pairling 0.2.8 → 0.2.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pairling",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Pair your iPhone with the AI coding agents running on your Mac. CLI and local runtime installer for the Pairling iOS app.",
   "keywords": [
     "pairling",
@@ -40,7 +40,7 @@
     "url": "https://github.com/mergimg0/pairling-helper"
   },
   "optionalDependencies": {
-    "@pairling/runtime-darwin-arm64": "0.2.8",
-    "@pairling/runtime-darwin-x64": "0.2.8"
+    "@pairling/runtime-darwin-arm64": "0.2.10",
+    "@pairling/runtime-darwin-x64": "0.2.10"
   }
 }

package/payload/mac/SOURCE_REVISION

@@ -1 +1 @@
-c07a6fd
+0d3be68

package/payload/mac/VERSION

@@ -1 +1 @@
-0.2.8
+0.2.10

package/payload/mac/companiond/pairlingd.py

@@ -728,6 +728,7 @@ POST_ONLY_ENDPOINTS = {
     "/pair/reauth-claim",
     "/pair/revoke",
     "/pair/rotate-token",
+    "/pair/bind-node",
     "/aperture-cli/open",
     "/open",
     "/inject",
@@ -811,6 +812,12 @@ PROOF_REQUIRED_ENDPOINTS = HIGH_RISK_ENDPOINTS | {
     "/phone-tools/availability",
     "/phone-tools/next",
     "/phone-tools/result",
+    # Minimal proof-required POST whose only purpose is to trip the interactive
+    # provenance bind in _maybe_persist_tailnet_node_id. The iOS post-pair proof
+    # probes the embedded route with GET (never proof-required), so the bind for
+    # an untagged D2 interactive node never fired. A proof-required POST here
+    # reaches proof_verified=True and binds the device's tailnet_node_id.
+    "/pair/bind-node",
 }
 
 MAX_REQUEST_BODY_BYTES = 1_000_000
@@ -1046,7 +1053,31 @@ def _connectd_peer_node_id(headers) -> str:
     return value
 
 
-def _maybe_persist_tailnet_node_id(headers, client_address, auth_result) -> bool:
+def _connectd_peer_provenance(headers):
+    """Parse the connectd-injected X-Pairling-Peer-Provenance header strictly.
+
+    connectd strips any client-supplied copy first, so when this header is
+    present it is trustworthy. Three outcomes, kept deliberately distinct:
+
+    * header ABSENT -> return None. Legacy-eligible: an old connectd that sends
+      X-Pairling-Peer-Node but no provenance keeps the bearer-only bind.
+    * header EXACTLY "tagged" (tag:pairling-phone minted node) or "interactive"
+      (untagged Pairling iOS D2 node) -> return that exact value.
+    * header PRESENT but any other value (including empty) -> return "" as an
+      invalid sentinel. Distinct from None so a present-but-invalid value is
+      rejected, never silently downgraded to the legacy path.
+    """
+    getter = headers.get if hasattr(headers, "get") else lambda key, default=None: default
+    raw = getter("X-Pairling-Peer-Provenance", None)
+    if raw is None:
+        return None
+    value = str(raw).strip()
+    if value in ("tagged", "interactive"):
+        return value
+    return ""
+
+
+def _maybe_persist_tailnet_node_id(headers, client_address, auth_result, proof_verified=False) -> bool:
     if DEVICE_REGISTRY is None or auth_result is None or not getattr(auth_result, "ok", False):
         return False
     device_id = str(getattr(auth_result, "device_id", "") or "").strip()
@@ -1056,9 +1087,26 @@ def _maybe_persist_tailnet_node_id(headers, client_address, auth_result) -> bool
         return False
     if not _pairdrop_gateway_provenance_ok(headers, client_address):
         return False
+    provenance = _connectd_peer_provenance(headers)
     node_id = _connectd_peer_node_id(headers)
     if not node_id:
         return False
+    if provenance is None:
+        # Legacy: an old connectd sent a peer-node header but no provenance.
+        # Bind after bearer auth, preserving the pre-Stage-2 behavior.
+        pass
+    elif provenance == "tagged":
+        # tag:pairling-phone minted node: bearer auth is sufficient to bind.
+        pass
+    elif provenance == "interactive":
+        # Untagged, less-trusted Pairling iOS D2 node: bind only after the
+        # request also passed request-proof, never on bearer auth alone.
+        if not proof_verified:
+            return False
+    else:
+        # Present-but-invalid provenance value: reject. Do NOT downgrade to the
+        # legacy path just because the value is unrecognized.
+        return False
     try:
         return bool(DEVICE_REGISTRY.set_tailnet_node_id_if_absent(device_id, node_id))
     except Exception:
@@ -2352,6 +2400,23 @@ def _pairling_connect_health() -> dict:
     return _cached_probe("pairling_connect_health", _HEALTH_PROBE_CACHE_SECONDS, probe)
 
 
+def _coordinator_from_pairling_connect(connect: dict) -> dict:
+    ready = bool(connect.get("ready"))
+    return {
+        "role": "primary_coordinator",
+        "host": DEFAULT_COORDINATOR_HOST,
+        "posture": "ready" if ready else "unknown",
+        "severity": "ok" if ready else "unknown",
+        "summary": (
+            "Pairling Connect route is ready."
+            if ready
+            else "Pairling Connect route is not ready."
+        ),
+        "stale": False,
+        "tailnet_axis": "pairling_connect",
+    }
+
+
 # Guardian checks whose failure is fully compensated by a ready Pairling
 # Connect route: both only measure the standalone-Tailscale axis.
 _TAILNET_AXIS_CHECK_IDS = {"tailscale_ip", "daemon_reachable"}
@@ -2507,11 +2572,9 @@ def _routez_payload(auth_result=None) -> dict:
 
 
 def _health_payload(full_power: bool = False, authenticated: bool = False, auth_result=None) -> dict:
-    state, path, age, error = _read_guardian_state()
-    power_state = _normalize_guardian_state(state)
-    coordinator = _coordinator_from_guardian(power_state, age, error)
     connect = _pairling_connect_health()
-    coordinator = _apply_pairling_connect_posture(coordinator, power_state, connect)
+    power_state = None
+    coordinator = _coordinator_from_pairling_connect(connect)
     if connect.get("summary") is not None:
         coordinator = dict(coordinator)
         coordinator["pairling_connect"] = connect["summary"]
@@ -2551,11 +2614,6 @@ def _health_payload(full_power: bool = False, authenticated: bool = False, auth_
             "high_risk_count": 0,
             "updated_at": _time.time(),
         }
-    if full_power:
-        payload["guardian_path"] = path
-        payload["guardian_error"] = error
-        payload["guardian_sample_age_seconds"] = age
-        payload["power_state"] = power_state
     return payload
 
 
@@ -2575,11 +2633,11 @@ def _cached_health_payload(full_power: bool = False, authenticated: bool = False
 
 
 def _mac_health_alert_snapshot() -> dict:
-    state, _path, age, error = _read_guardian_state()
-    coordinator = _coordinator_from_guardian(state, age, error)
-    coordinator = _apply_pairling_connect_posture(
-        coordinator, _normalize_guardian_state(state), _pairling_connect_health()
-    )
+    connect = _pairling_connect_health()
+    coordinator = _coordinator_from_pairling_connect(connect)
+    if connect.get("summary") is not None:
+        coordinator = dict(coordinator)
+        coordinator["pairling_connect"] = connect["summary"]
     return {
         "ok": coordinator.get("posture") in ("ready", "warning"),
         "schema_version": 1,
@@ -2611,7 +2669,7 @@ def _health_diff_digest(payload: dict) -> str:
 def _orchestration_preflight_from_health(health: dict) -> tuple[dict, dict]:
     power_state = health.get("power_state") if isinstance(health.get("power_state"), dict) else None
     if power_state is None:
-        power_state = (_read_guardian_state()[0] or {})
+        power_state = {}
     coordinator = health.get("coordinator") or {}
     route = (health.get("routes") or [{}])[0]
     runtime_info = health.get("runtime") if isinstance(health.get("runtime"), dict) else {}
@@ -7397,6 +7455,7 @@ class Handler(BaseHTTPRequestHandler):
             self.send_error(405, "POST required")
             return
 
+        proof_verified = False
         if (
             self.pairling_auth is not None
             and _requires_request_proof(u.path, self.command)
@@ -7432,9 +7491,15 @@ class Handler(BaseHTTPRequestHandler):
                     },
                 }, status=proof_result.status)
                 return
+            proof_verified = True
 
         if self.pairling_auth is not None:
-            _maybe_persist_tailnet_node_id(self.headers, self.client_address, self.pairling_auth)
+            _maybe_persist_tailnet_node_id(
+                self.headers,
+                self.client_address,
+                self.pairling_auth,
+                proof_verified=proof_verified,
+            )
 
         if self.pairling_auth is not None and _is_high_risk_endpoint(u.path) and DEVICE_REGISTRY is not None:
             max_per_min = _rate_limit_for_high_risk_endpoint(u.path)
@@ -7490,6 +7555,8 @@ class Handler(BaseHTTPRequestHandler):
                 self._handle_pair_revoke(q)
             elif u.path == "/pair/rotate-token":
                 self._handle_pair_rotate_token(q)
+            elif u.path == "/pair/bind-node":
+                self._handle_pair_bind_node(q)
             elif u.path == "/healthz":
                 self._handle_healthz(q)
             elif u.path == "/power-state":
@@ -8430,6 +8497,28 @@ class Handler(BaseHTTPRequestHandler):
             return
         self._send_json({"ok": True, "device_id": device_id, "token": token})
 
+    def _handle_pair_bind_node(self, q):
+        # Minimal proof-required POST whose sole purpose is to trip the
+        # interactive provenance bind. The bind itself already ran in
+        # _maybe_persist_tailnet_node_id BEFORE routing (it fires only when this
+        # request was bearer-authed AND passed request-proof, which a POST to a
+        # PROOF_REQUIRED_ENDPOINTS path is). Here we only report whether the
+        # device now carries a tailnet_node_id. NO other side effects.
+        if self.pairling_auth is None:
+            self._send_json({
+                "ok": False,
+                "error": {
+                    "code": "missing_token",
+                    "message": "Authorization: Bearer token required",
+                },
+            }, status=401)
+            return
+        bound = bool(
+            DEVICE_REGISTRY
+            and DEVICE_REGISTRY.tailnet_node_id(self.pairling_auth.device_id)
+        )
+        self._send_json({"ok": True, "tailnet_node_id_bound": bound})
+
     def _handle_power_state(self, q):
         self._send_json(_cached_health_payload(
             full_power=True,

package/payload/mac/connectd/cmd/pairling-connectd/main.go

@@ -484,35 +484,59 @@ type tailscalePeerNodeResolver struct {
 	localClient func() (whoIsClient, error)
 }
 
-func (r tailscalePeerNodeResolver) PeerNodeID(ctx context.Context, remoteAddr string) (string, bool) {
+func (r tailscalePeerNodeResolver) PeerNodeID(ctx context.Context, remoteAddr string) (string, string, bool) {
 	if r.localClient == nil {
-		return "", false
+		return "", "", false
 	}
 	lc, err := r.localClient()
 	if err != nil || lc == nil {
-		return "", false
+		return "", "", false
 	}
 	who, err := lc.WhoIs(ctx, remoteAddr)
 	if err != nil {
-		return "", false
+		return "", "", false
 	}
 	return peerNodeIDFromWhoIs(who)
 }
 
-func peerNodeIDFromWhoIs(who *apitype.WhoIsResponse) (string, bool) {
+// peerNodeIDFromWhoIs resolves a peer's tailnet node ID and its provenance from
+// a WhoIs response. The node ID is always the WhoIs StableID; it is never
+// derived from any client-controlled value. Two provenance paths are admitted:
+//
+//   - "tagged": the old minted path, where the node carries tag:pairling-phone.
+//   - "interactive": an untagged, user-owned Pairling iOS node from the D2
+//     sign-in path, identified by a WhoIs hostname with the pairling-ios- prefix.
+//
+// connectd's hostname gate here is defense-in-depth; pairlingd performs the real
+// bearer + request-proof gate. As a guard against a non-iOS node spoofing the
+// pairling-ios- hostname, an untagged node is rejected when its Hostinfo reports
+// a non-empty OS that is not iOS.
+func peerNodeIDFromWhoIs(who *apitype.WhoIsResponse) (string, string, bool) {
 	if who == nil || who.Node == nil {
-		return "", false
+		return "", "", false
 	}
 	nodeID := strings.TrimSpace(string(who.Node.StableID))
 	if nodeID == "" {
-		return "", false
+		return "", "", false
 	}
 	for _, tag := range who.Node.Tags {
 		if tag == "tag:pairling-phone" {
-			return nodeID, true
+			return nodeID, "tagged", true
 		}
 	}
-	return "", false
+	hostname := who.Node.ComputedName
+	if hostname == "" && who.Node.Hostinfo.Valid() {
+		hostname = who.Node.Hostinfo.Hostname()
+	}
+	if strings.HasPrefix(strings.ToLower(hostname), "pairling-ios-") {
+		if who.Node.Hostinfo.Valid() {
+			if os := who.Node.Hostinfo.OS(); os != "" && !strings.EqualFold(os, "iOS") {
+				return "", "", false
+			}
+		}
+		return nodeID, "interactive", true
+	}
+	return "", "", false
 }
 
 func nodeIdentityFromStatus(st *ipnstate.Status) NodeIdentity {

package/payload/mac/connectd/cmd/pairling-connectd/peer_identity_test.go

@@ -34,7 +34,7 @@ func TestPeerNodeResolverUsesWhoIsRemoteAddr(t *testing.T) {
 		},
 	}
 
-	nodeID, ok := resolver.PeerNodeID(context.Background(), "100.64.0.50:12345")
+	nodeID, provenance, ok := resolver.PeerNodeID(context.Background(), "100.64.0.50:12345")
 	if !ok {
 		t.Fatal("resolver should accept tagged peer")
 	}
@@ -44,10 +44,13 @@ func TestPeerNodeResolverUsesWhoIsRemoteAddr(t *testing.T) {
 	if nodeID != "nPeerCNTRL" {
 		t.Fatalf("node ID = %q", nodeID)
 	}
+	if provenance != "tagged" {
+		t.Fatalf("provenance = %q, want tagged", provenance)
+	}
 }
 
 func TestWhoIsResolvesPeerStableID(t *testing.T) {
-	nodeID, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
+	nodeID, provenance, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
 		Node: &tailcfg.Node{
 			StableID: tailcfg.StableNodeID("nPeerCNTRL"),
 			Tags:     []string{"tag:pairling-phone"},
@@ -60,6 +63,9 @@ func TestWhoIsResolvesPeerStableID(t *testing.T) {
 	if nodeID != "nPeerCNTRL" {
 		t.Fatalf("node ID = %q, want nPeerCNTRL", nodeID)
 	}
+	if provenance != "tagged" {
+		t.Fatalf("provenance = %q, want tagged", provenance)
+	}
 }
 
 func TestAssertsGrantedPhoneTagBeforePersist(t *testing.T) {
@@ -72,15 +78,149 @@ func TestAssertsGrantedPhoneTagBeforePersist(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			nodeID, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
+			nodeID, provenance, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
 				Node: &tailcfg.Node{
 					StableID: tailcfg.StableNodeID("nPeerCNTRL"),
 					Tags:     tc.tags,
 				},
 			})
-			if ok || nodeID != "" {
-				t.Fatalf("wrongly accepted node ID %q with tags %#v", nodeID, tc.tags)
+			if ok || nodeID != "" || provenance != "" {
+				t.Fatalf("wrongly accepted node ID %q provenance %q with tags %#v", nodeID, provenance, tc.tags)
+			}
+		})
+	}
+}
+
+// TestPeerNodeIDProvenanceFromWhoIs covers the interactive-sign-in provenance
+// path: an untagged, user-owned iOS node whose WhoIs hostname starts with
+// pairling-ios- is admitted as "interactive", while a tagged phone is admitted
+// as "tagged". Non-Pairling untagged nodes and OS-mismatched nodes are rejected.
+func TestPeerNodeIDProvenanceFromWhoIs(t *testing.T) {
+	cases := []struct {
+		name           string
+		node           *tailcfg.Node
+		wantNodeID     string
+		wantProvenance string
+		wantOK         bool
+	}{
+		{
+			name: "tagged phone",
+			node: &tailcfg.Node{
+				StableID: tailcfg.StableNodeID("nPeerCNTRL"),
+				Tags:     []string{"tag:pairling-phone"},
+			},
+			wantNodeID:     "nPeerCNTRL",
+			wantProvenance: "tagged",
+			wantOK:         true,
+		},
+		{
+			name: "untagged interactive ios computed name",
+			node: &tailcfg.Node{
+				StableID:     tailcfg.StableNodeID("nInteractiveIOS"),
+				ComputedName: "pairling-ios-b702bb49",
+			},
+			wantNodeID:     "nInteractiveIOS",
+			wantProvenance: "interactive",
+			wantOK:         true,
+		},
+		{
+			name: "untagged non-pairling laptop",
+			node: &tailcfg.Node{
+				StableID:     tailcfg.StableNodeID("nLaptop"),
+				ComputedName: "my-laptop",
+			},
+			wantNodeID:     "",
+			wantProvenance: "",
+			wantOK:         false,
+		},
+		{
+			name: "untagged pairling-ios prefix but macOS hostinfo rejected",
+			node: &tailcfg.Node{
+				StableID:     tailcfg.StableNodeID("nFakeIOS"),
+				ComputedName: "pairling-ios-x",
+				Hostinfo:     (&tailcfg.Hostinfo{OS: "macOS"}).View(),
+			},
+			wantNodeID:     "",
+			wantProvenance: "",
+			wantOK:         false,
+		},
+		{
+			name: "empty stable id",
+			node: &tailcfg.Node{
+				StableID: tailcfg.StableNodeID(""),
+				Tags:     []string{"tag:pairling-phone"},
+			},
+			wantNodeID:     "",
+			wantProvenance: "",
+			wantOK:         false,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			nodeID, provenance, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{Node: tc.node})
+			if ok != tc.wantOK {
+				t.Fatalf("ok = %t, want %t (nodeID=%q provenance=%q)", ok, tc.wantOK, nodeID, provenance)
+			}
+			if nodeID != tc.wantNodeID {
+				t.Fatalf("nodeID = %q, want %q", nodeID, tc.wantNodeID)
+			}
+			if provenance != tc.wantProvenance {
+				t.Fatalf("provenance = %q, want %q", provenance, tc.wantProvenance)
 			}
 		})
 	}
 }
+
+// TestPeerNodeIDInteractiveAcceptsIOSHostinfo confirms an untagged Pairling iOS
+// node with Hostinfo OS reported as "iOS" (case-insensitive) is still admitted
+// as interactive — the OS check only rejects a non-empty, non-iOS OS.
+func TestPeerNodeIDInteractiveAcceptsIOSHostinfo(t *testing.T) {
+	nodeID, provenance, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
+		Node: &tailcfg.Node{
+			StableID:     tailcfg.StableNodeID("nIOS"),
+			ComputedName: "pairling-ios-abc123",
+			Hostinfo:     (&tailcfg.Hostinfo{OS: "iOS"}).View(),
+		},
+	})
+	if !ok {
+		t.Fatal("untagged pairling iOS node with iOS Hostinfo should be admitted")
+	}
+	if nodeID != "nIOS" {
+		t.Fatalf("nodeID = %q, want nIOS", nodeID)
+	}
+	if provenance != "interactive" {
+		t.Fatalf("provenance = %q, want interactive", provenance)
+	}
+}
+
+// TestPeerNodeIDInteractiveFallsBackToHostinfoHostname confirms that when
+// ComputedName is empty, the WhoIs hostname is derived from a valid Hostinfo's
+// Hostname() and the pairling-ios- prefix is still honored.
+func TestPeerNodeIDInteractiveFallsBackToHostinfoHostname(t *testing.T) {
+	nodeID, provenance, ok := peerNodeIDFromWhoIs(&apitype.WhoIsResponse{
+		Node: &tailcfg.Node{
+			StableID: tailcfg.StableNodeID("nIOSHost"),
+			Hostinfo: (&tailcfg.Hostinfo{Hostname: "pairling-ios-fallback", OS: "iOS"}).View(),
+		},
+	})
+	if !ok {
+		t.Fatal("untagged pairling iOS node identified via Hostinfo hostname should be admitted")
+	}
+	if nodeID != "nIOSHost" {
+		t.Fatalf("nodeID = %q, want nIOSHost", nodeID)
+	}
+	if provenance != "interactive" {
+		t.Fatalf("provenance = %q, want interactive", provenance)
+	}
+}
+
+// TestPeerNodeIDRejectsNilNode confirms a nil WhoIs or nil Node yields the
+// empty-rejection tuple.
+func TestPeerNodeIDRejectsNilNode(t *testing.T) {
+	for _, who := range []*apitype.WhoIsResponse{nil, {Node: nil}} {
+		nodeID, provenance, ok := peerNodeIDFromWhoIs(who)
+		if ok || nodeID != "" || provenance != "" {
+			t.Fatalf("nil node wrongly accepted: nodeID=%q provenance=%q ok=%t", nodeID, provenance, ok)
+		}
+	}
+}

package/payload/mac/connectd/internal/gateway/proxy.go

@@ -21,6 +21,18 @@ const pairDropSmallFileMaxBodyBytes int64 = 10 * 1024 * 1024
 const pairDropUploadChunkMaxBodyBytes int64 = 1024 * 1024
 const peerNodeHeader = "X-Pairling-Peer-Node"
 
+// peerProvenanceHeader tells pairlingd how connectd identified the peer node:
+// "tagged" (the old minted tag:pairling-phone path) or "interactive" (an
+// untagged, user-owned Pairling iOS node admitted via the D2 sign-in path).
+// connectd deletes any inbound copy before re-injecting the resolver's value, so
+// a client can never forge it.
+const peerProvenanceHeader = "X-Pairling-Peer-Provenance"
+
+const (
+	provenanceTagged      = "tagged"
+	provenanceInteractive = "interactive"
+)
+
 // funnelOriginHeader marks a request that arrived over the public Funnel
 // listener. connectd sets it only on the funnel handler and deletes any inbound
 // copy first; every other handler deletes it, so a client can never forge it.
@@ -50,7 +62,7 @@ type Logger interface {
 }
 
 type PeerNodeResolver interface {
-	PeerNodeID(ctx context.Context, remoteAddr string) (string, bool)
+	PeerNodeID(ctx context.Context, remoteAddr string) (nodeID string, provenance string, ok bool)
 }
 
 type Event struct {
@@ -222,14 +234,16 @@ func (h *Handler) rewrite(r *httputil.ProxyRequest) {
 	r.Out.Host = h.upstream.Host
 	r.Out.Header.Del("X-Forwarded-For")
 	r.Out.Header.Del(peerNodeHeader)
+	r.Out.Header.Del(peerProvenanceHeader)
 	r.Out.Header.Del(funnelOriginHeader)
 	if h.mode == ExposureModeFunnelBootstrap {
 		r.Out.Header.Set(funnelOriginHeader, "1")
 	}
 	if h.peerNodeResolver != nil {
-		if nodeID, ok := h.peerNodeResolver.PeerNodeID(in.Context(), in.RemoteAddr); ok {
+		if nodeID, provenance, ok := h.peerNodeResolver.PeerNodeID(in.Context(), in.RemoteAddr); ok {
 			if nodeID = strings.TrimSpace(nodeID); nodeID != "" {
 				r.Out.Header.Set(peerNodeHeader, nodeID)
+				r.Out.Header.Set(peerProvenanceHeader, provenance)
 			}
 		}
 	}

package/payload/mac/connectd/internal/gateway/proxy_test.go

@@ -21,9 +21,9 @@ type recordingLogger struct {
 	events []Event
 }
 
-type peerNodeResolverFunc func(context.Context, string) (string, bool)
+type peerNodeResolverFunc func(context.Context, string) (string, string, bool)
 
-func (f peerNodeResolverFunc) PeerNodeID(ctx context.Context, remoteAddr string) (string, bool) {
+func (f peerNodeResolverFunc) PeerNodeID(ctx context.Context, remoteAddr string) (string, string, bool) {
 	return f(ctx, remoteAddr)
 }
 
@@ -451,9 +451,11 @@ func TestPairlingConnectStripsForgedPeerNodeHeader(t *testing.T) {
 
 func TestPairlingConnectSetsPeerNodeHeaderFromResolver(t *testing.T) {
 	var forwardedHeader string
+	var forwardedProvenance string
 	var resolvedRemote string
 	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		forwardedHeader = r.Header.Get("X-Pairling-Peer-Node")
+		forwardedProvenance = r.Header.Get("X-Pairling-Peer-Provenance")
 		w.WriteHeader(http.StatusOK)
 	}))
 	defer upstream.Close()
@@ -465,9 +467,9 @@ func TestPairlingConnectSetsPeerNodeHeaderFromResolver(t *testing.T) {
 		Upstream:     upstreamURL,
 		MaxBodyBytes: 1024,
 		Mode:         ExposureModePairlingConnect,
-		PeerNodeResolver: peerNodeResolverFunc(func(_ context.Context, remoteAddr string) (string, bool) {
+		PeerNodeResolver: peerNodeResolverFunc(func(_ context.Context, remoteAddr string) (string, string, bool) {
 			resolvedRemote = remoteAddr
-			return "nPeerCNTRL", true
+			return "nPeerCNTRL", "tagged", true
 		}),
 	})
 	if err != nil {
@@ -489,6 +491,103 @@ func TestPairlingConnectSetsPeerNodeHeaderFromResolver(t *testing.T) {
 	if forwardedHeader != "nPeerCNTRL" {
 		t.Fatalf("peer-node header = %q, want trusted resolver value", forwardedHeader)
 	}
+	if forwardedProvenance != "tagged" {
+		t.Fatalf("peer-provenance header = %q, want tagged", forwardedProvenance)
+	}
+}
+
+// TestRewriteStripsForgedProvenanceAndReinjectsFromResolver proves the rewrite
+// step deletes BOTH client-supplied X-Pairling-Peer-Node and
+// X-Pairling-Peer-Provenance headers, then re-injects them from the resolver's
+// trusted return values. A forged "tagged" provenance from the client must not
+// survive when the resolver reports "interactive".
+func TestRewriteStripsForgedProvenanceAndReinjectsFromResolver(t *testing.T) {
+	var forwardedHeader string
+	var forwardedProvenance string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		forwardedHeader = r.Header.Get("X-Pairling-Peer-Node")
+		forwardedProvenance = r.Header.Get("X-Pairling-Peer-Provenance")
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+	upstreamURL, err := url.Parse(upstream.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	handler, err := NewHandler(Options{
+		Upstream:     upstreamURL,
+		MaxBodyBytes: 1024,
+		Mode:         ExposureModePairlingConnect,
+		PeerNodeResolver: peerNodeResolverFunc(func(_ context.Context, _ string) (string, string, bool) {
+			return "nResolverIOS", "interactive", true
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "http://pairling-connect.local/send-text", strings.NewReader(`{}`))
+	req.RemoteAddr = "100.64.0.50:12345"
+	req.Header.Set("Authorization", "Bearer device-token")
+	req.Header.Set("X-Pairling-Peer-Node", "forged-node")
+	req.Header.Set("X-Pairling-Peer-Provenance", "tagged")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	if forwardedHeader != "nResolverIOS" {
+		t.Fatalf("peer-node header = %q, want resolver value nResolverIOS", forwardedHeader)
+	}
+	if forwardedProvenance != "interactive" {
+		t.Fatalf("peer-provenance header = %q, want resolver value interactive", forwardedProvenance)
+	}
+}
+
+// TestRewriteInjectsNoHeadersWhenResolverRejects proves that when the resolver
+// returns ok=false, NEITHER the peer-node NOR the peer-provenance header reaches
+// the upstream, and any client-supplied copies are stripped.
+func TestRewriteInjectsNoHeadersWhenResolverRejects(t *testing.T) {
+	var sawNode bool
+	var sawProvenance bool
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, sawNode = r.Header["X-Pairling-Peer-Node"]
+		_, sawProvenance = r.Header["X-Pairling-Peer-Provenance"]
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer upstream.Close()
+	upstreamURL, err := url.Parse(upstream.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	handler, err := NewHandler(Options{
+		Upstream:     upstreamURL,
+		MaxBodyBytes: 1024,
+		Mode:         ExposureModePairlingConnect,
+		PeerNodeResolver: peerNodeResolverFunc(func(_ context.Context, _ string) (string, string, bool) {
+			return "", "", false
+		}),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "http://pairling-connect.local/send-text", strings.NewReader(`{}`))
+	req.RemoteAddr = "100.64.0.50:12345"
+	req.Header.Set("Authorization", "Bearer device-token")
+	req.Header.Set("X-Pairling-Peer-Node", "forged-node")
+	req.Header.Set("X-Pairling-Peer-Provenance", "interactive")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	if sawNode {
+		t.Fatal("peer-node header reached upstream when resolver rejected")
+	}
+	if sawProvenance {
+		t.Fatal("peer-provenance header reached upstream when resolver rejected")
+	}
 }
 
 func TestPairlingConnectModeMatchesEndpointContract(t *testing.T) {

package/payload-manifest.json

@@ -1,11 +1,11 @@
 {
   "connectd": {
     "darwin-arm64": {
-      "sha256": "d4d9439eae6cfa244b491b5086050f932fe78058e5ac18a876b80b20ea8517ad",
+      "sha256": "9b2ed8873ae42e33426590c19b6bbae9ab6e42c9a103f2978a9f4b3486f95986",
       "team_id": "965AVD34A3"
     },
     "darwin-x64": {
-      "sha256": "936c7046bfc3cd84289881444da57ad025d5c734c44a01c2dcbd9eb2afc7cbb8",
+      "sha256": "affe30386b854c5449b6a985ac678203945d756c3a4c418f62fea62d41b310db",
       "team_id": "965AVD34A3"
     }
   },
@@ -20,11 +20,11 @@
     },
     {
       "path": "payload/mac/SOURCE_REVISION",
-      "sha256": "354ac93fcb550a4bf353e3857282bafb747f158ce1ad6e7068a5d85c5cd071bd"
+      "sha256": "6d11e38b8ce99a27fd026588dec66a7bed33016085d28076bacd7c597e6611e9"
     },
     {
       "path": "payload/mac/VERSION",
-      "sha256": "283571d2642fc7b3befd294f45d53b896a1d54d34c86235b13151192b380606a"
+      "sha256": "011cfdb24c667a75861adfffaabe68e66358d982f437b47270ef09d86c6c6cd7"
     },
     {
       "path": "payload/mac/companiond/app_attest_lan.py",
@@ -96,7 +96,7 @@
     },
     {
       "path": "payload/mac/companiond/pairlingd.py",
-      "sha256": "e69188ec651d0a04af5cad73c9dd0a81dfa6455b6e32f8b733c412d11a4ead9e"
+      "sha256": "297d1558ecd6bb4cdbadfe073e396564af723173e0cb7b4085ecc852fd889def"
     },
     {
       "path": "payload/mac/companiond/providers/__init__.py",
@@ -200,11 +200,11 @@
     },
     {
       "path": "payload/mac/connectd/cmd/pairling-connectd/main.go",
-      "sha256": "4582664c189db3c13fef81328172d69fa0bcd6b064396c0a811a154da98f7f21"
+      "sha256": "019288bd16c6e900c60206ee4739f9ae5ed640ea73cd57db6a1f0d618c9bf00c"
     },
     {
       "path": "payload/mac/connectd/cmd/pairling-connectd/peer_identity_test.go",
-      "sha256": "044c1260387b990de073d4f09fa516c3ce15ded7c255b5e1ac3d57f3f5810c27"
+      "sha256": "eb1f44e588c2d70e2660f805ee6b7fe09aa793365c0ae442164785a8241c35d8"
     },
     {
       "path": "payload/mac/connectd/cmd/pairling-connectd/upstream_health_test.go",
@@ -232,11 +232,11 @@
     },
     {
       "path": "payload/mac/connectd/internal/gateway/proxy.go",
-      "sha256": "ad7de08a59819fcbdd81f62d707738af128064cc24cea576674aee2f0960c267"
+      "sha256": "b852408a35b71a0b62554cc93f413c3352034432f14529ab3ddbe85fa5ee49c8"
     },
     {
       "path": "payload/mac/connectd/internal/gateway/proxy_test.go",
-      "sha256": "b02cd354dcd3292079f35ee86a1ce75e3ed8286550f064fdae7914e661464910"
+      "sha256": "f3a6b1974c1ccba8e5e380d18c31a5aca61458b6d4a1075865b8978e86e54209"
     },
     {
       "path": "payload/mac/connectd/internal/runtime/config.go",
@@ -296,8 +296,8 @@
     }
   ],
   "package": "pairling",
-  "package_version": "0.2.8",
+  "package_version": "0.2.10",
   "schema_version": 1,
   "source_dirty": false,
-  "source_revision": "c07a6fd"
+  "source_revision": "0d3be68"
 }