Renderer QUIC server authenticates no peer — any LAN host can register as a renderer

[forkwright]

Finding

The renderer QUIC server authenticates no one. handle_renderer_connection reads a SessionInit, validates only its message type, then assigns a session ID and registers the renderer. No API key, token, or pre-shared secret is checked, so any host that can reach QUIC port 4433 completes the handshake and is recorded in the registry.

Evidence

crates/archon/src/render/server.rs:199:

let session_id = RendererSessionId(generate_session_id());

The peer's SessionInit is read at line 185 and only its message type is checked at line 186; lines 199-226 then unconditionally create and registry.add() the session. The credentials.rs module stores API keys but is never consulted on the server path.

Why this matters

Any LAN attacker can register as a renderer: receive audio frames once the audio unidirectional stream is wired, read session metadata (renderer name, connected time) through the REST API, and flood RendererRegistry with attacker-controlled entries. There is no admission control on a network-exposed surface that an in-scope adversary can reach.

Desired correction

Carry an API key or HMAC token derived from the pre-shared renderer credential in SessionInit (or a follow-up SessionAuth message). Verify it before calling registry.add(); close connections that fail verification with a QUIC protocol error before any session state is created.
Done when: a renderer presenting no valid API key receives a protocol error and is disconnected before being added to the registry, and an integration test verifies the rejection.