xah30
bb835e4ca7
feat(proto): implement Wave 2 — hybrid PKI handshake + session
aura-proto: 5-byte wire header + Frame codec (§6.1/§6.3); transport-agnostic
handshake state machine (§6.2) over split tokio AsyncRead/AsyncWrite —
hybrid X25519+ML-KEM-768 KEM, SHA-256 transcript, mutual X.509 auth with
ECDSA-P256 transcript signatures (ring), constant-time HMAC Finished;
Session with sliding-window replay protection. 13 tests green, clippy clean.
Handshake message order pinned (resolves spec diagram ambiguity); reader/writer
taken by value since Session owns both halves.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>