feat: add Noise channel foundation

Co-authored-by: Codex noreply@openai.com

codex-rs/exec-server/src/aws_lc_ml_kem.rs

@@ -0,0 +1,90 @@
+use aws_lc_rs::kem::Ciphertext;
+use aws_lc_rs::kem::DecapsulationKey;
+use aws_lc_rs::kem::EncapsulationKey;
+use aws_lc_rs::kem::ML_KEM_768;
+use clatter::KeyPair;
+use clatter::bytearray::ByteArray;
+use clatter::bytearray::HeapArray;
+use clatter::bytearray::SensitiveByteArray;
+use clatter::error::KemError;
+use clatter::error::KemResult;
+use clatter::traits::CryptoComponent;
+use clatter::traits::Kem;
+use clatter::traits::Rng;
+
+pub(super) const PUBLIC_KEY_LEN: usize = 1184;
+const SECRET_KEY_LEN: usize = 2400;
+const CIPHERTEXT_LEN: usize = 1088;
+const SHARED_SECRET_LEN: usize = 32;
+
+/// ML-KEM-768 implementation backed by AWS-LC through `aws-lc-rs`.
+#[derive(Clone)]
+pub(super) struct AwsLcMlKem768;
+
+impl CryptoComponent for AwsLcMlKem768 {
+    fn name() -> &'static str {
+        "MLKEM768"
+    }
+}
+
+impl Kem for AwsLcMlKem768 {
+    type SecretKey = SensitiveByteArray<HeapArray<SECRET_KEY_LEN>>;
+    type PubKey = HeapArray<PUBLIC_KEY_LEN>;
+    type Ct = HeapArray<CIPHERTEXT_LEN>;
+    type Ss = SensitiveByteArray<[u8; SHARED_SECRET_LEN]>;
+
+    fn genkey_rng<R: Rng>(_rng: &mut R) -> KemResult<KeyPair<Self::PubKey, Self::SecretKey>> {
+        // AWS-LC owns ML-KEM key-generation randomness internally, so
+        // Clatter's injectable RNG cannot be plumbed through this provider.
+        let decapsulation_key =
+            DecapsulationKey::generate(&ML_KEM_768).map_err(|_| KemError::KeyGeneration)?;
+        let encapsulation_key = decapsulation_key
+            .encapsulation_key()
+            .map_err(|_| KemError::KeyGeneration)?;
+        let public = encapsulation_key
+            .key_bytes()
+            .map_err(|_| KemError::KeyGeneration)?;
+        let secret = decapsulation_key
+            .key_bytes()
+            .map_err(|_| KemError::KeyGeneration)?;
+
+        Ok(KeyPair {
+            public: Self::PubKey::from_slice(public.as_ref()),
+            secret: Self::SecretKey::from_slice(secret.as_ref()),
+        })
+    }
+
+    fn encapsulate<R: Rng>(pk: &[u8], _rng: &mut R) -> KemResult<(Self::Ct, Self::Ss)> {
+        let encapsulation_key =
+            EncapsulationKey::new(&ML_KEM_768, pk).map_err(|_| KemError::Input)?;
+        let (ciphertext, shared_secret) = encapsulation_key
+            .encapsulate()
+            .map_err(|_| KemError::Encapsulation)?;
+
+        Ok((
+            Self::Ct::from_slice(ciphertext.as_ref()),
+            Self::Ss::from_slice(shared_secret.as_ref()),
+        ))
+    }
+
+    fn decapsulate(ct: &[u8], sk: &[u8]) -> KemResult<Self::Ss> {
+        // Reject the length before constructing AWS-LC's ciphertext wrapper.
+        // This keeps malformed wire input classified as an input error rather
+        // than relying on provider-specific decapsulation behavior.
+        if ct.len() != CIPHERTEXT_LEN {
+            return Err(KemError::Input);
+        }
+
+        let decapsulation_key =
+            DecapsulationKey::new(&ML_KEM_768, sk).map_err(|_| KemError::Input)?;
+        let shared_secret = decapsulation_key
+            .decapsulate(Ciphertext::from(ct))
+            .map_err(|_| KemError::Decapsulation)?;
+
+        Ok(Self::Ss::from_slice(shared_secret.as_ref()))
+    }
+}
+
+#[cfg(test)]
+#[path = "aws_lc_ml_kem_tests.rs"]
+mod tests;

codex-rs/exec-server/src/aws_lc_ml_kem_tests.rs

@@ -0,0 +1,31 @@
+use clatter::bytearray::ByteArray;
+use clatter::traits::Kem;
+use pretty_assertions::assert_eq;
+
+use super::AwsLcMlKem768;
+
+#[test]
+fn kem_roundtrip() {
+    let keypair = AwsLcMlKem768::genkey().expect("generate keypair");
+    let mut rng = clatter::crypto::rng::DefaultRng;
+    let (ciphertext, encapsulated_secret) =
+        AwsLcMlKem768::encapsulate(keypair.public.as_slice(), &mut rng).expect("encapsulate");
+    let decapsulated_secret =
+        AwsLcMlKem768::decapsulate(ciphertext.as_slice(), keypair.secret.as_slice())
+            .expect("decapsulate");
+
+    assert_eq!(
+        encapsulated_secret.as_slice(),
+        decapsulated_secret.as_slice()
+    );
+}
+
+#[test]
+fn decapsulate_rejects_wrong_ciphertext_length() {
+    let keypair = AwsLcMlKem768::genkey().expect("generate keypair");
+
+    let error = AwsLcMlKem768::decapsulate(&[], keypair.secret.as_slice())
+        .expect_err("empty ciphertext should be rejected");
+
+    assert!(matches!(error, clatter::error::KemError::Input));
+}

codex-rs/exec-server/src/lib.rs

@@ -1,3 +1,4 @@
+mod aws_lc_ml_kem;
 mod client;
 mod client_api;
 mod client_transport;
@@ -11,6 +12,7 @@ mod fs_helper_main;
 mod fs_sandbox;
 mod local_file_system;
 mod local_process;
+mod noise_channel;
 mod process;
 mod process_id;
 mod protocol;
@@ -51,6 +53,9 @@ pub use fs_helper::CODEX_FS_HELPER_ARG1;
 pub use fs_helper_main::main as run_fs_helper_main;
 pub use local_file_system::LOCAL_FS;
 pub use local_file_system::LocalFileSystem;
+pub use noise_channel::NoiseChannelError;
+pub use noise_channel::NoiseChannelIdentity;
+pub use noise_channel::NoiseChannelPublicKey;
 pub use process::ExecBackend;
 pub use process::ExecProcess;
 pub use process::ExecProcessEvent;

codex-rs/exec-server/src/noise_channel.rs

@@ -0,0 +1,379 @@
+//! Narrow, misuse-resistant wrapper around the Clatter primitives used by the
+//! remote exec-server relay.
+//!
+//! The harness is the Noise hybrid-IK initiator and pins the registry-provided
+//! exec-server static public key. The exec-server is the responder; after it
+//! reads the first IK message, Noise exposes the authenticated harness static
+//! public key for registry authorization. Application data is allowed only
+//! after both the cryptographic handshake and that external authorization pass.
+
+use base64::Engine;
+use base64::engine::general_purpose::STANDARD;
+use clatter::HybridHandshake;
+use clatter::HybridHandshakeParams;
+use clatter::KeyPair;
+use clatter::bytearray::ByteArray;
+use clatter::constants::MAX_MESSAGE_LEN;
+use clatter::crypto::cipher::AesGcm;
+use clatter::crypto::dh::X25519;
+use clatter::crypto::hash::Sha256;
+use clatter::handshakepattern::noise_hybrid_ik;
+use clatter::traits::Cipher;
+use clatter::traits::Dh;
+use clatter::traits::Handshaker;
+use clatter::traits::Kem;
+use clatter::transportstate::TransportState;
+use serde::Deserialize;
+use serde::Serialize;
+
+use crate::aws_lc_ml_kem::AwsLcMlKem768;
+use crate::aws_lc_ml_kem::PUBLIC_KEY_LEN as MLKEM768_PUBLIC_KEY_LEN;
+
+pub const NOISE_CHANNEL_SUITE: &str = "Noise_hybridIK_X25519+MLKEM768_AESGCM_SHA256";
+
+const X25519_PUBLIC_KEY_LEN: usize = 32;
+const MAX_TRANSPORT_RECORDS_PER_DIRECTION: u64 = u32::MAX as u64;
+const PROLOGUE_DOMAIN: &[u8] = b"codex-exec-server-relay-noise/v1";
+
+type Handshake = HybridHandshake<X25519, AwsLcMlKem768, AwsLcMlKem768, AesGcm, Sha256>;
+type Transport = TransportState<AesGcm, Sha256>;
+type DhKeyPair = KeyPair<<X25519 as Dh>::PubKey, <X25519 as Dh>::PrivateKey>;
+type KemKeyPair = KeyPair<<AwsLcMlKem768 as Kem>::PubKey, <AwsLcMlKem768 as Kem>::SecretKey>;
+
+/// Public key material for the exec-server Noise-over-relay suite.
+///
+/// The suite field is part of the serialized contract. A key from a different
+/// suite must not be interpreted as compatible merely because one component has
+/// a familiar byte length.
+#[derive(Clone, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct NoiseChannelPublicKey {
+    suite: String,
+    x25519_public_key: String,
+    mlkem768_public_key: String,
+}
+
+impl std::fmt::Debug for NoiseChannelPublicKey {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("NoiseChannelPublicKey")
+            .field("suite", &self.suite)
+            .field("x25519_public_key", &"<redacted>")
+            .field("mlkem768_public_key", &"<redacted>")
+            .finish()
+    }
+}
+
+impl NoiseChannelPublicKey {
+    /// Validate suite selection, encoding, and exact key lengths.
+    pub fn validate(&self) -> Result<(), NoiseChannelError> {
+        let _ = self.decode()?;
+        Ok(())
+    }
+
+    fn from_keypairs(dh: &DhKeyPair, kem: &KemKeyPair) -> Self {
+        Self {
+            suite: NOISE_CHANNEL_SUITE.to_string(),
+            x25519_public_key: STANDARD.encode(dh.public),
+            mlkem768_public_key: STANDARD.encode(kem.public.as_slice()),
+        }
+    }
+
+    fn from_raw(dh: &<X25519 as Dh>::PubKey, kem: &<AwsLcMlKem768 as Kem>::PubKey) -> Self {
+        Self {
+            suite: NOISE_CHANNEL_SUITE.to_string(),
+            x25519_public_key: STANDARD.encode(dh),
+            mlkem768_public_key: STANDARD.encode(kem.as_slice()),
+        }
+    }
+
+    fn decode(
+        &self,
+    ) -> Result<(<X25519 as Dh>::PubKey, <AwsLcMlKem768 as Kem>::PubKey), NoiseChannelError> {
+        if self.suite != NOISE_CHANNEL_SUITE {
+            return Err(NoiseChannelError::InvalidPublicKey(
+                "unsupported Noise channel suite",
+            ));
+        }
+        let dh = STANDARD
+            .decode(&self.x25519_public_key)
+            .map_err(|_| NoiseChannelError::InvalidPublicKey("invalid X25519 public key"))?;
+        let dh: [u8; X25519_PUBLIC_KEY_LEN] = dh
+            .try_into()
+            .map_err(|_| NoiseChannelError::InvalidPublicKey("invalid X25519 public key length"))?;
+        let kem = STANDARD
+            .decode(&self.mlkem768_public_key)
+            .map_err(|_| NoiseChannelError::InvalidPublicKey("invalid ML-KEM-768 public key"))?;
+        if kem.len() != MLKEM768_PUBLIC_KEY_LEN {
+            return Err(NoiseChannelError::InvalidPublicKey(
+                "invalid ML-KEM-768 public key length",
+            ));
+        }
+
+        Ok((
+            dh,
+            <AwsLcMlKem768 as Kem>::PubKey::from_slice(kem.as_slice()),
+        ))
+    }
+}
+
+/// Endpoint-local static identity for the exec-server Noise-over-relay suite.
+///
+/// Private components never cross the process boundary. Cloning is used only to
+/// construct Clatter handshake state for reconnects within the same process.
+#[derive(Clone)]
+pub struct NoiseChannelIdentity {
+    dh: DhKeyPair,
+    kem: KemKeyPair,
+}
+
+impl std::fmt::Debug for NoiseChannelIdentity {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("NoiseChannelIdentity")
+            .field("public_key", &self.public_key())
+            .finish_non_exhaustive()
+    }
+}
+
+impl NoiseChannelIdentity {
+    /// Generate independent classical and post-quantum static keypairs.
+    pub fn generate() -> Result<Self, NoiseChannelError> {
+        let dh = X25519::genkey()
+            .map_err(|error| NoiseChannelError::KeyGeneration(error.to_string()))?;
+        let kem = AwsLcMlKem768::genkey()
+            .map_err(|error| NoiseChannelError::KeyGeneration(error.to_string()))?;
+        Ok(Self { dh, kem })
+    }
+
+    /// Return the distributable public half of this endpoint identity.
+    pub fn public_key(&self) -> NoiseChannelPublicKey {
+        NoiseChannelPublicKey::from_keypairs(&self.dh, &self.kem)
+    }
+}
+
+pub(crate) struct InitiatorHandshake {
+    handshake: Handshake,
+}
+
+impl InitiatorHandshake {
+    /// Start hybrid IK while pinning the expected responder static key.
+    ///
+    /// `payload` is encrypted by the first IK message. The relay uses it for
+    /// the short-lived registry authorization naming this harness public key.
+    pub(crate) fn start(
+        identity: &NoiseChannelIdentity,
+        responder_public_key: &NoiseChannelPublicKey,
+        prologue: &[u8],
+        payload: &[u8],
+    ) -> Result<(Self, Vec<u8>), NoiseChannelError> {
+        let (responder_dh, responder_kem) = responder_public_key.decode()?;
+
+        // IK authenticates both static identities. Supplying both responder
+        // components here is what makes a misrouted or impersonating
+        // exec-server fail before any JSON-RPC plaintext is released.
+        let params = HybridHandshakeParams::new(noise_hybrid_ik(), true)
+            .with_prologue(prologue)
+            .with_s(identity.dh.clone())
+            .with_s_kem(identity.kem.clone())
+            .with_rs(responder_dh)
+            .with_rs_kem(responder_kem);
+        let mut handshake = Handshake::new(params)?;
+        let mut output = [0u8; MAX_MESSAGE_LEN];
+        let output_len = handshake.write_message(payload, &mut output)?;
+        Ok((Self { handshake }, output[..output_len].to_vec()))
+    }
+
+    /// Consume the responder message and enter transport mode.
+    ///
+    /// The responder message carries no application payload in v1. Rejecting
+    /// one keeps future protocol additions from becoming an implicit channel.
+    pub(crate) fn finish(mut self, response: &[u8]) -> Result<NoiseTransport, NoiseChannelError> {
+        ensure_noise_frame_len(response.len(), "handshake response is too large")?;
+        let mut payload = [0u8; MAX_MESSAGE_LEN];
+        let payload_len = self.handshake.read_message(response, &mut payload)?;
+        if payload_len != 0 {
+            return Err(NoiseChannelError::InvalidMessage(
+                "handshake response payload must be empty",
+            ));
+        }
+        Ok(NoiseTransport {
+            transport: self.handshake.finalize()?,
+        })
+    }
+}
+
+pub(crate) struct PendingResponderHandshake {
+    handshake: Handshake,
+    initiator_public_key: NoiseChannelPublicKey,
+    payload: Vec<u8>,
+}
+
+impl PendingResponderHandshake {
+    /// Authenticate and parse the first IK message without completing it.
+    ///
+    /// This split is intentional: callers must authorize `initiator_public_key`
+    /// with the registry before calling [`Self::complete`].
+    pub(crate) fn read_request(
+        identity: &NoiseChannelIdentity,
+        prologue: &[u8],
+        request: &[u8],
+    ) -> Result<Self, NoiseChannelError> {
+        ensure_noise_frame_len(request.len(), "handshake request is too large")?;
+        let params = HybridHandshakeParams::new(noise_hybrid_ik(), false)
+            .with_prologue(prologue)
+            .with_s(identity.dh.clone())
+            .with_s_kem(identity.kem.clone());
+        let mut handshake = Handshake::new(params)?;
+        let mut payload = [0u8; MAX_MESSAGE_LEN];
+        let payload_len = handshake.read_message(request, &mut payload)?;
+        // Clatter exposes the initiator static key only after the first IK
+        // message authenticates and decrypts successfully.
+        let remote = handshake
+            .get_remote_static()
+            .ok_or(NoiseChannelError::InvalidMessage(
+                "handshake request is missing initiator static key",
+            ))?;
+        Ok(Self {
+            handshake,
+            initiator_public_key: NoiseChannelPublicKey::from_raw(remote.dh(), remote.kem()),
+            payload: payload[..payload_len].to_vec(),
+        })
+    }
+
+    pub(crate) fn initiator_public_key(&self) -> &NoiseChannelPublicKey {
+        &self.initiator_public_key
+    }
+
+    /// Move the authenticated first-message payload out of pending state.
+    ///
+    /// The v1 payload is a short-lived registry authorization and is not
+    /// needed to complete the handshake. Moving it avoids retaining a second
+    /// copy while external authorization is in flight.
+    pub(crate) fn take_payload(&mut self) -> Vec<u8> {
+        std::mem::take(&mut self.payload)
+    }
+
+    /// Finish the responder handshake after external harness authorization.
+    pub(crate) fn complete(mut self) -> Result<(NoiseTransport, Vec<u8>), NoiseChannelError> {
+        let mut response = [0u8; MAX_MESSAGE_LEN];
+        let response_len = self.handshake.write_message(&[], &mut response)?;
+        Ok((
+            NoiseTransport {
+                transport: self.handshake.finalize()?,
+            },
+            response[..response_len].to_vec(),
+        ))
+    }
+}
+
+pub(crate) struct NoiseTransport {
+    transport: Transport,
+}
+
+impl NoiseTransport {
+    /// Encrypt exactly one ordered transport record.
+    ///
+    /// The caller owns relay sequence assignment and must never encrypt the
+    /// same logical record twice under different transport nonces.
+    pub(crate) fn encrypt(&mut self, plaintext: &[u8]) -> Result<Vec<u8>, NoiseChannelError> {
+        if self.transport.sending_nonce() >= MAX_TRANSPORT_RECORDS_PER_DIRECTION {
+            return Err(NoiseChannelError::InvalidState(
+                "transport record nonce exhausted",
+            ));
+        }
+        let frame_len = plaintext.len().checked_add(AesGcm::tag_len()).ok_or(
+            NoiseChannelError::InvalidMessage("transport plaintext is too large"),
+        )?;
+        ensure_noise_frame_len(frame_len, "transport plaintext is too large")?;
+        Ok(self.transport.send_vec(plaintext)?)
+    }
+
+    /// Decrypt exactly the next ordered transport record.
+    ///
+    /// Clatter advances the receiving nonce during this call, so callers must
+    /// reorder and deduplicate relay frames before invoking it.
+    pub(crate) fn decrypt(&mut self, ciphertext: &[u8]) -> Result<Vec<u8>, NoiseChannelError> {
+        if self.transport.receiving_nonce() >= MAX_TRANSPORT_RECORDS_PER_DIRECTION {
+            return Err(NoiseChannelError::InvalidState(
+                "transport record nonce exhausted",
+            ));
+        }
+        if ciphertext.len() < AesGcm::tag_len() {
+            return Err(NoiseChannelError::InvalidMessage(
+                "transport ciphertext is too short",
+            ));
+        }
+        ensure_noise_frame_len(ciphertext.len(), "transport ciphertext is too large")?;
+        Ok(self.transport.receive_vec(ciphertext)?)
+    }
+}
+
+/// Build the transcript prologue that binds cryptographic identity to routing.
+///
+/// A handshake captured from one environment, exec-server registration, or
+/// relay stream cannot be replayed into another because every participant must
+/// construct the same prologue before the first Noise message is processed.
+pub(crate) fn noise_channel_prologue(
+    environment_id: &str,
+    executor_registration_id: &str,
+    stream_id: &str,
+) -> Result<Vec<u8>, NoiseChannelError> {
+    let mut prologue = Vec::new();
+    append_prologue_part(&mut prologue, PROLOGUE_DOMAIN)?;
+    append_prologue_part(&mut prologue, environment_id.as_bytes())?;
+    append_prologue_part(&mut prologue, executor_registration_id.as_bytes())?;
+    append_prologue_part(&mut prologue, stream_id.as_bytes())?;
+    Ok(prologue)
+}
+
+fn append_prologue_part(prologue: &mut Vec<u8>, part: &[u8]) -> Result<(), NoiseChannelError> {
+    // Length prefixes make component boundaries unambiguous. Raw concatenation
+    // would allow different identifier tuples to produce the same prologue.
+    let len = u32::try_from(part.len()).map_err(|_| {
+        NoiseChannelError::InvalidMessage("Noise channel prologue part is too large")
+    })?;
+    prologue.extend_from_slice(&len.to_be_bytes());
+    prologue.extend_from_slice(part);
+    Ok(())
+}
+
+fn ensure_noise_frame_len(
+    frame_len: usize,
+    message: &'static str,
+) -> Result<(), NoiseChannelError> {
+    if frame_len > MAX_MESSAGE_LEN {
+        return Err(NoiseChannelError::InvalidMessage(message));
+    }
+    Ok(())
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum NoiseChannelError {
+    #[error("Noise channel key generation failed: {0}")]
+    KeyGeneration(String),
+    #[error("invalid Noise channel public key: {0}")]
+    InvalidPublicKey(&'static str),
+    #[error("invalid Noise channel state: {0}")]
+    InvalidState(&'static str),
+    #[error("invalid Noise channel message: {0}")]
+    InvalidMessage(&'static str),
+    #[error("Noise channel handshake failed: {0}")]
+    Handshake(String),
+    #[error("Noise channel transport failed: {0}")]
+    Transport(String),
+}
+
+impl From<clatter::error::HandshakeError> for NoiseChannelError {
+    fn from(error: clatter::error::HandshakeError) -> Self {
+        Self::Handshake(error.to_string())
+    }
+}
+
+impl From<clatter::error::TransportError> for NoiseChannelError {
+    fn from(error: clatter::error::TransportError) -> Self {
+        Self::Transport(error.to_string())
+    }
+}
+
+#[cfg(test)]
+#[path = "noise_channel_tests.rs"]
+mod tests;

codex-rs/exec-server/src/noise_channel_tests.rs

@@ -0,0 +1,252 @@
+use pretty_assertions::assert_eq;
+
+use super::InitiatorHandshake;
+use super::MAX_TRANSPORT_RECORDS_PER_DIRECTION;
+use super::NOISE_CHANNEL_SUITE;
+use super::NoiseChannelError;
+use super::NoiseChannelIdentity;
+use super::NoiseChannelPublicKey;
+use super::PendingResponderHandshake;
+use super::noise_channel_prologue;
+
+#[test]
+fn hybrid_ik_roundtrip_authenticates_both_endpoints() {
+    let initiator = NoiseChannelIdentity::generate().expect("generate initiator identity");
+    let responder = NoiseChannelIdentity::generate().expect("generate responder identity");
+    let prologue =
+        noise_channel_prologue("env-1", "registration-1", "stream-1").expect("build prologue");
+    let authorization = b"harness-key-authorization";
+
+    let (initiator_handshake, request) = InitiatorHandshake::start(
+        &initiator,
+        &responder.public_key(),
+        &prologue,
+        authorization,
+    )
+    .expect("start initiator handshake");
+    let mut responder_handshake =
+        PendingResponderHandshake::read_request(&responder, &prologue, &request)
+            .expect("read responder handshake");
+
+    assert_eq!(
+        responder_handshake.initiator_public_key(),
+        &initiator.public_key()
+    );
+    assert_eq!(responder_handshake.take_payload(), authorization);
+
+    let (mut responder_transport, response) = responder_handshake
+        .complete()
+        .expect("complete responder handshake");
+    let mut initiator_transport = initiator_handshake
+        .finish(&response)
+        .expect("complete initiator handshake");
+
+    let request_ciphertext = initiator_transport
+        .encrypt(b"request")
+        .expect("encrypt request");
+    assert_ne!(request_ciphertext, b"request");
+    assert_eq!(
+        responder_transport
+            .decrypt(&request_ciphertext)
+            .expect("decrypt request"),
+        b"request"
+    );
+
+    let response_ciphertext = responder_transport
+        .encrypt(b"response")
+        .expect("encrypt response");
+    assert_ne!(response_ciphertext, b"response");
+    assert_eq!(
+        initiator_transport
+            .decrypt(&response_ciphertext)
+            .expect("decrypt response"),
+        b"response"
+    );
+}
+
+#[test]
+fn initiator_rejects_wrong_responder_key() {
+    let initiator = NoiseChannelIdentity::generate().expect("generate initiator identity");
+    let expected_responder = NoiseChannelIdentity::generate().expect("generate expected identity");
+    let actual_responder = NoiseChannelIdentity::generate().expect("generate actual identity");
+    let prologue =
+        noise_channel_prologue("env-1", "registration-1", "stream-1").expect("build prologue");
+
+    let (_initiator_handshake, request) = InitiatorHandshake::start(
+        &initiator,
+        &expected_responder.public_key(),
+        &prologue,
+        b"authorization",
+    )
+    .expect("start initiator handshake");
+
+    assert!(
+        PendingResponderHandshake::read_request(&actual_responder, &prologue, &request).is_err()
+    );
+}
+
+#[test]
+fn responder_rejects_mismatched_prologue() {
+    let initiator = NoiseChannelIdentity::generate().expect("generate initiator identity");
+    let responder = NoiseChannelIdentity::generate().expect("generate responder identity");
+    let initiator_prologue =
+        noise_channel_prologue("env-1", "registration-1", "stream-1").expect("build prologue");
+    let responder_prologue =
+        noise_channel_prologue("env-1", "registration-1", "stream-2").expect("build prologue");
+    let (_initiator_handshake, request) = InitiatorHandshake::start(
+        &initiator,
+        &responder.public_key(),
+        &initiator_prologue,
+        b"authorization",
+    )
+    .expect("start initiator handshake");
+
+    assert!(
+        PendingResponderHandshake::read_request(&responder, &responder_prologue, &request).is_err()
+    );
+}
+
+#[test]
+fn prologue_encoding_is_stable_and_unambiguous() {
+    let prologue =
+        noise_channel_prologue("env-1", "registration-1", "stream-1").expect("build prologue");
+
+    assert_eq!(
+        prologue,
+        b"\x00\x00\x00\x20codex-exec-server-relay-noise/v1\
+          \x00\x00\x00\x05env-1\
+          \x00\x00\x00\x0eregistration-1\
+          \x00\x00\x00\x08stream-1"
+            .to_vec()
+    );
+}
+
+#[test]
+fn transport_rejects_tampered_ciphertext() {
+    let initiator = NoiseChannelIdentity::generate().expect("generate initiator identity");
+    let responder = NoiseChannelIdentity::generate().expect("generate responder identity");
+    let prologue =
+        noise_channel_prologue("env-1", "registration-1", "stream-1").expect("build prologue");
+    let (initiator_handshake, request) = InitiatorHandshake::start(
+        &initiator,
+        &responder.public_key(),
+        &prologue,
+        b"authorization",
+    )
+    .expect("start initiator handshake");
+    let responder_handshake =
+        PendingResponderHandshake::read_request(&responder, &prologue, &request)
+            .expect("read responder handshake");
+    let (mut responder_transport, response) = responder_handshake
+        .complete()
+        .expect("complete responder handshake");
+    let mut initiator_transport = initiator_handshake
+        .finish(&response)
+        .expect("complete initiator handshake");
+    let mut ciphertext = initiator_transport
+        .encrypt(b"request")
+        .expect("encrypt request");
+    ciphertext[0] ^= 1;
+
+    assert!(responder_transport.decrypt(&ciphertext).is_err());
+}
+
+#[test]
+fn transport_rejects_exhausted_receiving_nonce_before_decryption() {
+    let initiator = NoiseChannelIdentity::generate().expect("generate initiator identity");
+    let responder = NoiseChannelIdentity::generate().expect("generate responder identity");
+    let prologue =
+        noise_channel_prologue("env-1", "registration-1", "stream-1").expect("build prologue");
+    let (initiator_handshake, request) = InitiatorHandshake::start(
+        &initiator,
+        &responder.public_key(),
+        &prologue,
+        b"authorization",
+    )
+    .expect("start initiator handshake");
+    let responder_handshake =
+        PendingResponderHandshake::read_request(&responder, &prologue, &request)
+            .expect("read responder handshake");
+    let (mut responder_transport, response) = responder_handshake
+        .complete()
+        .expect("complete responder handshake");
+    let mut initiator_transport = initiator_handshake
+        .finish(&response)
+        .expect("complete initiator handshake");
+    let ciphertext = initiator_transport
+        .encrypt(b"request")
+        .expect("encrypt request");
+    responder_transport
+        .transport
+        .set_receiving_nonce(MAX_TRANSPORT_RECORDS_PER_DIRECTION);
+
+    assert!(matches!(
+        responder_transport.decrypt(&ciphertext),
+        Err(NoiseChannelError::InvalidState(
+            "transport record nonce exhausted"
+        ))
+    ));
+}
+
+#[test]
+fn transport_rejects_replayed_ciphertext() {
+    let initiator = NoiseChannelIdentity::generate().expect("generate initiator identity");
+    let responder = NoiseChannelIdentity::generate().expect("generate responder identity");
+    let prologue =
+        noise_channel_prologue("env-1", "registration-1", "stream-1").expect("build prologue");
+    let (initiator_handshake, request) = InitiatorHandshake::start(
+        &initiator,
+        &responder.public_key(),
+        &prologue,
+        b"authorization",
+    )
+    .expect("start initiator handshake");
+    let responder_handshake =
+        PendingResponderHandshake::read_request(&responder, &prologue, &request)
+            .expect("read responder handshake");
+    let (mut responder_transport, response) = responder_handshake
+        .complete()
+        .expect("complete responder handshake");
+    let mut initiator_transport = initiator_handshake
+        .finish(&response)
+        .expect("complete initiator handshake");
+    let ciphertext = initiator_transport
+        .encrypt(b"request")
+        .expect("encrypt request");
+
+    assert_eq!(
+        responder_transport
+            .decrypt(&ciphertext)
+            .expect("decrypt request"),
+        b"request"
+    );
+    assert!(matches!(
+        responder_transport.decrypt(&ciphertext),
+        Err(NoiseChannelError::Transport(_))
+    ));
+}
+
+#[test]
+fn public_key_validation_rejects_unknown_suite() {
+    let key = NoiseChannelIdentity::generate()
+        .expect("generate identity")
+        .public_key();
+    let json = serde_json::to_value(key).expect("serialize key");
+    let mut object = json.as_object().expect("key object").clone();
+    object.insert("suite".to_string(), serde_json::json!("unknown"));
+    let key: NoiseChannelPublicKey =
+        serde_json::from_value(serde_json::Value::Object(object)).expect("deserialize key");
+
+    assert!(key.validate().is_err());
+}
+
+#[test]
+fn public_key_serializes_with_expected_suite() {
+    let key = NoiseChannelIdentity::generate()
+        .expect("generate identity")
+        .public_key();
+
+    let json = serde_json::to_value(key).expect("serialize key");
+
+    assert_eq!(json["suite"], NOISE_CHANNEL_SUITE);
+}