fix(nightly): repair WSS compat-auth skew + stale enterprise-gate test assertions (#381)

fix(nightly): repair real test-suite regressions + daemon WSS auth skew

The nightly suite has been red since it was created (2026-05-28) and never
green. Categorising every failure showed most were either real regressions
or CPU-starvation artifacts of -parallel 4, not genuine env limits.

Real fixes in this commit (all fail deterministically in isolation):

- daemon WSS compat auth: pkg/daemon/transport/wss signed the pre-v0.2.6
  challenge shape "compat_auth:<node>:<nonce>", but beacon v0.2.6 binds the
  server timestamp and verifies "compat_auth:<node>:<ts>:<nonce>". Real
  production skew — compat daemons could not authenticate to a v0.2.6
  beacon. Parse the challenge `ts` and sign the new shape; update the
  fake-beacon unit test to match. Fixes TestCompatRegistryTLSPinned,
  TestCompatRegistryTrustSystemRejectsBadCert, TestCompatDaemonDialUDPPeerThroughWSS.

- invite signer: common@v0.5.7's InviteToNetwork/RespondInvite/PollInvites
  now always sign, so every test issuing an invite must set a signer. Set
  the inviter's signer before each InviteToNetwork call across the invite,
  RBAC, audit, enterprise-gate, network and pilotctl suites. Several
  rejection-path tests were passing for the wrong reason (rejected on the
  missing signer, not the intended authz check) — they now sign so the
  registry performs the real authorization.

- TestAdminKicksAdmin: registry policy PILOT-266 (2026-05-29) forbids an
  admin kicking another admin; assert the guard and that the owner can
  still kick an admin.

- TestInviteRequiresAdmin: premise was stale (owner invites via signature
  without an admin token). Reworked to assert owner-by-signature succeeds
  and an unauthorized outsider is rejected.

- dashboard /api/stats is now admin-gated (rich payload behind
  requireAdminToken; anonymous uses /api/public-stats). Set an admin token
  and authenticate. Fixes TestDashboard{HTTPEndpoints,APIShape,BannerEndpoint,NoIPLeak}.

Co-authored-by: Teodor Calin <teodor@vulturelabs.io>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

pkg/daemon/transport/wss/wss.go

@@ -71,15 +71,16 @@ const DefaultRecvBuffer = 256
 // channel; everything after auth_ok is binary frames carrying raw
 // Pilot packets.
 type authChallengeMsg struct {
-	Type  string `json:"type"`  // "auth_challenge"
-	Nonce string `json:"nonce"` // 32 random bytes, hex-encoded
+	Type      string `json:"type"`  // "auth_challenge"
+	Nonce     string `json:"nonce"` // 32 random bytes, hex-encoded
+	Timestamp int64  `json:"ts"`    // Unix epoch seconds, server-issued (replay window)
 }
 
 type authReplyMsg struct {
 	Type      string `json:"type"` // "auth_reply"
 	NodeID    uint32 `json:"node_id"`
 	PublicKey string `json:"public_key"` // base64 Ed25519 pubkey
-	Sig       string `json:"sig"`        // base64 Ed25519 signature over "compat_auth:"+node_id+":"+nonce
+	Sig       string `json:"sig"`        // base64 Ed25519 signature over "compat_auth:"+node_id+":"+ts+":"+nonce
 }
 
 type authOKMsg struct {
@@ -274,10 +275,11 @@ func (t *Transport) runAuth(ctx context.Context, conn *websocket.Conn) error {
 		return fmt.Errorf("malformed challenge: type=%q nonce-len=%d", ch.Type, len(ch.Nonce))
 	}
 
-	// Sign "compat_auth:<nodeID>:<nonce>" — same shape the beacon
-	// verifies. Binding nodeID + nonce into the signed bytes prevents
-	// replay across different daemon identities.
-	msg := fmt.Sprintf("compat_auth:%d:%s", t.cfg.NodeID, ch.Nonce)
+	// Sign "compat_auth:<nodeID>:<ts>:<nonce>" — same shape the beacon
+	// verifies (beacon >= v0.2.6). Binding nodeID + server timestamp +
+	// nonce into the signed bytes prevents replay across identities and
+	// bounds the auth to the server's freshness window.
+	msg := fmt.Sprintf("compat_auth:%d:%d:%s", t.cfg.NodeID, ch.Timestamp, ch.Nonce)
 	sig := t.cfg.Identity.Sign([]byte(msg))
 
 	reply := authReplyMsg{

pkg/daemon/transport/wss/zz_wss_test.go

@@ -106,9 +106,11 @@ func (fb *fakeBeacon) handle(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
 
-	// Send auth challenge with a fixed nonce so we can assert on it.
+	// Send auth challenge with a fixed nonce + timestamp so we can assert
+	// on the signed payload (beacon >= v0.2.6 binds ts into the signature).
 	nonce := "deadbeef12345678deadbeef12345678"
-	ch := map[string]string{"type": "auth_challenge", "nonce": nonce}
+	const ts int64 = 1700000000
+	ch := map[string]interface{}{"type": "auth_challenge", "nonce": nonce, "ts": ts}
 	chBytes, _ := json.Marshal(ch)
 	if err := conn.Write(ctx, websocket.MessageText, chBytes); err != nil {
 		fb.t.Logf("fake beacon: write challenge: %v", err)
@@ -154,7 +156,7 @@ func (fb *fakeBeacon) handle(w http.ResponseWriter, r *http.Request) {
 		conn.Close(websocket.StatusPolicyViolation, "bad sig b64")
 		return
 	}
-	signed := fmt.Sprintf("compat_auth:%d:%s", reply.NodeID, nonce)
+	signed := fmt.Sprintf("compat_auth:%d:%d:%s", reply.NodeID, ts, nonce)
 	if !ed25519.Verify(ed25519.PublicKey(pubBytes), []byte(signed), sigBytes) {
 		conn.Close(websocket.StatusPolicyViolation, "sig verify failed")
 		return

tests/zz_audit_test.go

@@ -361,7 +361,7 @@ func TestAuditInviteActions(t *testing.T) {
 	}
 	defer rc.Close()
 
-	creatorID, _ := registerTestNode(t, rc)
+	creatorID, creatorIdentity := registerTestNode(t, rc)
 	resp, err := rc.CreateNetwork(creatorID, "audit-invite-net", "invite", "", TestAdminToken, true)
 	if err != nil {
 		t.Fatalf("create network: %v", err)
@@ -370,6 +370,8 @@ func TestAuditInviteActions(t *testing.T) {
 
 	targetID, targetIdentity := registerTestNode(t, rc)
 
+	// InviteToNetwork always signs (common@v0.5.7); sign as the inviter.
+	setClientSigner(rc, creatorIdentity)
 	_, err = rc.InviteToNetwork(netID, creatorID, targetID, TestAdminToken)
 	if err != nil {
 		t.Fatalf("invite: %v", err)

tests/zz_dashboard_test.go

@@ -81,6 +81,10 @@ func TestDashboardHTTPEndpoints(t *testing.T) {
 
 	r := registry.New("127.0.0.1:9001")
 	defer r.Close()
+	// /api/stats is admin-gated (rich payload moved behind requireAdminToken;
+	// anonymous callers use /api/public-stats). Authenticate as an operator.
+	const adminToken = "dash-http-admin-token"
+	r.SetAdminToken(adminToken)
 
 	// Find a free port for the dashboard
 	ln, err := net.Listen("tcp", "127.0.0.1:0")
@@ -96,8 +100,9 @@ func TestDashboardHTTPEndpoints(t *testing.T) {
 	var client http.Client
 	client.Timeout = 2 * time.Second
 	var resp *http.Response
+	statsURL := fmt.Sprintf("http://%s/api/stats?admin_token=%s", dashAddr, adminToken)
 	for i := 0; i < 20; i++ {
-		resp, err = client.Get(fmt.Sprintf("http://%s/api/stats", dashAddr))
+		resp, err = client.Get(statsURL)
 		if err == nil {
 			break
 		}
@@ -163,6 +168,9 @@ func TestDashboardNoIPLeak(t *testing.T) {
 	go r.ListenAndServe("127.0.0.1:0")
 	<-r.Ready()
 	defer r.Close()
+	// /api/stats is admin-gated; authenticate as an operator.
+	const adminToken = "dash-leak-admin-token"
+	r.SetAdminToken(adminToken)
 
 	addr := r.Addr().String()
 	dashRegisterNode(t, addr, "leak-test")
@@ -180,8 +188,9 @@ func TestDashboardNoIPLeak(t *testing.T) {
 	var client http.Client
 	client.Timeout = 2 * time.Second
 	var resp *http.Response
+	statsURL := fmt.Sprintf("http://%s/api/stats?admin_token=%s", dashAddr, adminToken)
 	for i := 0; i < 20; i++ {
-		resp, err = client.Get(fmt.Sprintf("http://%s/api/stats", dashAddr))
+		resp, err = client.Get(statsURL)
 		if err == nil {
 			break
 		}
@@ -219,6 +228,11 @@ func TestDashboardAPIShape(t *testing.T) {
 	defer r.Close()
 
 	r.SetDashboardToken("shape-test-token")
+	// /api/stats is admin-gated; operators reach it with the admin token.
+	// The dashboard `token` param still toggles per-network (authenticated)
+	// fields on top of the admin gate.
+	const adminToken = "shape-admin-token"
+	r.SetAdminToken(adminToken)
 
 	ln, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
@@ -234,9 +248,9 @@ func TestDashboardAPIShape(t *testing.T) {
 
 	fetch := func(token string) map[string]interface{} {
 		t.Helper()
-		url := fmt.Sprintf("http://%s/api/stats", dashAddr)
+		url := fmt.Sprintf("http://%s/api/stats?admin_token=%s", dashAddr, adminToken)
 		if token != "" {
-			url += "?token=" + token
+			url += "&token=" + token
 		}
 		var resp *http.Response
 		for i := 0; i < 20; i++ {
@@ -404,9 +418,9 @@ func TestDashboardBannerEndpoint(t *testing.T) {
 		t.Fatalf("GET banner = %q, want %q", getResp.Banner, newBanner)
 	}
 
-	// 6. The new banner must surface in the public /api/stats payload so
-	//    the dashboard HTML renders it.
-	statsResp, err := client.Get(fmt.Sprintf("http://%s/api/stats", dashAddr))
+	// 6. The new banner must surface in the /api/stats payload so the
+	//    dashboard HTML renders it (admin-gated; authenticate as operator).
+	statsResp, err := client.Get(fmt.Sprintf("http://%s/api/stats?admin_token=%s", dashAddr, adminToken))
 	if err != nil {
 		t.Fatalf("GET stats: %v", err)
 	}

tests/zz_enterprise_gate_test.go

@@ -147,7 +147,7 @@ func TestEnterpriseGateInvite(t *testing.T) {
 	rc, _, cleanup := startTestRegistryWithAdmin(t)
 	defer cleanup()
 
-	ownerID, _ := registerTestNode(t, rc)
+	ownerID, ownerIdentity := registerTestNode(t, rc)
 	targetID, _ := registerTestNode(t, rc)
 
 	// Create an enterprise invite-only network (only way to get invite rule)
@@ -157,7 +157,9 @@ func TestEnterpriseGateInvite(t *testing.T) {
 	}
 	netID := uint16(resp["network_id"].(float64))
 
-	// This should succeed (enterprise network)
+	// This should succeed (enterprise network). InviteToNetwork always signs
+	// (common@v0.5.7); sign as the owner/inviter.
+	setClientSigner(rc, ownerIdentity)
 	_, err = rc.InviteToNetwork(netID, ownerID, targetID, TestAdminToken)
 	if err != nil {
 		t.Fatalf("invite on enterprise network should succeed: %v", err)
@@ -638,7 +640,7 @@ func TestDeleteNetworkCleansInvites(t *testing.T) {
 	rc, _, cleanup := startTestRegistryWithAdmin(t)
 	defer cleanup()
 
-	owner, _ := registerTestNode(t, rc)
+	owner, ownerIdentity := registerTestNode(t, rc)
 	target, targetID := registerTestNode(t, rc)
 
 	// Create invite-only enterprise network
@@ -648,7 +650,9 @@ func TestDeleteNetworkCleansInvites(t *testing.T) {
 	}
 	netID := uint16(resp["network_id"].(float64))
 
-	// Send invite to target
+	// Send invite to target. InviteToNetwork always signs (common@v0.5.7);
+	// sign as the owner/inviter.
+	setClientSigner(rc, ownerIdentity)
 	if _, err := rc.InviteToNetwork(netID, owner, target, TestAdminToken); err != nil {
 		t.Fatalf("invite: %v", err)
 	}
@@ -1824,7 +1828,10 @@ func TestAuditEnrichedTagsAndPolicy(t *testing.T) {
 	}
 }
 
-// TestAdminKicksAdmin verifies that an admin can kick another admin.
+// TestAdminKicksAdmin verifies the admin-kick privilege policy: an admin
+// may NOT kick another admin (privilege-escalation guard, PILOT-266), but
+// the owner may kick an admin. Admins may still be blocked from kicking the
+// owner.
 func TestAdminKicksAdmin(t *testing.T) {
 	t.Parallel()
 	env := NewTestEnv(t)
@@ -1897,13 +1904,26 @@ func TestAdminKicksAdmin(t *testing.T) {
 		t.Fatalf("promote admin2: %v", err)
 	}
 
-	// Admin1 kicks Admin2 (admin kicking admin — should succeed)
+	// Admin1 kicks Admin2 (admin kicking admin — must be REJECTED by the
+	// privilege-escalation guard added in PILOT-266).
 	setClientSigner(rc, admin1Identity)
 	_, err = rc.KickMember(netID, admin1ID, admin2ID, TestAdminToken)
+	if err == nil {
+		t.Fatal("expected error: an admin must not be able to kick another admin")
+	}
+	if !strings.Contains(err.Error(), "admins cannot kick other admins") {
+		t.Fatalf("expected 'admins cannot kick other admins' error, got: %v", err)
+	}
+	t.Logf("admin correctly blocked from kicking another admin: %v", err)
+
+	// Owner kicks Admin2 (owner kicking admin — should succeed). This keeps
+	// the successful-kick code path under test.
+	setClientSigner(rc, ownerIdentity)
+	_, err = rc.KickMember(netID, ownerID, admin2ID, TestAdminToken)
 	if err != nil {
-		t.Fatalf("admin1 kick admin2: %v", err)
+		t.Fatalf("owner kick admin2: %v", err)
 	}
-	t.Log("admin successfully kicked another admin")
+	t.Log("owner successfully kicked an admin")
 
 	// Verify admin2 is no longer in the network
 	resp, err = rc.ListNodes(netID, TestAdminToken)
@@ -1919,6 +1939,7 @@ func TestAdminKicksAdmin(t *testing.T) {
 	}
 
 	// Admin cannot kick owner
+	setClientSigner(rc, admin1Identity)
 	_, err = rc.KickMember(netID, admin1ID, ownerID, TestAdminToken)
 	if err == nil {
 		t.Fatal("expected error kicking owner")