Jannis Braun abdaf99bb4 fix(federation): address code review findings for FED-011 ...

- Fix race window: store pendingHmacSecret AFTER remote peer confirms,
  not before (admin endpoint + auto-rotation worker)
- Add hex validation on newSecret at /peer/rotate endpoint
- Use pending-secret-aware signing in initial sync worker
- Add test for corrupt state (pendingHmacSecret set, secretRotationAt null)

2026-03-31 21:01:02 +02:00

..

desktop

chore: sync repo with deployed state — clean up old specs/plans, desktop tweaks

2026-03-24 04:33:23 +01:00

server

fix(federation): address code review findings for FED-011

2026-03-31 21:01:02 +02:00

shared

fix(federation): add strict origin enforcement for user attribution (FED-010)

2026-03-31 19:16:48 +02:00

web

chore: add system docs, specs, and misc updates from other sessions

2026-03-31 03:40:34 +02:00