fix(sync): ingest replayed quarantined grants + guard Prime's legacy custody upgrade (post-#33 review hardening)

[Reederey87]

Summary

Hardening follow-up to #33 from the post-merge gpt-5.5 (Codex) security review. Four findings triaged: two real gaps fixed here, two are the already-documented residuals (P4-SEC-04, P6-SEC-03) now annotated in the specs.

Fix 1 — replay-time grant ingestion (availability, High)

A device.key.granted carrier that arrives before its author is approved locally is quarantined (event_verification_failure) and the pull cursor advances past it (PR #30 semantics). EncryptedHub.Pull is the only path that ingests a grant's WCK — and it never re-pulls that carrier. So the approve-time replay applied the event's audit row but the granted (epoch, kid) was permanently lost: every fleet event sealed under it would defer ("awaiting workspace key grant") forever.

replayQuarantinedEvents (both devices approve and devices enroll --approve) now unmarshals a replayed grant and calls Keyring.IngestGrant — recipient filtering, kid-mismatch rejection, and the no-overwrite guarantees all apply unchanged. Pinned by TestReplayIngestsQuarantinedGrant: grant quarantined under the fail-closed regime → approve → key metadata, custody slot, and decrypt candidates all held, conflict resolved.

Fix 2 — Prime legacy-upgrade custody guard (Medium)

Keyring.Prime's legacy kid-less backfill was the one surviving unconditional custody write: it computed the kid from the legacy slot and called StoreWCK even if the kid-aware target slot already held different bytes (local corruption/tampering). It now byte-compares and refuses a mismatch — the same P6-SEC-01b defense IngestGrant ships. Pinned by TestPrimeRefusesLegacyUpgradeOverDifferentBytes.

Documented residuals (spec notes only)

• P4-SEC-04 (spec/15): pre-enrollment bootstrap grants gain 'grant' origin and hence push preference — the residual's full extent is now stated; closing it is the out-of-band fingerprint work.
• P6-SEC-03 (spec/07): the permanent-truncate wedge extends to a hostile hub forging an unheld kid at a held epoch; the truncate-vs-skip trade is deliberate (skipping would lose legitimately-decryptable-later fleet events), the fix remains the bounded grace window.

Validation

• gofmt -w cmd internal — clean
• golangci-lint run (v2.12.0) — 0 issues
• go run ./cmd/spec-drift --base origin/main --head HEAD — passed (20 specs, 8 changed files)
• GOCACHE=/tmp/devstrap-gocache go test -race ./... — all pass

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fbea2426-751b-4a0d-aef5-41e05f8565e2

📥 Commits

Reviewing files that changed from the base of the PR and between f5f527e and 5fbc503.

📒 Files selected for processing (7)

• internal/sync/encryptedhub.go
• internal/sync/encryptedhub_test.go
• internal/sync/eventcrypt.go
• internal/workspacekeys/keyring.go
• spec/07_NAMESPACE_AND_SYNC_MODEL.md
• spec/15_SECURITY_THREAT_MODEL.md
• spec/18_WORK_LOG.md

👮 Files not reviewed due to content moderation or server errors (7)

• spec/18_WORK_LOG.md
• internal/sync/encryptedhub_test.go
• spec/15_SECURITY_THREAT_MODEL.md
• internal/sync/eventcrypt.go
• internal/sync/encryptedhub.go
• internal/workspacekeys/keyring.go
• spec/07_NAMESPACE_AND_SYNC_MODEL.md

---

📝 Walkthrough

[!WARNING]

Walkthrough skipped

File diffs could not be summarized.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/p6-sec-01-replay-ingest

---

_{Comment @coderabbitai help to get the list of available commands.}

[Reederey87]

Second review pass (fable-5 adversarial review of the merged #33 diff) added one more fix in 5fbc503:

Major — relabeled-kid wedge. The envelope kid is outside the AAD until enc.v2, so a hostile hub could take a genuinely decryptable event, relabel its kid to any unheld 64-hex value, and wedge the device forever on the truncate path — even though it held the decrypting key. Pull now treats the kid strictly as a candidate-ordering hint: exact match first, then every held key at the epoch; truncate (defer) only when the kid is unheld and nothing at the epoch decrypts (the P6-SEC-02 fleet-key defer is preserved), skip only when the named key is held (or the envelope is legacy kid-less) and all candidates fail auth. Pinned by TestEncryptedHubRelabeledKidStillDecrypts; all prior poison/truncate pins pass unchanged.

Also from that review: the kid-STRIP availability residual (targeted event drop for a not-yet-granted joiner; closed by the enc.v2 AAD binding, P6-SYNC-04) is now documented in spec/15, the overclaiming comment in eventcrypt.go is corrected, and the split-brain double-founding caveat (init --join on second machines) is documented in spec/07. Verdict items not fixed here are the two scheduled residuals (P4-SEC-04, P6-SYNC-04) plus two nits addressed as comments.