feat: add packet authenticity policy schema

[RCGV1]

What does this PR do?

Adds the shared protocol contract for a device-enforced packet authenticity policy:

• Config.SecurityConfig.PacketSignaturePolicy with Compatible, Balanced, and Strict levels.
• packet_signature_policy = 9, with Balanced as the protobuf zero/default to preserve current behavior.
• DeviceMetadata.has_xeddsa = 14, allowing clients to expose the setting only when firmware can enforce it. Tag 13 is already claimed by Add Find Node buzzer admin protobufs #956.

Strict represents authenticated-only receive behavior: firmware may accept a verified XEdDSA packet or a successfully authenticated PKI packet. The implementation and client behavior are coordinated in design#121.

Closes #982.

Validation

• Buf 1.71.0 format, lint, and breaking checks.
• TypeScript generation and package build.
• Swift, Python, nanopb, and descriptor generation/default checks.
• KMP clean build (94 tasks) and final tag-14 generation check.

This is a draft while the dependent firmware and client implementations are reviewed. No hardware behavior changes are introduced by this schema-only PR.

Checklist before merging

• All top level messages commented
• All enum members have unique descriptions

Summary by CodeRabbit

• New Features
  • Added configurable packet signature policy options for remotely received mesh packets: Compatible, Balanced, and Strict modes.
  • Added a device capability flag indicating whether XEdDSA packet signature verification is available in the current firmware build.
• Chores
  • Reformatted protocol message and enum declarations for improved consistency without changing wire semantics.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds configurable remote packet signature policies, an XEdDSA verification capability flag, and formatting-only updates to interdevice protobuf declarations.

Changes

Packet Authentication Schema

Layer / File(s)	Summary
Packet signature policy configuration meshtastic/config.proto	Adds SecurityConfig.PacketSignaturePolicy with compatible, balanced, and strict modes, plus the packet_signature_policy field at tag 9.
XEdDSA capability metadata meshtastic/mesh.proto	Adds the read-only has_xeddsa capability field at tag 14 to DeviceMetadata.
Interdevice declaration formatting meshtastic/interdevice.proto	Normalizes spacing, alignment, and blank lines without changing field numbers, types, or enum values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• [2.8.0] Enforce configurable packet authenticity policy firmware#10963: Consumes the packet signature policy and XEdDSA capability for packet-authenticity enforcement.
• [PARENT] [ALIGNMENT]: Configurable packet authenticity policy design#121: Defines the protobuf schema and capability fields implemented here.
• [2.8.0] Configure packet authenticity policy web#1260: Uses the packet signature policy field for web-client controls.

Suggested reviewers: caveman99, vidplace7

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	[#982] The enum ordinals conflict with the issue: Compatible is zero/default instead of Balanced, so the wire contract does not match.	Change the enum to Balanced=0 and Compatible=1, keep field 9, and rerun the supported generation and compatibility checks.
Out of Scope Changes check	⚠️ Warning	The whitespace-only reformatting in meshtastic/interdevice.proto is unrelated to #982 and appears outside the schema change scope.	Remove or split the interdevice.proto formatting-only diff into a separate PR so this change stays focused on the packet policy schema.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately describes the main schema change.
Description check	✅ Passed	The description includes the required PR summary, related issue, validation, and checklist sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[RCGV1]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[RCGV1]

@coderabbitai review

[RCGV1]

Follow-up: after rebasing on current master, Buf formatting also touched meshtastic/interdevice.proto; that file change is whitespace-only and does not change schema semantics. The packet signature policy change is in meshtastic/config.proto: Compatible is now the zero/default value and Balanced is value 1.

[coderabbitai]

🧹 Nitpick comments (1)

meshtastic/config.proto (1)

1296-1318: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider adding a reference to design issue 121.

The PR objectives mention that the schema references design issue 121, which documents the dependent firmware and client work. Adding this reference directly to the protobuf comments can help future developers understand the context of these policies.

💡 Proposed comment update

     /*
      * Controls how the device authenticates remotely received mesh packets.
+     * Reference: Design issue 121
      */
     enum PacketSignaturePolicy {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@meshtastic/config.proto` around lines 1296 - 1318, Add a reference to design
issue 121 in the protobuf documentation comments for PacketSignaturePolicy,
preferably in the enum-level comment so it applies to all policy values.
Preserve the existing policy descriptions and formatting.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@meshtastic/config.proto`:
- Around line 1296-1318: Add a reference to design issue 121 in the protobuf
documentation comments for PacketSignaturePolicy, preferably in the enum-level
comment so it applies to all policy values. Preserve the existing policy
descriptions and formatting.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4b438c2a-ece3-4ae7-b800-35eef742b900

📥 Commits

Reviewing files that changed from the base of the PR and between 3c3de09 and 223e20e.

📒 Files selected for processing (3)

• meshtastic/config.proto
• meshtastic/interdevice.proto
• meshtastic/mesh.proto

🚧 Files skipped from review as they are similar to previous changes (1)

• meshtastic/mesh.proto