yakmesh 2.8.2 → 3.0.0

package/mesh/annex.js

@@ -27,10 +27,32 @@
 
 import { randomBytes, createCipheriv, createDecipheriv, createHash } from 'crypto';
 import { ml_kem768 } from '@noble/post-quantum/ml-kem.js';
-import { sha3_256 } from '@noble/hashes/sha3.js';
+import { sha3_256 as _nobleSha3 } from '@noble/hashes/sha3.js';
 import { bytesToHex, hexToBytes, utf8ToBytes } from '@noble/hashes/utils.js';
 import { createLogger } from '../utils/logger.js';
 
+// ACCEL: Hardware-accelerated crypto (native SHA3, native KEM via liboqs/AVX-512)
+import { sha3_256, mlKem768Keygen, mlKem768Encapsulate, mlKem768Decapsulate } from '../utils/accel.js';
+
+// STEADYWATCH: Quantum-hardware-validated entropy seeds (Hurwitz quaternion, IBM Quantum)
+import { getHybridSeed, seedStore as steadywatchStore } from '../security/steadywatch.js';
+
+// ═══ TRIBHUJ — Balanced ternary for channel lifecycle ═══
+// POSITIVE: ESTABLISHED (secure channel active)
+// NEUTRAL:  NEGOTIATING (key exchange in progress)
+// NEGATIVE: CLOSED (session terminated or expired)
+import { POSITIVE, NEUTRAL, NEGATIVE } from '../oracle/tribhuj.js';
+
+/** ANNEX channel lifecycle states (TRIBHUJ trits) */
+export const ChannelState = Object.freeze({
+  CLOSED: NEGATIVE,       // -1: Session terminated or expired
+  NEGOTIATING: NEUTRAL,   //  0: Key exchange in progress
+  ESTABLISHED: POSITIVE,  // +1: Secure channel active
+});
+
+/** Extract unique peer suffix from nodeId (e.g. 'node-net-name-pq-kEEU' → 'kEEU') */
+const peerTag = (id) => id?.split('-pq-').pop() || id?.slice?.(-8) || String(id);
+
 const log = createLogger('mesh:annex');
 
 const ANNEX_CONFIG = {
@@ -144,36 +166,77 @@ class AnnexSession {
     this.kemKeyPair = null;      // Our ephemeral KEM key pair
     this.sharedSecret = null;    // Derived shared secret
     this.encryptionKey = null;   // Current symmetric key
+    this.pendingEncryptionKey = null; // Future key awaiting implicit ack (bootstrap→KEM upgrade only)
+    this.bootstrapped = false;   // JHILKE: true if using deterministic bootstrap key (not yet KEM-backed)
+    this.rekeyEpoch = 0;         // JHILKE: deterministic rekey epoch (incremented on each cricket-coordinated switch)
     this.sendSequence = 0;       // Outbound message counter
-    this.recvSequence = 0;       // Inbound message counter
+    this.recvSequence = -1;      // Inbound message counter (-1 so first msg seq 0 passes)
     this.messageCount = 0;       // Total messages with current key
     
     // State
     this.established = false;
+    this.channelState = ChannelState.NEGOTIATING;  // TRIBHUJ trit lifecycle
     this.createdAt = Date.now();
     this.lastActivity = Date.now();
     this.lastRekey = null;
   }
   
   /**
-   * Generate ephemeral KEM key pair for this session
+   * JHILKE deterministic rekey — both nodes derive the same key simultaneously.
+   * No KEM round-trip, no pending key, no race condition.
+   * Called by JhilkeCoordinator._executeSwitch() after cricket coordination.
+   */
+  deterministicRekey(newKey, epoch) {
+    this.encryptionKey = newKey;
+    this.rekeyEpoch = epoch;
+    this.messageCount = 0;
+    this.lastRekey = Date.now();
+    this.lastActivity = Date.now();
+  }
+  
+  /**
+   * Generate ephemeral KEM key pair for this session.
+   * 
+   * ACCEL: Routes through mlKem768Keygen() for native liboqs AVX-512 NTT
+   * acceleration when available (previously called noble directly — bypassed ACCEL).
+   * 
+   * STEADYWATCH: If quantum satellite seeds are loaded, uses hybrid entropy:
+   *   hybridSeed = SHA3(satelliteSeed || EXPAND) ⊕ randomBytes(64)
+   * Two-source extractor: even if one source is compromised, keys are safe.
    */
-  generateKeyPair() {
-    const seed = randomBytes(64);
-    this.kemKeyPair = ml_kem768.keygen(seed);
+  async generateKeyPair() {
+    // STEADYWATCH hybrid seed (quantum + CSPRNG) or pure CSPRNG fallback
+    const seed = steadywatchStore.initialized
+      ? getHybridSeed()
+      : randomBytes(64);
+
+    // Route through ACCEL for native liboqs/AVX-512 acceleration
+    this.kemKeyPair = await mlKem768Keygen(seed);
     return bytesToHex(this.kemKeyPair.publicKey);
   }
   
   /**
    * Complete key exchange as initiator (encapsulate with peer's public key)
    */
-  encapsulate(peerPublicKey) {
+  encapsulate(peerPublicKey, { defer = false } = {}) {
     const publicKeyBytes = hexToBytes(peerPublicKey);
-    const result = ml_kem768.encapsulate(publicKeyBytes);
+    const result = mlKem768Encapsulate(publicKeyBytes);
     
     this.sharedSecret = result.sharedSecret;
-    this.encryptionKey = this._deriveEncryptionKey();
+    const newKey = this._deriveEncryptionKey();
+    
+    if (defer && this.encryptionKey) {
+      // Rekey responder: store new key as pending, keep current active.
+      // PFS-safe: we only hold the FUTURE key, never the past key.
+      // Activation happens implicitly when we receive a message encrypted
+      // with the new key (see decrypt()).
+      this.pendingEncryptionKey = newKey;
+    } else {
+      // Initial handshake or initiator: switch immediately
+      this.encryptionKey = newKey;
+    }
     this.established = true;
+    this.channelState = ChannelState.ESTABLISHED;
     this.lastRekey = Date.now();
     
     return bytesToHex(result.cipherText);
@@ -188,9 +251,34 @@ class AnnexSession {
     }
     
     const ciphertextBytes = hexToBytes(ciphertext);
-    this.sharedSecret = ml_kem768.decapsulate(ciphertextBytes, this.kemKeyPair.secretKey);
+    this.sharedSecret = mlKem768Decapsulate(ciphertextBytes, this.kemKeyPair.secretKey);
+
+    // Zero ephemeral KEM secret key — shared secret is extracted, secret key is
+    // no longer needed. Minimizes exposure window if memory is later compromised.
+    if (this.kemKeyPair.secretKey instanceof Uint8Array) {
+      this.kemKeyPair.secretKey.fill(0);
+    }
+    this.kemKeyPair = null; // Release reference entirely
+
+    // Bootstrap→KEM upgrade bridge: briefly retain old key for in-flight messages.
+    // The responder still encrypts with bootstrap key until implicit ack arrives.
+    // Without this bridge, those in-flight messages cause AEAD auth failures.
+    // Auto-expires after 5s — NOT a permanent "previous key" (PFS preserved).
+    if (this.encryptionKey) {
+      this._transitionKey = this.encryptionKey;
+      this._transitionKeyTimer = setTimeout(() => {
+        this._transitionKey = null;
+        this._transitionKeyTimer = null;
+      }, 5000);
+    }
+
+    // Initiator receiving KEY_RESPONSE: switch immediately to KEM key.
+    // The initiator is always "first mover" — its next message triggers
+    // the responder to promote pendingEncryptionKey.
     this.encryptionKey = this._deriveEncryptionKey();
+    this.pendingEncryptionKey = null; // Clear any pending state
     this.established = true;
+    this.channelState = ChannelState.ESTABLISHED;
     this.lastRekey = Date.now();
     
     return true;
@@ -237,28 +325,21 @@ class AnnexSession {
   /**
    * Decrypt a message for this session
    */
-  decrypt(encryptedData, expectedSequence) {
-    if (!this.established || !this.encryptionKey) {
-      throw new Error('Session not established');
-    }
-    
-    // Replay protection: sequence must be greater than last received
-    if (expectedSequence <= this.recvSequence && this.recvSequence > 0) {
-      throw new Error(`Replay detected: sequence ${expectedSequence} <= ${this.recvSequence}`);
-    }
-    
+  /**
+   * Decrypt with a specific key (internal helper)
+   */
+  _decryptWithKey(key, encryptedData, expectedSequence) {
     const nonce = Buffer.from(encryptedData.nonce, 'hex');
     const ciphertext = Buffer.from(encryptedData.ciphertext, 'hex');
     const authTag = Buffer.from(encryptedData.authTag, 'hex');
     
     const decipher = createDecipheriv(
       ANNEX_CONFIG.symmetricAlgorithm,
-      this.encryptionKey,
+      key,
       nonce,
       { authTagLength: ANNEX_CONFIG.authTagLength }
     );
     
-    // Verify AAD
     const aad = Buffer.from(`${this.sessionId}:${expectedSequence}`);
     decipher.setAAD(aad);
     decipher.setAuthTag(authTag);
@@ -268,12 +349,66 @@ class AnnexSession {
       decipher.final(),
     ]);
     
-    this.recvSequence = expectedSequence;
-    this.lastActivity = Date.now();
-    
     return decrypted.toString('utf8');
   }
   
+  decrypt(encryptedData, expectedSequence) {
+    if (!this.established || !this.encryptionKey) {
+      throw new Error('Session not established');
+    }
+    
+    // Replay protection: sequence must be greater than last received
+    if (typeof expectedSequence !== 'number' || expectedSequence <= this.recvSequence) {
+      throw new Error(`Replay detected: sequence ${expectedSequence} <= ${this.recvSequence}`);
+    }
+    
+    try {
+      // Try current key first
+      const result = this._decryptWithKey(this.encryptionKey, encryptedData, expectedSequence);
+      this.recvSequence = expectedSequence;
+      this.lastActivity = Date.now();
+      return result;
+    } catch (err) {
+      // During rekey transition, the initiator has switched to the new key
+      // but the responder is still on the old key. Try the PENDING (future)
+      // key — if it works, promote it to current. This is the implicit ack.
+      //
+      // Security note: we only ever store the FUTURE key as fallback, never
+      // the PAST key. An attacker who dumps memory gets a key they'd have
+      // gotten anyway once activated. PFS of past messages is never at risk.
+      if (this.pendingEncryptionKey) {
+        try {
+          const result = this._decryptWithKey(this.pendingEncryptionKey, encryptedData, expectedSequence);
+          // Implicit ack: promote pending → current, zero old key
+          this.encryptionKey = this.pendingEncryptionKey;
+          this.pendingEncryptionKey = null;
+          this.recvSequence = expectedSequence;
+          this.lastActivity = Date.now();
+          log.info('Rekey activated via implicit ack', { sessionId: this.sessionId?.slice(0, 16) });
+          return result;
+        } catch {
+          // pending key also failed — fall through to transition key
+        }
+      }
+      
+      // Bootstrap→KEM upgrade bridge: the responder may still send messages
+      // encrypted with the bootstrap key between our KEM switch and their
+      // implicit-ack promotion. Try the briefly-retained old key.
+      // NO promotion — this key is being phased out (auto-expires via timer).
+      if (this._transitionKey) {
+        const result = this._decryptWithKey(this._transitionKey, encryptedData, expectedSequence);
+        this.recvSequence = expectedSequence;
+        this.lastActivity = Date.now();
+        log.info('Bootstrap→KEM transition: decoded in-flight message with old key', {
+          sessionId: this.sessionId?.slice(0, 16),
+        });
+        return result;
+      }
+      
+      throw err;
+    }
+  }
+  
   /**
    * Check if session needs re-keying for perfect forward secrecy
    */
@@ -298,12 +433,15 @@ class AnnexSession {
    * Derive symmetric encryption key from shared secret
    */
   _deriveEncryptionKey() {
+    // Sort nodeIds so both sides derive the same key
+    // (localNodeId and remoteNodeId are swapped between initiator/responder)
+    const [first, second] = [this.localNodeId, this.remoteNodeId].sort();
     return createHash('sha3-256')
       .update(this.sharedSecret)
       .update(ANNEX_CONFIG.keyDerivationSalt)
       .update(this.sessionId)
-      .update(this.localNodeId)
-      .update(this.remoteNodeId)
+      .update(first)
+      .update(second)
       .digest();
   }
 }
@@ -322,6 +460,9 @@ export class Annex {
     this.pendingHandshakes = new Map();
     this.messageHandlers = new Map();
     
+    // JHILKE coordinator reference (set by network.js after initialization)
+    this.jhilke = null;
+    
     // Stats
     this.stats = {
       sessionsCreated: 0,
@@ -331,31 +472,90 @@ export class Annex {
       replaysBlocked: 0,
     };
     
+    // Deferred message queue — buffer ANNEX messages from peers whose
+    // public key hasn't arrived yet (HELLO/WELCOME still in flight).
+    // Max 10 senders, 1 message per sender, 3s timeout.
+    this._deferredMessages = new Map();  // senderId -> { envelope, origin, timer }
+    this._maxDeferredSenders = 10;
+    this._deferTimeoutMs = 3000;
+    
     // Register mesh handler for ANNEX messages
     if (this.mesh) {
       this._registerMeshHandlers();
     }
   }
   
+  /**
+   * Create a bootstrap session with a deterministic key.
+   * JHILKE derives this key from the shared code hash + both node IDs.
+   * Both sides compute the same key independently.
+   *
+   * The bootstrap session enables encrypted communication from message #1,
+   * eliminating plaintext KEM exchange. It is immediately upgraded to a
+   * proper KEM-backed session with full PFS.
+   */
+  bootstrapSession(peerId, bootstrapKey) {
+    // Deterministic sessionId — both sides MUST agree on AES-GCM AAD.
+    // AAD = "${sessionId}:${sequence}", so random sessionId = instant auth failure.
+    const localNodeId = this.identity.identity.nodeId;
+    const [first, second] = [localNodeId, peerId].sort();
+    const deterministicSessionId = createHash('sha3-256')
+      .update(`yakmesh-annex-bootstrap-session:${first}:${second}`)
+      .digest('hex')
+      .slice(0, 32); // same length as bytesToHex(randomBytes(16))
+
+    const session = new AnnexSession({
+      sessionId: deterministicSessionId,
+      localNodeId,
+      remoteNodeId: peerId,
+    });
+    session.encryptionKey = bootstrapKey;
+    session.established = true;
+    session.bootstrapped = true;
+    session.channelState = ChannelState.ESTABLISHED;
+    session.lastRekey = Date.now();
+    
+    this.sessions.set(peerId, session);
+    log.info('JHILKE bootstrap session created (encrypted from message #1)', {
+      peerId: peerTag(peerId),
+      sessionId: deterministicSessionId.slice(0, 8) + '...',
+    });
+    return session;
+  }
+  
   /**
    * Initialize or get secure session with a peer (annex territory)
+   * 
+   * JHILKE integration: If a bootstrap session exists, this method
+   * upgrades it to a KEM-backed session by performing the key exchange
+   * THROUGH the bootstrap-encrypted channel (no plaintext KEM).
    */
   async openChannel(remoteNodeId) {
     // Check for existing session
     let session = this.sessions.get(remoteNodeId);
-    if (session && session.established && !session.isExpired()) {
+    
+    // Return existing FULL (non-bootstrap) session
+    if (session && session.established && !session.isExpired() && !session.bootstrapped) {
       return session;
     }
     
-    // Create new session
-    session = new AnnexSession({
-      localNodeId: this.identity.identity.nodeId,
-      remoteNodeId,
-      initiator: true,
-    });
+    // Bootstrap upgrade: reuse existing session, add KEM negotiation
+    const isBootstrapUpgrade = session?.bootstrapped;
+    
+    if (isBootstrapUpgrade) {
+      session.initiator = true;
+      log.info('JHILKE: upgrading bootstrap → KEM', { peer: peerTag(remoteNodeId) });
+    } else {
+      // Create new session
+      session = new AnnexSession({
+        localNodeId: this.identity.identity.nodeId,
+        remoteNodeId,
+        initiator: true,
+      });
+    }
     
-    // Generate our key pair
-    const ourPublicKey = session.generateKeyPair();
+    // Generate our key pair (ACCEL: native liboqs/AVX-512, STEADYWATCH: quantum seed)
+    const ourPublicKey = await session.generateKeyPair();
     
     // Store pending handshake
     this.pendingHandshakes.set(remoteNodeId, session);
@@ -372,8 +572,8 @@ export class Annex {
     // Sign the envelope
     envelope.signature = this.identity.sign(envelope.getSigningPayload());
     
-    // Send via mesh
-    await this._sendToMesh(remoteNodeId, envelope);
+    // JHILKE: Send via secure channel if bootstrap exists, else raw
+    await this._sendControlSecure(remoteNodeId, envelope);
     
     // Wait for response (with timeout)
     return new Promise((resolve, reject) => {
@@ -406,9 +606,14 @@ export class Annex {
       session = await this.openChannel(remoteNodeId);
     }
     
-    // Check for re-key need
-    if (session.needsRekey()) {
-      await this._rekey(session);
+    // Check for re-key need — JHILKE handles all rekeys deterministically.
+    // Both sides derive the same key after cricket coordination (no KEM round-trip).
+    if (!options._skipRekeyCheck && session.needsRekey()) {
+      if (this.jhilke) {
+        this.jhilke.initiateRekey(remoteNodeId);
+      }
+      // No fallback — JHILKE is the only rekey path. If unavailable,
+      // the session continues until timeout/reconnect.
     }
     
     // Encrypt the payload
@@ -469,7 +674,18 @@ export class Annex {
     envelope.signature = this.identity.sign(envelope.getSigningPayload());
     
     await this._sendToMesh(remoteNodeId, envelope);
+    session.channelState = ChannelState.CLOSED;
     this.sessions.delete(remoteNodeId);
+    
+    // Clean up any deferred messages from this peer
+    const deferred = this._deferredMessages?.get(remoteNodeId);
+    if (deferred) {
+      clearTimeout(deferred.timer);
+      if (deferred.onRegistered) {
+        this.mesh.off('peer-registered', deferred.onRegistered);
+      }
+      this._deferredMessages.delete(remoteNodeId);
+    }
   }
   
   /**
@@ -482,6 +698,7 @@ export class Annex {
     return {
       sessionId: session.sessionId,
       established: session.established,
+      channelState: session.channelState,  // TRIBHUJ trit: ESTABLISHED/NEGOTIATING/CLOSED
       createdAt: session.createdAt,
       lastActivity: session.lastActivity,
       messageCount: session.messageCount,
@@ -500,6 +717,7 @@ export class Annex {
         nodeId,
         sessionId: session.sessionId,
         established: session.established,
+        channelState: session.channelState,  // TRIBHUJ trit
         createdAt: session.createdAt,
         lastActivity: session.lastActivity,
         messageCount: session.messageCount,
@@ -531,12 +749,21 @@ export class Annex {
   
   async _handleAnnexMessage(envelope, origin) {
     try {
-      // Verify signature
-      const sigPayload = AnnexEnvelope.fromJSON(envelope).getSigningPayload();
+      // Verify ML-DSA-65 signature — MANDATORY for all ANNEX messages.
+      // "Changes pass through math alone" — no key, no entry.
       const peerPublicKey = this._getPeerPublicKey(envelope.senderId);
       
-      if (peerPublicKey && !this.identity.verify(sigPayload, envelope.signature, peerPublicKey)) {
-        log.warn('Invalid signature from peer', { peerId: envelope.senderId?.slice(0, 16) });
+      if (!peerPublicKey) {
+        // Peer's public key isn't registered yet — their HELLO/WELCOME
+        // may still be in flight. Defer the message and replay it once
+        // the mesh emits 'peer-registered' for this sender.
+        this._deferMessage(envelope, origin);
+        return;
+      }
+      
+      const sigPayload = AnnexEnvelope.fromJSON(envelope).getSigningPayload();
+      if (!this.identity.verify(sigPayload, envelope.signature, peerPublicKey)) {
+        log.warn('Invalid ML-DSA-65 signature from peer', { peerId: peerTag(envelope.senderId) });
         return;
       }
       
@@ -553,14 +780,13 @@ export class Annex {
           await this._handleEncrypted(envelope);
           break;
           
-        case ANNEX_CONFIG.messageTypes.REKEY:
-          await this._handleRekey(envelope);
-          break;
-          
-        case ANNEX_CONFIG.messageTypes.CLOSE:
+        case ANNEX_CONFIG.messageTypes.CLOSE: {
+          const closedSession = this.sessions.get(envelope.senderId);
+          if (closedSession) closedSession.channelState = ChannelState.CLOSED;
           this.sessions.delete(envelope.senderId);
-          log.info('Channel closed by peer', { peerId: envelope.senderId?.slice(0, 16) });
+          log.info('Channel closed by peer', { peerId: peerTag(envelope.senderId) });
           break;
+        }
       }
     } catch (err) {
       log.error('Error handling ANNEX message', { error: err.message });
@@ -568,23 +794,40 @@ export class Annex {
   }
   
   async _handleKeyExchange(envelope) {
-    log.info('Key exchange from peer', { peerId: envelope.senderId?.slice(0, 16) });
+    log.info('Key exchange from peer', { peerId: peerTag(envelope.senderId) });
     
-    // Create responding session
-    const session = new AnnexSession({
-      sessionId: envelope.sessionId,
-      localNodeId: this.identity.identity.nodeId,
-      remoteNodeId: envelope.senderId,
-      initiator: false,
-    });
+    // JHILKE: Check for existing bootstrap session to upgrade
+    let session = this.sessions.get(envelope.senderId);
+    const isBootstrapUpgrade = session?.bootstrapped;
+    
+    if (isBootstrapUpgrade) {
+      // Upgrade existing bootstrap session — keep bootstrap key as current
+      session.sessionId = envelope.sessionId;
+      session.initiator = false;
+      log.info('JHILKE: upgrading bootstrap → KEM (responder)', { peerId: peerTag(envelope.senderId) });
+    } else {
+      // Create responding session
+      session = new AnnexSession({
+        sessionId: envelope.sessionId,
+        localNodeId: this.identity.identity.nodeId,
+        remoteNodeId: envelope.senderId,
+        initiator: false,
+      });
+    }
     
     // Generate our key pair and encapsulate with peer's public key
-    session.generateKeyPair();
-    const kemCiphertext = session.encapsulate(envelope.kemPublicKey);
+    // ACCEL: native liboqs/AVX-512, STEADYWATCH: quantum seed
+    await session.generateKeyPair();
+    
+    // CRITICAL: For bootstrap upgrades, DEFER the KEM key.
+    // Keep bootstrap key active for the KEY_RESPONSE message.
+    // The KEM key activates via implicit ack when we receive
+    // a message encrypted with it from the initiator.
+    const kemCiphertext = session.encapsulate(envelope.kemPublicKey, { defer: isBootstrapUpgrade });
     
     // Store session
     this.sessions.set(envelope.senderId, session);
-    this.stats.sessionsCreated++;
+    if (!isBootstrapUpgrade) this.stats.sessionsCreated++;
     
     // Send response with our public key and the KEM ciphertext
     const response = new AnnexEnvelope({
@@ -597,27 +840,34 @@ export class Annex {
     });
     
     response.signature = this.identity.sign(response.getSigningPayload());
-    await this._sendToMesh(envelope.senderId, response);
     
-    log.info('Channel established with peer', { peerId: envelope.senderId?.slice(0, 16) });
+    // JHILKE: Send via secure channel (encrypted through bootstrap or current key)
+    await this._sendControlSecure(envelope.senderId, response);
+    
+    log.info('Channel established with peer', { peerId: peerTag(envelope.senderId) });
   }
   
   async _handleKeyResponse(envelope) {
+    // KEY_RESPONSE is only used during initial handshake or bootstrap→KEM upgrade.
+    // All subsequent rekeys are deterministic via JHILKE (no KEM round-trip).
     const session = this.pendingHandshakes.get(envelope.senderId);
+    
     if (!session) {
-      log.warn('Unexpected key response', { peerId: envelope.senderId?.slice(0, 16) });
+      log.warn('Unexpected key response (no pending handshake)', { peerId: peerTag(envelope.senderId) });
       return;
     }
     
     // Decapsulate to get shared secret
     session.decapsulate(envelope.kemCiphertext);
     
-    // Move to active sessions
+    // JHILKE: Clear bootstrap flag — now KEM-backed with full PFS
+    session.bootstrapped = false;
+    
+    // Move from pending to active
     this.pendingHandshakes.delete(envelope.senderId);
     this.sessions.set(envelope.senderId, session);
     this.stats.sessionsCreated++;
-    
-    log.info('Channel established with peer', { peerId: envelope.senderId?.slice(0, 16) });
+    log.info('Channel established with peer', { peerId: peerTag(envelope.senderId) });
     
     // Resolve the handshake promise
     if (session._resolveHandshake) {
@@ -628,7 +878,7 @@ export class Annex {
   async _handleEncrypted(envelope) {
     const session = this.sessions.get(envelope.senderId);
     if (!session || !session.established) {
-      log.warn('No session for encrypted message', { peerId: envelope.senderId?.slice(0, 16) });
+      log.warn('No session for encrypted message', { peerId: peerTag(envelope.senderId) });
       return;
     }
     
@@ -653,6 +903,13 @@ export class Annex {
         payload = plaintext;
       }
       
+      // JHILKE: Intercept secure ANNEX control messages routed through
+      // the encrypted channel (bootstrap upgrade, encrypted rekey, etc.)
+      if (payload && payload._annexControl) {
+        await this._handleAnnexControl(payload._annexControl, envelope.senderId);
+        return;
+      }
+      
       // Dispatch to handlers
       for (const handler of this.messageHandlers.values()) {
         try {
@@ -675,48 +932,58 @@ export class Annex {
       }
     }
   }
+
   
-  async _handleRekey(envelope) {
-    const session = this.sessions.get(envelope.senderId);
-    if (!session) return;
-    
-    log.debug('Re-keying with peer', { peerId: envelope.senderId?.slice(0, 16) });
-    
-    // Respond to re-key with new key exchange
-    session.generateKeyPair();
-    const kemCiphertext = session.encapsulate(envelope.kemPublicKey);
-    session.messageCount = 0;
-    
-    const response = new AnnexEnvelope({
-      type: ANNEX_CONFIG.messageTypes.KEY_RESPONSE,
-      senderId: this.identity.identity.nodeId,
-      recipientId: envelope.senderId,
-      sessionId: session.sessionId,
-      kemPublicKey: bytesToHex(session.kemKeyPair.publicKey),
-      kemCiphertext,
-    });
-    
-    response.signature = this.identity.sign(response.getSigningPayload());
-    await this._sendToMesh(envelope.senderId, response);
+  // KEM-based _handleRekey and _rekey REMOVED — JHILKE handles all rekeys
+  // deterministically via deriveRekeyKey(). Both nodes compute the same key
+  // after cricket coordination. No encapsulate/decapsulate dance needed.
+  
+  /**
+   * Send an ANNEX control message securely through the existing encrypted channel.
+   * When a session exists, wraps the control message inside an encrypted payload.
+   * Falls back to raw transport only when no session exists (pre-bootstrap).
+   *
+   * This eliminates plaintext KEM exchange after bootstrap — all ANNEX control
+   * messages (KEY_EXCHANGE, KEY_RESPONSE, REKEY) are encrypted on the wire.
+   */
+  async _sendControlSecure(remoteNodeId, controlEnvelope) {
+    const session = this.sessions.get(remoteNodeId);
+    if (session?.established) {
+      // Wrap control message inside encrypted ANNEX payload
+      // _skipRekeyCheck prevents recursive rekey triggers
+      await this.send(remoteNodeId, { _annexControl: controlEnvelope.toJSON() }, { _skipRekeyCheck: true });
+    } else {
+      // No session yet — raw transport (only during pre-JHILKE or HELLO/WELCOME phase)
+      await this._sendToMesh(remoteNodeId, controlEnvelope);
+    }
   }
   
-  async _rekey(session) {
-    log.debug('Initiating re-key with peer', { peerId: session.remoteNodeId?.slice(0, 16) });
-    
-    // Generate new ephemeral keys
-    const newPublicKey = session.generateKeyPair();
-    session.messageCount = 0;
-    
-    const envelope = new AnnexEnvelope({
-      type: ANNEX_CONFIG.messageTypes.REKEY,
-      senderId: this.identity.identity.nodeId,
-      recipientId: session.remoteNodeId,
-      sessionId: session.sessionId,
-      kemPublicKey: newPublicKey,
+  /**
+   * Handle a secure ANNEX control message received through the encrypted channel.
+   * The outer AEAD encryption guarantees authenticity — no separate signature
+   * check needed (only the session peer could have encrypted it).
+   */
+  async _handleAnnexControl(controlData, senderId) {
+    log.debug('Processing secure ANNEX control', {
+      type: controlData.type,
+      from: peerTag(senderId),
     });
     
-    envelope.signature = this.identity.sign(envelope.getSigningPayload());
-    await this._sendToMesh(session.remoteNodeId, envelope);
+    switch (controlData.type) {
+      case ANNEX_CONFIG.messageTypes.KEY_EXCHANGE:
+        await this._handleKeyExchange(controlData);
+        break;
+      case ANNEX_CONFIG.messageTypes.KEY_RESPONSE:
+        await this._handleKeyResponse(controlData);
+        break;
+      case ANNEX_CONFIG.messageTypes.CLOSE: {
+        const closedSession = this.sessions.get(controlData.senderId);
+        if (closedSession) closedSession.channelState = ChannelState.CLOSED;
+        this.sessions.delete(controlData.senderId);
+        log.info('Channel closed by peer (secure)', { peerId: peerTag(controlData.senderId) });
+        break;
+      }
+    }
   }
   
   async _sendToMesh(remoteNodeId, envelope) {
@@ -730,11 +997,98 @@ export class Annex {
     });
   }
   
+  /**
+   * Buffer an ANNEX message whose sender key hasn't arrived yet.
+   * Replays automatically when 'peer-registered' fires, or discards
+   * after _deferTimeoutMs (preventing memory leaks from spoofed senderIds).
+   */
+  _deferMessage(envelope, origin) {
+    const senderId = envelope.senderId;
+    
+    // Already deferring a message from this sender — discard the older one
+    if (this._deferredMessages.has(senderId)) {
+      const existing = this._deferredMessages.get(senderId);
+      clearTimeout(existing.timer);
+      if (existing.onRegistered) {
+        this.mesh.off('peer-registered', existing.onRegistered);
+      }
+      this._deferredMessages.delete(senderId);
+    }
+    
+    // Cap total deferred senders to prevent memory abuse
+    if (this._deferredMessages.size >= this._maxDeferredSenders) {
+      log.debug('Deferred ANNEX queue full, dropping message from unknown peer', {
+        peerId: peerTag(senderId),
+        type: envelope.type,
+      });
+      return;
+    }
+    
+    log.debug('Deferring ANNEX message until peer key arrives', {
+      peerId: peerTag(senderId),
+      type: envelope.type,
+    });
+    
+    // Event listener: replay when peer registers
+    const onRegistered = (registeredNodeId) => {
+      if (registeredNodeId === senderId) {
+        this._replayDeferred(senderId);
+      }
+    };
+    
+    // Safety timeout: if key never arrives, discard silently
+    const timer = setTimeout(() => {
+      if (this._deferredMessages.has(senderId)) {
+        this.mesh.off('peer-registered', onRegistered);
+        this._deferredMessages.delete(senderId);
+        log.debug('Deferred ANNEX message expired (peer key never arrived)', {
+          peerId: peerTag(senderId),
+          type: envelope.type,
+        });
+      }
+    }, this._deferTimeoutMs);
+    
+    this._deferredMessages.set(senderId, { envelope, origin, timer, onRegistered });
+    this.mesh.on('peer-registered', onRegistered);
+  }
+  
+  /**
+   * Replay a deferred ANNEX message now that the sender's key is available.
+   */
+  _replayDeferred(senderId) {
+    const deferred = this._deferredMessages.get(senderId);
+    if (!deferred) return;
+    
+    clearTimeout(deferred.timer);
+    this.mesh.off('peer-registered', deferred.onRegistered);
+    this._deferredMessages.delete(senderId);
+    
+    log.debug('Replaying deferred ANNEX message (peer key arrived)', {
+      peerId: peerTag(senderId),
+      type: deferred.envelope.type,
+    });
+    
+    // Re-enter the handler — this time _getPeerPublicKey should succeed
+    this._handleAnnexMessage(deferred.envelope, deferred.origin).catch(err => {
+      log.warn('Deferred ANNEX replay failed', { peerId: peerTag(senderId), error: err.message });
+    });
+  }
+  
   _getPeerPublicKey(nodeId) {
-    // Get from mesh peer info
+    // Get from WS peer info first
     if (this.mesh && this.mesh.peers) {
       const peer = this.mesh.peers.get(nodeId);
-      return peer?.identity?.publicKey || null;
+      if (peer?.identity?.publicKey) return peer.identity.publicKey;
+    }
+    // Fallback: relay peer keys stored during signed registration
+    if (this.mesh && this.mesh._relayPeerKeys) {
+      const key = this.mesh._relayPeerKeys.get(nodeId);
+      if (key) return key;
+    }
+    // Fallback: SHERPA registry (populated during relay registration)
+    if (this.mesh && this.mesh.sherpa?.registry) {
+      const regPeer = this.mesh.sherpa.registry.get(nodeId);
+      if (regPeer?.publicKey) return regPeer.publicKey;
     }
     return null;
   }