Participant Relationship Protocol

Back to matrix

C04-PI: Yes

Rationale

The selected known-identity PRP composition includes a credential-gated handshake defense. In pinned kernel source, hs2_observe_scoped first verifies the HS2 cryptographic proof and then matches the derived strong identity against an unexpired expected identity for the context/scope/alias before allocating negotiation state. A different identity returns EKEYREJECTED; the carrier-bootstrap fallback applies to ENOKEY, not a mismatch against an existing expectation. The inspected rejection path reports through local generic netlink, not a carrier response. For an already protected adjacency, authentication failure returns before public-control parsing. Credit the existence of this bounded defense, consistently with C04 cells that retain documented admission exceptions.

Assessment method

Source-level evidence of a bounded defense; prior local admission experiment retained with explicit limits

Source context

Pinned prp-linux-kmod d90a712c6d36111de66bcdd7be8e0f462bf539ae: handshake proof, expected-identity admission, local rejection diagnostics and RX dispatch

Outstanding qualification

Requires a valid expected-identity binding in the already selected known-identity mode. This is not silence for every probe or every endpoint state. Missing/expired identity expectations may allow identity learning on valid carrier-bootstrap contexts; the public PoW challenge can remain recognizable before requester authentication, as the previous local harness demonstrated with TX stubbed. Locator/context matching is not itself cryptographic authentication. No network/timing/replay-resistance experiment, constant-time claim, universal camouflage, DoS immunity or whole-stack certification. Any runtime controller reactions and carrier-driver replies remain outside this source-level witness. Criterion and profiles unchanged.

Public sources

Editorial evidence references

The following identifiers refer to research records not included in this public package; they are not public links.