join (docs/10)

* kv-proto: ticket and join wire types, LoginFinish.ticket, b64_opt.
* kv-crypto: pairing.rs (HPKE AuthPSK seal/open with the QR secret as PSK, SAS code).
* kv-sync: onboarding.rs (kestrove://setup/v1 and kestrove://join/v1 codec with
  strict validation), ApiClient ticket/join calls and login_with_ticket, test
  server support for tickets and rendezvous.
* kv-ffi: parse/encode_setup_payload, setup_payload_for_kit, add_device_payload,
  revoke_enrollment_ticket, login_with_setup, join_start/poll/cancel,
  join_approve/send. The Secret Key is kept locally, HPKE-sealed to enc_pk.
* Tests: codec round trips and rejections, AuthPSK tamper cases, end-to-end
  Add-device QR and scan-to-join between two clients, forged bundles, bound
  tickets; live test extended with scan-to-join.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

This commit is contained in:

sami

2026-10-17 23:49:48 +09:00

co-authored by

Claude Opus 5.5

parent f20380d293

commit 266fb90e45

14 changed files with 1409 additions and 17 deletions

									
										crates/kv-ffi/Cargo.toml
									
		+1
		
												View File
												
				@@ -22,6 +22,7 @@ kv-store.workspace = true

				kv-sync.workspace = true

				kv-import.workspace = true

				serde.workspace = true

				base64.workspace = true

				hkdf.workspace = true

				sha2.workspace = true

				tokio = { workspace = true }