test(rig): verify identity/MITM security over the wire + safety-number consistency

Single-process loopback could never test the identity crypto: it self-pairs (safety
number over ONE identity, degenerate) and can't stage a MITM. The two-endpoint rig now
can, given DISTINCT identities per instance — added TRINET_KC_ACCOUNT (keychain account
suffix) and TRINET_PINS_KEY (pin-store suffix) so two local instances hold separate
identities + separate TOFU pins (dev-only, inert in a shipping run; mirrored on both
platforms to stay byte-identical).

smoke/two_endpoint_security.sh, verified live:
  TEST 1  two honest peers (A,B) with distinct identities derive the SAME safety number
          (24514929508 == 24514929508) with ZERO false MITM — the real Signal-style check
          that single-process loopback could not do.
  TEST 2  A pins B, then an impostor M with a DIFFERENT identity answers at B's address;
          A flags "identity CHANGED — session refused" and decodes ZERO video from M — a
          real over-the-wire MITM detection of the pinning feature (#36), not a harness.

Also: the MITM rejection now logs ONCE (on the false->true transition) instead of on every
impostor handshake retry (the rig saw 65196 lines; now 2). The latch + session refusal
are unchanged. Both platforms build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: 2 people

phone/TriNetVideo/VideoPipeline.swift

@@ -1642,7 +1642,16 @@ final class MeshCrypto {
     // Long-term signing key in the KEYCHAIN (not a plaintext plist). Migrates a legacy
     // UserDefaults key once; falls back to UserDefaults only if the Keychain is unavailable.
     static let kcService = "com.trinet.identity"
-    static let kcAccount = "device-ed25519"
+    // TRINET_KC_ACCOUNT / TRINET_PINS_KEY give the two-endpoint rig distinct identities +
+    // pin stores per instance (Mac rig only; inert on iOS where the env vars are unset).
+    static let kcAccount: String = {
+        if let s = ProcessInfo.processInfo.environment["TRINET_KC_ACCOUNT"], !s.isEmpty { return "device-ed25519-" + s }
+        return "device-ed25519"
+    }()
+    static let pinsKey: String = {
+        if let s = ProcessInfo.processInfo.environment["TRINET_PINS_KEY"], !s.isEmpty { return "trinetPeerPins-" + s }
+        return "trinetPeerPins"
+    }()
     private static func kcQuery() -> [String: Any] {
         [kSecClass as String: kSecClassGenericPassword,
          kSecAttrService as String: kcService, kSecAttrAccount as String: kcAccount]
@@ -1675,11 +1684,11 @@ final class MeshCrypto {
         return key
     }
 
-    private var pins: [String: Data] = (UserDefaults.standard.dictionary(forKey: "trinetPeerPins") as? [String: String] ?? [:])
+    private var pins: [String: Data] = (UserDefaults.standard.dictionary(forKey: MeshCrypto.pinsKey) as? [String: String] ?? [:])
         .compactMapValues { Data(base64Encoded: $0) }
     private func pin(_ ip: String, _ idPub: Data) {
         pins[ip] = idPub
-        UserDefaults.standard.set(pins.mapValues { $0.base64EncodedString() }, forKey: "trinetPeerPins")
+        UserDefaults.standard.set(pins.mapValues { $0.base64EncodedString() }, forKey: MeshCrypto.pinsKey)
     }
 
     static func safetyNumber(_ a: Data, _ b: Data) -> String {
@@ -1741,8 +1750,8 @@ final class MeshCrypto {
             return true
         }
         if let pinned = pins[peerIP], pinned != idPub {
-            mitmDetected = true
-            NSLog("TRINET: MITM — peer %@ identity CHANGED from the pinned key; session refused", peerIP)
+            if !mitmDetected { NSLog("TRINET: MITM — peer %@ identity CHANGED from the pinned key; session refused", peerIP) }
+            mitmDetected = true   // latch; subsequent impostor handshakes still refused, not re-logged
             return true
         }
         if pins[peerIP] == nil, !peerIP.isEmpty { pin(peerIP, idPub) }

phone/desktop/TriNetVideo/MeshCrypto.swift

@@ -80,7 +80,17 @@ final class MeshCrypto {
     // identity + peers' pins stay valid); (3) first run — generate + store. If the Keychain
     // is unavailable (unsigned build), fall back to UserDefaults so the app still works.
     static let kcService = "com.trinet.identity"
-    static let kcAccount = "device-ed25519"
+    // TRINET_KC_ACCOUNT / TRINET_PINS_KEY give the two-endpoint rig DISTINCT identities +
+    // pin stores per instance on one machine (so an over-the-wire MITM test is real). No-op
+    // in a shipping run.
+    static let kcAccount: String = {
+        if let s = ProcessInfo.processInfo.environment["TRINET_KC_ACCOUNT"], !s.isEmpty { return "device-ed25519-" + s }
+        return "device-ed25519"
+    }()
+    static let pinsKey: String = {
+        if let s = ProcessInfo.processInfo.environment["TRINET_PINS_KEY"], !s.isEmpty { return "trinetPeerPins-" + s }
+        return "trinetPeerPins"
+    }()
     private static func kcQuery() -> [String: Any] {
         [kSecClass as String: kSecClassGenericPassword,
          kSecAttrService as String: kcService, kSecAttrAccount as String: kcAccount]
@@ -114,11 +124,11 @@ final class MeshCrypto {
     }
 
     // Persisted TOFU pins: peer IP -> idPub. In-memory mirror for speed.
-    private var pins: [String: Data] = (UserDefaults.standard.dictionary(forKey: "trinetPeerPins") as? [String: String] ?? [:])
+    private var pins: [String: Data] = (UserDefaults.standard.dictionary(forKey: MeshCrypto.pinsKey) as? [String: String] ?? [:])
         .compactMapValues { Data(base64Encoded: $0) }
     private func pin(_ ip: String, _ idPub: Data) {
         pins[ip] = idPub
-        UserDefaults.standard.set(pins.mapValues { $0.base64EncodedString() }, forKey: "trinetPeerPins")
+        UserDefaults.standard.set(pins.mapValues { $0.base64EncodedString() }, forKey: MeshCrypto.pinsKey)
     }
 
     // Short digit string over BOTH identity keys (order-independent) for out-of-band checks.
@@ -191,8 +201,8 @@ final class MeshCrypto {
         }
         // TOFU: a different idPub at a peer we've pinned is a MITM. Refuse the session.
         if let pinned = pins[peerIP], pinned != idPub {
-            mitmDetected = true
-            NSLog("TRINET: MITM — peer %@ identity CHANGED from the pinned key; session refused", peerIP)
+            if !mitmDetected { NSLog("TRINET: MITM — peer %@ identity CHANGED from the pinned key; session refused", peerIP) }
+            mitmDetected = true   // latch; every subsequent impostor handshake is still refused, just not re-logged
             return true
         }
         if pins[peerIP] == nil, !peerIP.isEmpty { pin(peerIP, idPub) }   // trust on first use

smoke/two_endpoint_security.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# two_endpoint_security.sh — verify the identity/pinning security over REAL processes on
+# the two-endpoint rig. Single-process loopback can't test this: it self-pairs (safety
+# number over one identity, degenerate) and can't stage a MITM. Here each instance gets a
+# DISTINCT identity + pin store via TRINET_KC_ACCOUNT / TRINET_PINS_KEY.
+#
+#   Test 1  two honest peers (A,B) derive the SAME safety number, no false MITM.
+#   Test 2  A pins B, then an impostor M (different identity) answers at B's address ->
+#           A flags a MITM and refuses the session (no media from M).
+set -u
+APP=/Applications/TriNetMonitor.app
+clean() { for s in "$@"; do
+  security delete-generic-password -s com.trinet.identity -a "device-ed25519-$s" >/dev/null 2>&1
+  defaults delete com.trinet.monitor "trinetPeerPins-$s" >/dev/null 2>&1
+done; }
+launch() { # log listen autocall kc pins [extra-env...]
+  open -n --env TRINET_LOG="$1" --env TRINET_LISTEN="$2" --env TRINET_AUTOCALL="$3" \
+          --env TRINET_KC_ACCOUNT="$4" --env TRINET_PINS_KEY="$5" "$APP"; }
+wait_s() { local e=$(( $(date +%s) + $1 )); while [ "$(date +%s)" -lt "$e" ]; do sleep 3; done; }
+kill_all() { pkill -9 -f "TriNetMonitor.app/Contents/MacOS" 2>/dev/null; sleep 2; }
+
+kill_all; defaults delete com.trinet.monitor trinetRoom 2>/dev/null; clean A B M; rm -f /tmp/rig[ABM].log
+fail=0
+
+echo "== TEST 1: two honest peers derive the SAME safety number =="
+launch /tmp/rigA.log 8000 127.0.0.1:8100 A A; sleep 1
+launch /tmp/rigB.log 8100 127.0.0.1:8000 B B
+wait_s 18; kill_all
+SNA=$(grep -aoE "safety number [0-9]+" /tmp/rigA.log 2>/dev/null | tail -1 | grep -oE "[0-9]+")
+SNB=$(grep -aoE "safety number [0-9]+" /tmp/rigB.log 2>/dev/null | tail -1 | grep -oE "[0-9]+")
+echo "  A=$SNA  B=$SNB"
+if [ -n "${SNA:-}" ] && [ "$SNA" = "${SNB:-}" ]; then echo "  PASS (match)"; else echo "  FAIL"; fail=1; fi
+if [ "$(grep -aic MITM /tmp/rigA.log)" = 0 ] && [ "$(grep -aic MITM /tmp/rigB.log)" = 0 ]; then
+  echo "  PASS (no false MITM)"; else echo "  FAIL (false MITM)"; fail=1; fi
+
+echo "== TEST 2: an impostor identity at the pinned peer is flagged as MITM =="
+# A keeps its pin of B from Test 1; M is a fresh distinct identity at B's port.
+clean M; rm -f /tmp/rigA.log /tmp/rigM.log
+launch /tmp/rigA.log 8000 127.0.0.1:8100 A A; sleep 1
+launch /tmp/rigM.log 8100 127.0.0.1:8000 M M
+wait_s 16; kill_all
+MITM=$(grep -aic MITM /tmp/rigA.log 2>/dev/null); VID=$(grep -aic "FIRST FRAME DECODED" /tmp/rigA.log 2>/dev/null)
+echo "  A MITM-flagged=$MITM  video-from-M=$VID"
+if [ "${MITM:-0}" -ge 1 ] && [ "${VID:-0}" = 0 ]; then echo "  PASS (detected + refused)"; else echo "  FAIL"; fail=1; fi
+
+clean A B M
+echo; [ "$fail" = 0 ] && echo "ALL PASS" || echo "FAILURE(S)"
+exit $fail