F21-CJ: Yes
Rationale
In the selected native cjdns application path, SessionManager drops failed decryptions and builds received RouteHeader identity from the final CryptoAuth session. UpperDistributor passes native IP payloads to TUNAdapter, which reconstructs the IPv6 source from that session-derived address. UDP receive metadata therefore exposes a checked cryptographic node identifier without application authentication; this is not merely outer-neighbor authentication.
Assessment method
Documentary/code analysis
Source context
Primary specification and receiving implementation
Outstanding qualification
Documentary/code trace at f5902acab6dd2f1a68bf6e4c89e352ed71f93698. Execute invalid ciphertext, wrong key/address, session expiry/rekey and socket provenance tests. Restrict credit to applications on the final native node; imported IP tunnels, custom handlers, local packet injection and delegated endpoints require separate trust analysis. The node address does not identify a particular process or human.