[control] QUIC/mTLS key exchange + PSP-model data plane (APO-648/APO-644)#1

Merged

dilyevsky merged 20 commits into

mainfrom

dsky/apo-648-quic-psp-keyexchange

Jun 15, 2026

Commits on Jun 1, 2026

[handler] harden decap: anti-replay after auth (APO-645), empty-payload guard (APO-647)
dilyevsky
committed
[forwarder] recover datapath transform panics into frame drops
dilyevsky
committed
[control] add PSP key derivation: SP 800-108 KDF + AES-CMAC (APO-648)
dilyevsky
committed
[control] add QUIC/mTLS control plane with PSP SA negotiation (APO-648)
dilyevsky
committed
[handler] bind the AES-GCM nonce to the SPI and guard the key-install seam (APO-644)
dilyevsky
committed
[cli] document enforced rx!=tx + restart nonce-reuse caveat (APO-644)
dilyevsky
committed
[control] add control-plane tunnel orchestrator wiring SAs into the datapath (APO-648)
dilyevsky
committed
[cli] wire the control plane into the tunnel; add genkey/pubkey (APO-644)
dilyevsky
committed

Commits on Jun 2, 2026

Commits on Jun 14, 2026

Commits on Jun 15, 2026

[control] rename PSPVersion → ICXVersion (cipher-suite selector) (APO-758)
dilyevsky
committed