Bind Noise sessions to claimed peer identities

2026-07-24 22:25:19 +00:00 · 2026-07-12 11:09:01 -04:00
parent b7f0b33d3a
commit 338c487ef9
21 changed files with 1257 additions and 244 deletions
@@ -7,6 +7,7 @@ import android.util.Log
 import androidx.security.crypto.EncryptedSharedPreferences
 import androidx.security.crypto.MasterKey
 import com.bitchat.android.noise.NoiseEncryptionService
+import com.bitchat.android.noise.NoiseHandshakeProcessingResult
 import org.bouncycastle.crypto.AsymmetricCipherKeyPair
 import org.bouncycastle.crypto.generators.Ed25519KeyPairGenerator
 import org.bouncycastle.crypto.params.Ed25519KeyGenerationParameters
@@ -277,11 +278,24 @@ open class EncryptionService(private val context: Context) {
        Log.d(TAG, "🤝 Processing handshake message from $peerID")
        return noiseService.processHandshakeMessage(data, peerID)
    }
+
+    /**
+     * Process one Noise handshake frame while preserving whether this exact call authenticated a
+     * new session. Unlike the response-only compatibility API, binding failures are propagated.
+     */
+    @Throws(Exception::class)
+    open fun processHandshakeMessageWithResult(
+        data: ByteArray,
+        peerID: String
+    ): NoiseHandshakeProcessingResult {
+        Log.d(TAG, "🤝 Processing typed handshake message from $peerID")
+        return noiseService.processHandshakeMessageWithResult(data, peerID)
+    }
    
    /**
     * Remove a peer session (called when peer disconnects)
     */
-    fun removePeer(peerID: String) {
+    open fun removePeer(peerID: String) {
        establishedSessions.remove(peerID)
        noiseService.removePeer(peerID)
        onSessionLost?.invoke(peerID)
@@ -0,0 +1,37 @@
+package com.bitchat.android.mesh
+
+import com.bitchat.android.model.IdentityAnnouncement
+import com.bitchat.android.noise.NoisePeerIdentity
+import com.bitchat.android.protocol.BitchatPacket
+import com.bitchat.android.protocol.MessageType
+import com.bitchat.android.util.toHexString
+
+/** Canonical, side-effect-free preflight for a self-signed mesh announcement. */
+object AnnouncementIdentityValidator {
+    private const val MAX_CLOCK_SKEW_MS = 10 * 60 * 1_000L
+
+    fun verify(
+        packet: BitchatPacket,
+        claimedPeerID: String,
+        nowMs: Long = System.currentTimeMillis(),
+        verifyEd25519: (signature: ByteArray, data: ByteArray, publicKey: ByteArray) -> Boolean
+    ): IdentityAnnouncement? {
+        if (packet.type != MessageType.ANNOUNCE.value) return null
+        val now = nowMs.coerceAtLeast(0).toULong()
+        val skew = if (packet.timestamp >= now) packet.timestamp - now else now - packet.timestamp
+        if (skew > MAX_CLOCK_SKEW_MS.toULong()) return null
+        val announcement = IdentityAnnouncement.decode(packet.payload) ?: return null
+        if (announcement.signingPublicKey.size != 32) return null
+
+        val derivedPeerID = NoisePeerIdentity.derivePeerID(announcement.noisePublicKey) ?: return null
+        if (packet.senderID.toHexString() != derivedPeerID || claimedPeerID != derivedPeerID) return null
+
+        val signature = packet.signature ?: return null
+        val canonicalData = packet.toBinaryDataForSigning() ?: return null
+        return if (verifyEd25519(signature, canonicalData, announcement.signingPublicKey)) {
+            announcement
+        } else {
+            null
+        }
+    }
+}
@@ -217,7 +217,12 @@ class BluetoothMeshService(private val context: Context) : TransportBridgeServic
        
        // SecurityManager delegate for key exchange notifications
        securityManager.delegate = object : SecurityManagerDelegate {
-            override fun onKeyExchangeCompleted(peerID: String, peerPublicKeyData: ByteArray) {
+            override fun onKeyExchangeCompleted(
+                peerID: String,
+                authenticatedRemoteStaticKey: ByteArray,
+                directRelayAddress: String?,
+                ingressLinkID: String?
+            ) {
                // Send announcement and cached messages after key exchange
                serviceScope.launch {
                    Log.d(TAG, "Key exchange completed with $peerID; sending follow-ups")
@@ -376,31 +381,6 @@ class BluetoothMeshService(private val context: Context) : TransportBridgeServic
                }
            }
            
-            override fun updatePeerIDBinding(newPeerID: String, nickname: String,
-                                           publicKey: ByteArray, previousPeerID: String?) {
-
-                Log.d(TAG, "Updating peer ID binding: $newPeerID (was: $previousPeerID) with nickname: $nickname and public key: ${publicKey.toHexString().take(16)}...")
-                // Update peer mapping in the PeerManager for peer ID rotation support
-                peerManager.addOrUpdatePeer(newPeerID, nickname)
-                
-                // Store fingerprint for the peer via centralized fingerprint manager
-                val fingerprint = peerManager.storeFingerprintForPeer(newPeerID, publicKey)
-
-                // Index existing Nostr mapping by the new peerID if we have it
-                try {
-                    com.bitchat.android.favorites.FavoritesPersistenceService.shared.findNostrPubkey(publicKey)?.let { npub ->
-                        com.bitchat.android.favorites.FavoritesPersistenceService.shared.updateNostrPublicKeyForPeerID(newPeerID, npub)
-                    }
-                } catch (_: Exception) { }
-                
-                // If there was a previous peer ID, remove it to avoid duplicates
-                previousPeerID?.let { oldPeerID ->
-                    peerManager.removePeer(oldPeerID)
-                }
-                
-                Log.d(TAG, "Updated peer ID binding: $newPeerID (was: $previousPeerID), fingerprint: ${fingerprint.take(16)}...")
-            }
-            
            // Message operations  
            override fun decryptChannelMessage(encryptedContent: ByteArray, channel: String): String? {
                return delegate?.decryptChannelMessage(encryptedContent, channel)
@@ -492,35 +472,25 @@ class BluetoothMeshService(private val context: Context) : TransportBridgeServic
                serviceScope.launch { messageHandler.handleNoiseEncrypted(routed) }
            }
            
-            override fun handleAnnounce(routed: RoutedPacket) {
-                serviceScope.launch {
-                    // Process the announce
-                    val isFirst = messageHandler.handleAnnounce(routed)
+            override suspend fun handleAnnounce(routed: RoutedPacket): Boolean {
+                val result = messageHandler.handleAnnounceWithResult(routed)
+                if (result !is AnnounceHandlingResult.Accepted) return false

-                    // Map device address -> peerID based on TTL (max TTL = direct neighbor)
-                    // Matches iOS logic: any announce with max TTL on a link defines the direct peer
-                    val deviceAddress = routed.relayAddress
-                    val pid = routed.peerID
-                    if (deviceAddress != null && pid != null) {
-                        // Check if this is a direct connection (MAX TTL)
-                        // Note: packet.ttl is UByte, compare with AppConstants.MESSAGE_TTL_HOPS
-                        val isDirect = routed.packet.ttl == com.bitchat.android.util.AppConstants.MESSAGE_TTL_HOPS
-                        
-                        if (isDirect) {
-                            // Bind or rebind this device address to the announcing peer
-                            connectionManager.addressPeerMap[deviceAddress] = pid
-                            Log.d(TAG, "Mapped device $deviceAddress to peer $pid (TTL=${routed.packet.ttl})")
-
-                            // Mark as directly connected - refresh UI state
-                            try { peerManager.refreshPeerList() } catch (_: Exception) { }
-
-                            // Initial sync for this direct peer
-                            try { gossipSyncManager.scheduleInitialSyncToPeer(pid, 1_000) } catch (_: Exception) { }
-                        }
+                // Map device address -> peerID only after identity binding, signature, freshness,
+                // and peer replacement policy have all accepted the announce.
+                val deviceAddress = routed.relayAddress
+                val pid = routed.peerID
+                if (deviceAddress != null && pid != null) {
+                    val isDirect = routed.packet.ttl == com.bitchat.android.util.AppConstants.MESSAGE_TTL_HOPS
+                    if (isDirect) {
+                        connectionManager.addressPeerMap[deviceAddress] = pid
+                        Log.d(TAG, "Mapped device $deviceAddress to peer $pid (TTL=${routed.packet.ttl})")
+                        try { peerManager.refreshPeerList() } catch (_: Exception) { }
+                        try { gossipSyncManager.scheduleInitialSyncToPeer(pid, 1_000) } catch (_: Exception) { }
                    }
-                    // Track for sync
-                    try { gossipSyncManager.onPublicPacketSeen(routed.packet) } catch (_: Exception) { }
                }
+                try { gossipSyncManager.onPublicPacketSeen(routed.packet) } catch (_: Exception) { }
+                return true
            }
            
            override fun handleMessage(routed: RoutedPacket) {
@@ -41,8 +41,8 @@ class MeshCore(
 ) {
    data class Hooks(
        val onMessageReceived: ((BitchatMessage) -> Unit)? = null,
-        val onPeerIdBindingUpdated: ((String, String, ByteArray, String?) -> Unit)? = null,
        val onAnnounceProcessed: ((RoutedPacket, Boolean) -> Unit)? = null,
+        val onDirectNoiseAuthenticated: ((String, String, String, ByteArray) -> Unit)? = null,
        val readReceiptInterceptor: ((String, String) -> Boolean)? = null,
        val onReadReceiptSent: ((String) -> Unit)? = null,
        val announcementNicknameProvider: (() -> String?)? = null,
@@ -117,8 +117,20 @@ class MeshCore(
        packetProcessor.shutdown()
    }

-    fun processIncoming(packet: BitchatPacket, peerID: String?, relayAddress: String?) {
-        packetProcessor.processPacket(RoutedPacket(packet, peerID, relayAddress))
+    fun processIncoming(
+        packet: BitchatPacket,
+        peerID: String?,
+        relayAddress: String?,
+        ingressLinkID: String? = null
+    ) {
+        packetProcessor.processPacket(
+            RoutedPacket(
+                packet = packet,
+                peerID = peerID,
+                relayAddress = relayAddress,
+                ingressLinkID = ingressLinkID
+            )
+        )
    }

    fun sendFromBridge(packet: RoutedPacket) {
@@ -157,7 +169,20 @@ class MeshCore(
        }

        securityManager.delegate = object : SecurityManagerDelegate {
-            override fun onKeyExchangeCompleted(peerID: String, peerPublicKeyData: ByteArray) {
+            override fun onKeyExchangeCompleted(
+                peerID: String,
+                authenticatedRemoteStaticKey: ByteArray,
+                directRelayAddress: String?,
+                ingressLinkID: String?
+            ) {
+                if (directRelayAddress != null && ingressLinkID != null) {
+                    hooks.onDirectNoiseAuthenticated?.invoke(
+                        peerID,
+                        directRelayAddress,
+                        ingressLinkID,
+                        authenticatedRemoteStaticKey
+                    )
+                }
                scope.launch {
                    delay(100)
                    sendAnnouncementToPeer(peerID)
@@ -280,19 +305,6 @@ class MeshCore(
                }
            }

-            override fun updatePeerIDBinding(
-                newPeerID: String,
-                nickname: String,
-                publicKey: ByteArray,
-                previousPeerID: String?
-            ) {
-                peerManager.addOrUpdatePeer(newPeerID, nickname)
-                val fingerprint = peerManager.storeFingerprintForPeer(newPeerID, publicKey)
-                previousPeerID?.let { peerManager.removePeer(it) }
-                Log.d("MeshCore", "Updated peer ID binding: $newPeerID fp=${fingerprint.take(16)}")
-                hooks.onPeerIdBindingUpdated?.invoke(newPeerID, nickname, publicKey, previousPeerID)
-            }
-
            override fun decryptChannelMessage(encryptedContent: ByteArray, channel: String): String? {
                return delegate?.decryptChannelMessage(encryptedContent, channel)
            }
@@ -352,12 +364,12 @@ class MeshCore(
                scope.launch { messageHandler.handleNoiseEncrypted(routed) }
            }

-            override fun handleAnnounce(routed: RoutedPacket) {
-                scope.launch {
-                    val isFirst = messageHandler.handleAnnounce(routed)
-                    hooks.onAnnounceProcessed?.invoke(routed, isFirst)
-                    try { gossipSyncManager.onPublicPacketSeen(routed.packet) } catch (_: Exception) { }
-                }
+            override suspend fun handleAnnounce(routed: RoutedPacket): Boolean {
+                val result = messageHandler.handleAnnounceWithResult(routed)
+                if (result !is AnnounceHandlingResult.Accepted) return false
+                hooks.onAnnounceProcessed?.invoke(routed, result.isFirst)
+                try { gossipSyncManager.onPublicPacketSeen(routed.packet) } catch (_: Exception) { }
+                return true
            }

            override fun handleMessage(routed: RoutedPacket) {
@@ -3,7 +3,6 @@ package com.bitchat.android.mesh
 import android.util.Log
 import com.bitchat.android.model.BitchatMessage
 import com.bitchat.android.model.BitchatMessageType
-import com.bitchat.android.model.IdentityAnnouncement
 import com.bitchat.android.model.RoutedPacket
 import com.bitchat.android.protocol.BitchatPacket
 import com.bitchat.android.protocol.MessageType
@@ -13,6 +12,11 @@ import kotlinx.coroutines.*
 import java.util.*
 import kotlin.random.Random

+sealed class AnnounceHandlingResult {
+    data class Accepted(val isFirst: Boolean) : AnnounceHandlingResult()
+    object Rejected : AnnounceHandlingResult()
+}
+
 /**
 * Handles processing of different message types
 * Extracted from BluetoothMeshService for better separation of concerns
@@ -216,10 +220,14 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
     * Handle announce message with TLV decoding and signature verification - exactly like iOS
     */
    suspend fun handleAnnounce(routed: RoutedPacket): Boolean {
+        return (handleAnnounceWithResult(routed) as? AnnounceHandlingResult.Accepted)?.isFirst ?: false
+    }
+
+    suspend fun handleAnnounceWithResult(routed: RoutedPacket): AnnounceHandlingResult {
        val packet = routed.packet
        val peerID = routed.peerID ?: "unknown"

-        if (peerID == myPeerID) return false
+        if (peerID == myPeerID) return AnnounceHandlingResult.Rejected

        // Peers use wall-clock packet timestamps; tolerate moderate device clock skew
        // during identity learning, or later signed messages cannot be verified.
@@ -227,28 +235,21 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
        val clockSkewMs = kotlin.math.abs(now - packet.timestamp.toLong())
        if (clockSkewMs > ANNOUNCE_CLOCK_SKEW_TOLERANCE_MS) {
            Log.w(TAG, "Ignoring ANNOUNCE from ${peerID.take(8)} with excessive clock skew (${clockSkewMs}ms > ${ANNOUNCE_CLOCK_SKEW_TOLERANCE_MS}ms)")
-            return false
+            return AnnounceHandlingResult.Rejected
        } else if (clockSkewMs > com.bitchat.android.util.AppConstants.Mesh.STALE_PEER_TIMEOUT_MS) {
            Log.w(TAG, "Accepting ANNOUNCE from ${peerID.take(8)} within clock skew tolerance (${clockSkewMs}ms)")
        }
        
-        // Try to decode as iOS-compatible IdentityAnnouncement with TLV format
-        val announcement = IdentityAnnouncement.decode(packet.payload)
+        val announcement = AnnouncementIdentityValidator.verify(packet, peerID) { signature, data, key ->
+            delegate?.verifyEd25519Signature(signature, data, key) ?: false
+        }
        if (announcement == null) {
-            Log.w(TAG, "Failed to decode announce from $peerID as iOS-compatible TLV format")
-            return false
-        }
-        
-        // Verify packet signature using the announced signing public key
-        var verified = false
-        if (packet.signature != null) {
-            // Verify that the packet was signed by the signing private key corresponding to the announced signing public key
-            verified = delegate?.verifyEd25519Signature(packet.signature!!, packet.toBinaryDataForSigning()!!, announcement.signingPublicKey) ?: false
-            if (!verified) {
-                Log.w(TAG, "⚠️ Signature verification for announce failed ${peerID.take(8)}")
-            }
+            Log.w(TAG, "Rejecting malformed, unbound, or invalidly signed ANNOUNCE from ${peerID.take(8)}")
+            return AnnounceHandlingResult.Rejected
        }

+        var verified = true
+
        // Check for existing peer with different noise public key
        // If existing peer has a different noise public key, do not consider this verified
        val existingPeer = delegate?.getPeerInfo(peerID)
@@ -258,10 +259,21 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
            verified = false
        }

+        if (
+            existingPeer?.signingPublicKey != null &&
+            !existingPeer.signingPublicKey!!.contentEquals(announcement.signingPublicKey)
+        ) {
+            Log.w(
+                TAG,
+                "Rejecting signing-key replacement for ${peerID.take(8)} without authenticated peer-state proof"
+            )
+            verified = false
+        }
+
        // Require verified announce; ignore otherwise (no backward compatibility)
        if (!verified) {
            Log.w(TAG, "❌ Ignoring unverified announce from ${peerID.take(8)}...")
-            return false
+            return AnnounceHandlingResult.Rejected
        }
        
        // Successfully decoded TLV format exactly like iOS
@@ -283,14 +295,6 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
            isVerified = true
        ) ?: false

-        // Update peer ID binding with noise public key for identity management
-        delegate?.updatePeerIDBinding(
-            newPeerID = peerID,
-            nickname = nickname,
-            publicKey = noisePublicKey,
-            previousPeerID = null
-        )
-        
        // Update mesh graph from gossip neighbors (only if TLV present)
        try {
            val neighborsOrNull = com.bitchat.android.services.meshgraph.GossipTLV.decodeNeighborsFromAnnouncementPayload(packet.payload)
@@ -299,7 +303,7 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
        } catch (_: Exception) { }

        Log.d(TAG, "✅ Processed verified TLV announce: stored identity for $peerID")
-        return isFirstAnnounce
+        return AnnounceHandlingResult.Accepted(isFirstAnnounce)
    }
    
    /**
@@ -621,8 +625,6 @@ interface MessageHandlerDelegate {
    fun hasNoiseSession(peerID: String): Boolean
    fun initiateNoiseHandshake(peerID: String)
    fun processNoiseHandshakeMessage(payload: ByteArray, peerID: String): ByteArray?
-    fun updatePeerIDBinding(newPeerID: String, nickname: String,
-                           publicKey: ByteArray, previousPeerID: String?)
    
    // Message operations
    fun decryptChannelMessage(encryptedContent: ByteArray, channel: String): String?
@@ -143,7 +143,7 @@ class PacketProcessor(private val myPeerID: String) {
        
        // Handle public packet types (no address check needed)
        when (messageType) {
-            MessageType.ANNOUNCE -> handleAnnounce(routed)
+            MessageType.ANNOUNCE -> validPacket = handleAnnounce(routed)
            MessageType.MESSAGE -> handleMessage(routed)
            MessageType.FILE_TRANSFER -> handleMessage(routed) // treat same routing path; parsing happens in handler
            MessageType.LEAVE -> handleLeave(routed)
@@ -197,10 +197,10 @@ class PacketProcessor(private val myPeerID: String) {
    /**
     * Handle announce message
     */
-    private suspend fun handleAnnounce(routed: RoutedPacket) {
+    private suspend fun handleAnnounce(routed: RoutedPacket): Boolean {
        val peerID = routed.peerID ?: "unknown"
        Log.d(TAG, "Processing announce from ${formatPeerForLog(peerID)}")
-        delegate?.handleAnnounce(routed)
+        return delegate?.handleAnnounce(routed) ?: false
    }
    
    /**
@@ -231,7 +231,14 @@ class PacketProcessor(private val myPeerID: String) {
        val reassembledPacket = delegate?.handleFragment(routed.packet)
        if (reassembledPacket != null) {
            Log.d(TAG, "Fragment reassembled, processing complete message")
-            handleReceivedPacket(RoutedPacket(reassembledPacket, routed.peerID, routed.relayAddress))
+            handleReceivedPacket(
+                RoutedPacket(
+                    packet = reassembledPacket,
+                    peerID = routed.peerID,
+                    relayAddress = routed.relayAddress,
+                    ingressLinkID = routed.ingressLinkID
+                )
+            )
        }
        
        // Fragment relay is now handled by centralized PacketRelayManager
@@ -314,7 +321,7 @@ interface PacketProcessorDelegate {
    // Message type handlers
    fun handleNoiseHandshake(routed: RoutedPacket): Boolean
    fun handleNoiseEncrypted(routed: RoutedPacket)
-    fun handleAnnounce(routed: RoutedPacket)
+    suspend fun handleAnnounce(routed: RoutedPacket): Boolean
    fun handleMessage(routed: RoutedPacket)
    fun handleLeave(routed: RoutedPacket)
    fun handleFragment(packet: BitchatPacket): BitchatPacket?
@@ -102,19 +102,6 @@ class SecurityManager(private val encryptionService: EncryptionService, private
        // Skip our own handshake messages
        if (peerID == myPeerID) return false

-        // If we already have an established session but the peer is initiating a new handshake,
-        // drop the existing session so we can re-establish cleanly.
-        var forcedRehandshake = false
-        if (encryptionService.hasEstablishedSession(peerID)) {
-            Log.d(TAG, "Received new Noise handshake from $peerID with an existing session. Dropping old session to re-handshake.")
-            try {
-                encryptionService.removePeer(peerID)
-                forcedRehandshake = true
-            } catch (e: Exception) {
-                Log.w(TAG, "Failed to remove existing Noise session for $peerID: ${e.message}")
-            }
-        }
-        
        if (packet.payload.isEmpty()) {
            Log.w(TAG, "Noise handshake packet has empty payload")
            return false
@@ -123,26 +110,38 @@ class SecurityManager(private val encryptionService: EncryptionService, private
        // Prevent duplicate handshake processing
        val exchangeKey = "$peerID-${packet.payload.sliceArray(0 until minOf(16, packet.payload.size)).contentHashCode()}"
        
-        if (!forcedRehandshake && processedKeyExchanges.contains(exchangeKey)) {
+        if (processedKeyExchanges.contains(exchangeKey)) {
            Log.d(TAG, "Already processed handshake: $exchangeKey")
            return false
        }
        Log.d(TAG, "Processing Noise handshake from $peerID (${packet.payload.size} bytes)")
-        processedKeyExchanges.add(exchangeKey)
        
        try {
-            // Process the Noise handshake through the updated EncryptionService
-            val response = encryptionService.processHandshakeMessage(packet.payload, peerID)
+            // The session manager preserves an existing transport in a separate responder-candidate
+            // flow and reports whether this exact frame completed authentication. Never infer that
+            // from ambient session state: a rejected replacement may leave the old session active.
+            val result = encryptionService.processHandshakeMessageWithResult(packet.payload, peerID)
+            processedKeyExchanges.add(exchangeKey)
            
-            if (response != null) {
+            if (result.response != null) {
                Log.d(TAG, "Successfully processed Noise handshake from $peerID, sending response")
                // Send handshake response through delegate
-                delegate?.sendHandshakeResponse(peerID, response)
+                delegate?.sendHandshakeResponse(peerID, result.response)
            }
-            // Check if session is now established (handshake complete)
-            if (encryptionService.hasEstablishedSession(peerID)) {
+            if (result.establishedNow) {
+                val authenticatedRemoteStaticKey = result.authenticatedRemoteStaticKey
+                if (authenticatedRemoteStaticKey == null) {
+                    Log.e(TAG, "Bound Noise completion for $peerID omitted its authenticated static key")
+                    return false
+                }
+                val isDirectIngress = packet.ttl == com.bitchat.android.util.AppConstants.MESSAGE_TTL_HOPS
                Log.d(TAG, "✅ Noise handshake completed with $peerID")
-                delegate?.onKeyExchangeCompleted(peerID, packet.payload)
+                delegate?.onKeyExchangeCompleted(
+                    peerID = peerID,
+                    authenticatedRemoteStaticKey = authenticatedRemoteStaticKey,
+                    directRelayAddress = routed.relayAddress.takeIf { isDirectIngress },
+                    ingressLinkID = routed.ingressLinkID.takeIf { isDirectIngress }
+                )
            }
            return true

@@ -237,14 +236,44 @@ class SecurityManager(private val encryptionService: EncryptionService, private
     */
    private fun verifyPacketSignature(packet: BitchatPacket, peerID: String): Boolean {
        try {
-            // only verify ANNOUNCE, MESSAGE, and FILE_TRANSFER
+            // Public packets that mutate identity, presence, or user-visible state must prove the
+            // signing key learned from a verified announcement. LEAVE is included so an attacker
+            // cannot evict a claimed peer or amplify a forged departure through relay.
            if (MessageType.fromValue(packet.type) !in setOf(
                    MessageType.ANNOUNCE,
                    MessageType.MESSAGE,
-                    MessageType.FILE_TRANSFER
+                    MessageType.FILE_TRANSFER,
+                    MessageType.LEAVE
                )) {
                return true
            }
+
+            if (MessageType.fromValue(packet.type) == MessageType.ANNOUNCE) {
+                val announcement = AnnouncementIdentityValidator.verify(packet, peerID) { signature, data, key ->
+                    encryptionService.verifyEd25519Signature(signature, data, key)
+                } ?: run {
+                    Log.w(TAG, "Rejecting malformed, unbound, or invalidly signed ANNOUNCE from $peerID")
+                    return false
+                }
+
+                val existingPeer = delegate?.getPeerInfo(peerID)
+                if (
+                    existingPeer?.noisePublicKey != null &&
+                    !existingPeer.noisePublicKey!!.contentEquals(announcement.noisePublicKey)
+                ) {
+                    Log.w(TAG, "Rejecting ANNOUNCE Noise-key replacement for $peerID")
+                    return false
+                }
+                if (
+                    existingPeer?.signingPublicKey != null &&
+                    !existingPeer.signingPublicKey!!.contentEquals(announcement.signingPublicKey)
+                ) {
+                    Log.w(TAG, "Rejecting ANNOUNCE signing-key replacement without authenticated peer state for $peerID")
+                    return false
+                }
+                return true
+            }
+
            // 1. Mandatory Signature Check
            if (packet.signature == null) {
                Log.w(TAG, "❌ Signature check for $peerID: NO_SIGNATURE (packet type ${packet.type})")
@@ -252,21 +281,8 @@ class SecurityManager(private val encryptionService: EncryptionService, private
            }
            
            // 2. Get Signing Public Key
-            var signingPublicKey: ByteArray? = null
-            
-            if (MessageType.fromValue(packet.type) == MessageType.ANNOUNCE) {
-                // Special Case: ANNOUNCE packets carry their own signing key
-                try {
-                    val announcement = com.bitchat.android.model.IdentityAnnouncement.decode(packet.payload)
-                    signingPublicKey = announcement?.signingPublicKey
-                } catch (e: Exception) {
-                    Log.w(TAG, "Failed to decode announcement for key extraction: ${e.message}")
-                }
-            } else {
-                // Standard Case: Get key from known peer info
-                val peerInfo = delegate?.getPeerInfo(peerID)
-                signingPublicKey = peerInfo?.signingPublicKey
-            }
+            val peerInfo = delegate?.getPeerInfo(peerID)
+            val signingPublicKey = peerInfo?.signingPublicKey
            
            if (signingPublicKey == null) {
                // If we don't have a key (and it's not an announce), we can't verify.
@@ -416,7 +432,12 @@ class SecurityManager(private val encryptionService: EncryptionService, private
 * Delegate interface for security manager callbacks
 */
 interface SecurityManagerDelegate {
-    fun onKeyExchangeCompleted(peerID: String, peerPublicKeyData: ByteArray)
+    fun onKeyExchangeCompleted(
+        peerID: String,
+        authenticatedRemoteStaticKey: ByteArray,
+        directRelayAddress: String?,
+        ingressLinkID: String?
+    )
    fun sendHandshakeResponse(peerID: String, response: ByteArray)
    fun getPeerInfo(peerID: String): PeerInfo? // NEW: For signature verification
 }
@@ -10,5 +10,8 @@ data class RoutedPacket(
    val packet: BitchatPacket,
    val peerID: String? = null,           // Who sent it (parsed from packet.senderID)
    val relayAddress: String? = null,     // Address it came from (for avoiding loopback)
-    val transferId: String? = null        // Optional stable transfer ID for progress tracking
+    val transferId: String? = null,       // Optional stable transfer ID for progress tracking
+    // Opaque, process-local ingress identity. Unlike relayAddress, this distinguishes replacement
+    // sockets for the same provisional peer and must never be serialized onto the mesh.
+    val ingressLinkID: String? = null
 )
@@ -194,12 +194,25 @@ class NoiseEncryptionService(private val context: Context) {
     */
    fun processHandshakeMessage(data: ByteArray, peerID: String): ByteArray? {
        return try {
-            sessionManager.processHandshakeMessage(peerID, data)
+            processHandshakeMessageWithResult(data, peerID).response
        } catch (e: Exception) {
            Log.e(TAG, "Failed to process handshake from $peerID: ${e.message}")
            null
        }
    }
+
+    /**
+     * Typed handshake result for security-sensitive callers that must distinguish a null response
+     * from a newly authenticated session or a rejected handshake. Identity mismatch exceptions are
+     * intentionally propagated to the caller.
+     */
+    @Throws(Exception::class)
+    fun processHandshakeMessageWithResult(
+        data: ByteArray,
+        peerID: String
+    ): NoiseHandshakeProcessingResult {
+        return sessionManager.processHandshakeMessageWithResult(peerID, data)
+    }
    
    /**
     * Check if we have an established session with a peer
@@ -382,6 +395,20 @@ class NoiseEncryptionService(private val context: Context) {
        // Store fingerprint mapping via centralized manager
        // This is the ONLY place where fingerprints are stored - after successful Noise handshake
        fingerprintManager.storeFingerprintForPeer(peerID, remoteStaticKey)
+
+        // Preserve the canonical peerID -> npub index, but only after Noise proves possession of
+        // the static key. Announcement-time indexing was unsafe because a peer can copy another
+        // party's public Noise key without possessing its private key.
+        try {
+            com.bitchat.android.favorites.FavoritesPersistenceService.shared
+                .findNostrPubkey(remoteStaticKey)
+                ?.let { npub ->
+                    com.bitchat.android.favorites.FavoritesPersistenceService.shared
+                        .updateNostrPublicKeyForPeerID(peerID, npub)
+                }
+        } catch (_: Exception) {
+            // Favorites may not be initialized in isolated/background crypto tests.
+        }
        
        // Calculate fingerprint for logging and callback
        val fingerprint = calculateFingerprint(remoteStaticKey)
@@ -0,0 +1,30 @@
+package com.bitchat.android.noise
+
+import java.security.MessageDigest
+
+/**
+ * Canonical binding between an authenticated Noise static key and its mesh wire identity.
+ *
+ * Mesh peer IDs are the first eight bytes of SHA-256(staticPublicKey), encoded as 16 lowercase
+ * hexadecimal characters. A self-signed announcement or completed Noise XX handshake is not
+ * sufficient on its own: the claimed wire ID must also match this derivation.
+ */
+object NoisePeerIdentity {
+    const val STATIC_PUBLIC_KEY_SIZE = 32
+    const val WIRE_PEER_ID_LENGTH = 16
+
+    private val wirePeerIDPattern = Regex("^[0-9a-f]{$WIRE_PEER_ID_LENGTH}$")
+
+    fun derivePeerID(staticPublicKey: ByteArray): String? {
+        if (staticPublicKey.size != STATIC_PUBLIC_KEY_SIZE) return null
+        return MessageDigest.getInstance("SHA-256")
+            .digest(staticPublicKey)
+            .take(8)
+            .joinToString("") { "%02x".format(it) }
+    }
+
+    fun matchesClaimedPeerID(claimedPeerID: String, staticPublicKey: ByteArray): Boolean {
+        if (!wirePeerIDPattern.matches(claimedPeerID)) return false
+        return derivePeerID(staticPublicKey) == claimedPeerID
+    }
+}
@@ -451,27 +451,33 @@ class NoiseSession(
        Log.d(TAG, "Completing XX handshake with $peerID")
        
        try {
-            // Split handshake state into transport ciphers
-            val cipherPair = handshakeState?.split()
-            
-            sendCipher = cipherPair?.getSender()
-            receiveCipher = cipherPair?.getReceiver()
-            
-            // Extract remote static key if available
-            if (handshakeState?.hasRemotePublicKey() == true) {
-                val remoteDH = handshakeState?.getRemotePublicKey()
-                if (remoteDH != null) {
-                    remoteStaticPublicKey = ByteArray(32)
-                    remoteDH.getPublicKey(remoteStaticPublicKey!!, 0)
-                    Log.d(TAG, "Remote static public key: ${remoteStaticPublicKey!!.joinToString("") { "%02x".format(it) }}")
-                }
+            val activeHandshake = handshakeState ?: throw NoiseSessionError.HandshakeFailed
+
+            // Authenticate the remote static key's claimed mesh identity before split creates
+            // transport ciphers or the session can become observable as Established.
+            if (!activeHandshake.hasRemotePublicKey()) throw NoiseSessionError.HandshakeFailed
+            val remoteDH = activeHandshake.getRemotePublicKey()
+                ?: throw NoiseSessionError.HandshakeFailed
+            val authenticatedRemoteKey = ByteArray(NoisePeerIdentity.STATIC_PUBLIC_KEY_SIZE)
+            remoteDH.getPublicKey(authenticatedRemoteKey, 0)
+            val derivedPeerID = NoisePeerIdentity.derivePeerID(authenticatedRemoteKey)
+            if (!NoisePeerIdentity.matchesClaimedPeerID(peerID, authenticatedRemoteKey)) {
+                authenticatedRemoteKey.fill(0)
+                throw NoiseSessionError.PeerIdentityMismatch(peerID, derivedPeerID)
            }
+            remoteStaticPublicKey = authenticatedRemoteKey
+            Log.d(TAG, "Remote static public key is bound to $peerID")
+
+            // Only a bound remote identity may derive transport ciphers.
+            val cipherPair = activeHandshake.split()
+            sendCipher = cipherPair.getSender()
+            receiveCipher = cipherPair.getReceiver()
            
            // Extract handshake hash for channel binding
-            handshakeHash = handshakeState?.getHandshakeHash()
+            handshakeHash = activeHandshake.getHandshakeHash()
            
            // Clean up handshake state
-            handshakeState?.destroy()
+            activeHandshake.destroy()
            handshakeState = null
            
            messagesSent = 0
@@ -3,6 +3,13 @@ package com.bitchat.android.noise
 import android.util.Log
 import java.util.concurrent.ConcurrentHashMap

+data class NoiseHandshakeProcessingResult(
+    val response: ByteArray?,
+    val establishedNow: Boolean,
+    /** The bound remote static key only when this exact call completed authentication. */
+    val authenticatedRemoteStaticKey: ByteArray? = null
+)
+
 /**
 * SIMPLIFIED Noise session manager - focuses on core functionality only
 */
@@ -19,6 +26,9 @@ class NoiseSessionManager(
    }
    
    private val sessions = ConcurrentHashMap<String, NoiseSession>()
+    // An inbound replacement handshake must prove its authenticated static-key binding before it
+    // can evict a working transport session. Keep responder candidates outside the active map.
+    private val responderCandidates = ConcurrentHashMap<String, NoiseSession>()
    
    // Callbacks
    var onSessionEstablished: ((String, ByteArray) -> Unit)? = null
@@ -29,8 +39,10 @@ class NoiseSessionManager(
    /**
     * Add new session for a peer
     */
+    @Synchronized
    fun addSession(peerID: String, session: NoiseSession) {
-        sessions[peerID] = session
+        val previous = sessions.put(peerID, session)
+        if (previous != null && previous !== session) previous.destroy()
        Log.d(TAG, "Added new session for $peerID")
    }

@@ -45,15 +57,17 @@ class NoiseSessionManager(
    /**
     * Remove session for a peer
     */
+    @Synchronized
    fun removeSession(peerID: String) {
-        sessions[peerID]?.destroy()
-        sessions.remove(peerID)
+        sessions.remove(peerID)?.destroy()
+        responderCandidates.remove(peerID)?.destroy()
        Log.d(TAG, "Removed session for $peerID")
    }
    
    /**
     * SIMPLIFIED: Initiate handshake - no tie breaker, just start
     */
+    @Synchronized
    fun initiateHandshake(peerID: String): ByteArray? {
        Log.d(TAG, "initiateHandshake($peerID)")

@@ -94,7 +108,7 @@ class NoiseSessionManager(
            Log.d(TAG, "Started handshake with $peerID as INITIATOR")
            return handshakeData
        } catch (e: Exception) {
-            sessions.remove(peerID)
+            if (sessions.remove(peerID, session)) session.destroy()
            throw e
        }
    }
@@ -103,62 +117,132 @@ class NoiseSessionManager(
     * Handle incoming handshake message
     */
    fun processHandshakeMessage(peerID: String, message: ByteArray): ByteArray? {
-        Log.d(TAG, "processHandshakeMessage($peerID, ${message.size} bytes)")
-        
-        try {
-            var session = getSession(peerID)
+        return processHandshakeMessageWithResult(peerID, message).response
+    }

-            // Collision handling: both sides initiated and we received message 1
-            if (session != null &&
-                session.isHandshaking() &&
-                session.isInitiatorRole() &&
-                message.size == HANDSHAKE_MESSAGE_1_SIZE
-            ) {
-                val shouldYield = localPeerID > peerID
-                if (shouldYield) {
-                    Log.d(TAG, "Handshake collision with $peerID; yielding to responder role")
-                    removeSession(peerID)
-                    session = null
+    @Synchronized
+    fun processHandshakeMessageWithResult(
+        peerID: String,
+        message: ByteArray
+    ): NoiseHandshakeProcessingResult {
+        Log.d(TAG, "processHandshakeMessage($peerID, ${message.size} bytes)")
+
+        var activeSession: NoiseSession? = null
+        var isReplacementCandidate = false
+        var establishedRemoteKey: ByteArray? = null
+        var response: ByteArray? = null
+
+        try {
+            val existingCandidate = responderCandidates[peerID]
+            if (existingCandidate != null) {
+                activeSession = if (message.size == HANDSHAKE_MESSAGE_1_SIZE) {
+                    responderCandidates.remove(peerID, existingCandidate)
+                    existingCandidate.destroy()
+                    createSession(peerID, isInitiator = false).also {
+                        responderCandidates[peerID] = it
+                    }
                } else {
-                    Log.d(TAG, "Handshake collision with $peerID; keeping initiator role")
-                    return null
+                    existingCandidate
+                }
+                isReplacementCandidate = true
+            } else {
+                var session = getSession(peerID)
+
+                // Collision handling: both sides initiated and we received message 1.
+                if (session != null &&
+                    session.isHandshaking() &&
+                    session.isInitiatorRole() &&
+                    message.size == HANDSHAKE_MESSAGE_1_SIZE
+                ) {
+                    val shouldYield = localPeerID > peerID
+                    if (shouldYield) {
+                        Log.d(TAG, "Handshake collision with $peerID; yielding to responder role")
+                        if (sessions.remove(peerID, session)) session.destroy()
+                        session = null
+                    } else {
+                        Log.d(TAG, "Handshake collision with $peerID; keeping initiator role")
+                        return NoiseHandshakeProcessingResult(response = null, establishedNow = false)
+                    }
+                }
+
+                activeSession = when {
+                    session == null -> {
+                        Log.d(TAG, "Creating new RESPONDER session for $peerID")
+                        createSession(peerID, isInitiator = false).also { sessions[peerID] = it }
+                    }
+                    session.isEstablished() -> {
+                        Log.d(
+                            TAG,
+                            "Validating replacement handshake for $peerID while preserving active session"
+                        )
+                        isReplacementCandidate = true
+                        createSession(peerID, isInitiator = false).also {
+                            responderCandidates[peerID] = it
+                        }
+                    }
+                    session.isHandshaking() &&
+                        !session.isInitiatorRole() &&
+                        message.size == HANDSHAKE_MESSAGE_1_SIZE -> {
+                        // A restarted responder handshake can replace an incomplete session because
+                        // there is no working transport state to preserve.
+                        if (sessions.remove(peerID, session)) session.destroy()
+                        createSession(peerID, isInitiator = false).also { sessions[peerID] = it }
+                    }
+                    else -> session
                }
            }
-            
-            // If no session exists, create one as responder
-            if (session == null) {
-                Log.d(TAG, "Creating new RESPONDER session for $peerID")
-                session = NoiseSession(
-                    peerID = peerID,
-                    isInitiator = false,
-                    localStaticPrivateKey = localStaticPrivateKey,
-                    localStaticPublicKey = localStaticPublicKey
-                )
-                addSession(peerID, session)
-            }
-            
-            // Process handshake message
-            val response = session.processHandshakeMessage(message)
-            
-            // Check if session is established
+
+            val session = activeSession ?: throw NoiseSessionError.InvalidState
+
+            response = session.processHandshakeMessage(message)
+
            if (session.isEstablished()) {
-                Log.d(TAG, "✅ Session ESTABLISHED with $peerID")
                val remoteStaticKey = session.getRemoteStaticPublicKey()
-                if (remoteStaticKey != null) {
-                    onSessionEstablished?.invoke(peerID, remoteStaticKey)
+                    ?: throw NoiseSessionError.HandshakeFailed
+                val derivedPeerID = NoisePeerIdentity.derivePeerID(remoteStaticKey)
+                if (!NoisePeerIdentity.matchesClaimedPeerID(peerID, remoteStaticKey)) {
+                    throw NoiseSessionError.PeerIdentityMismatch(peerID, derivedPeerID)
                }
+
+                if (isReplacementCandidate) {
+                    responderCandidates.remove(peerID, session)
+                    val previous = sessions.put(peerID, session)
+                    if (previous != null && previous !== session) previous.destroy()
+                }
+
+                establishedRemoteKey = remoteStaticKey
+                Log.d(TAG, "✅ Session ESTABLISHED with bound identity $peerID")
            }
-            
-            return response
-            
        } catch (e: Exception) {
+            val session = activeSession
+            if (session != null) {
+                if (isReplacementCandidate) {
+                    responderCandidates.remove(peerID, session)
+                } else {
+                    sessions.remove(peerID, session)
+                }
+                session.destroy()
+            }
            Log.e(TAG, "Handshake failed with $peerID: ${e.message}")
-            sessions.remove(peerID)
-            onSessionFailed?.invoke(peerID, e)
+            runCatching { onSessionFailed?.invoke(peerID, e) }
            throw e
        }
+
+        establishedRemoteKey?.let { onSessionEstablished?.invoke(peerID, it) }
+        return NoiseHandshakeProcessingResult(
+            response = response,
+            establishedNow = establishedRemoteKey != null,
+            authenticatedRemoteStaticKey = establishedRemoteKey?.clone()
+        )
    }

+    private fun createSession(peerID: String, isInitiator: Boolean): NoiseSession = NoiseSession(
+        peerID = peerID,
+        isInitiator = isInitiator,
+        localStaticPrivateKey = localStaticPrivateKey,
+        localStaticPublicKey = localStaticPublicKey
+    )
+
    private fun isHandshakeStale(session: NoiseSession, nowMs: Long): Boolean {
        val lastActivity = session.getLastHandshakeActivityMs() ?: session.getHandshakeStartMs()
        if (lastActivity == null) return false
@@ -239,6 +323,7 @@ class NoiseSessionManager(
    fun getDebugInfo(): String = buildString {
        appendLine("=== Noise Session Manager Debug ===")
        appendLine("Active sessions: ${sessions.size}")
+        appendLine("Responder candidates: ${responderCandidates.size}")
        appendLine("")
        
        if (sessions.isNotEmpty()) {
@@ -252,9 +337,12 @@ class NoiseSessionManager(
    /**
     * Shutdown manager and clean up all sessions
     */
+    @Synchronized
    fun shutdown() {
        sessions.values.forEach { it.destroy() }
+        responderCandidates.values.forEach { it.destroy() }
        sessions.clear()
+        responderCandidates.clear()
        Log.d(TAG, "Noise session manager shut down")
    }
 }
@@ -268,4 +356,7 @@ sealed class NoiseSessionError(message: String, cause: Throwable? = null) : Exce
    object InvalidState : NoiseSessionError("Session in invalid state")
    object HandshakeFailed : NoiseSessionError("Handshake failed")
    object AlreadyEstablished : NoiseSessionError("Session already established")
+    class PeerIdentityMismatch(claimedPeerID: String, derivedPeerID: String?) : NoiseSessionError(
+        "Authenticated Noise key derives to ${derivedPeerID ?: "invalid"}, not claimed peer $claimedPeerID"
+    )
 }
@@ -0,0 +1,25 @@
+package com.bitchat.android.wifiaware
+
+/**
+ * Resolves an authenticated callback to the exact still-active ingress link that completed Noise.
+ * A relay/discovery ID alone is not sufficient because a replacement socket may reuse it.
+ */
+internal object AuthenticatedIngressLinkPolicy {
+    data class Link<T : Any>(
+        val relayAddress: String,
+        val transport: T
+    )
+
+    fun <T : Any> resolve(
+        authenticatedLinkID: String?,
+        authenticatedRelayAddress: String?,
+        links: Map<String, Link<T>>,
+        currentTransportForRelay: (String) -> T?
+    ): Link<T>? {
+        val linkID = authenticatedLinkID ?: return null
+        val relayAddress = authenticatedRelayAddress ?: return null
+        val link = links[linkID] ?: return null
+        if (link.relayAddress != relayAddress) return null
+        return link.takeIf { currentTransportForRelay(relayAddress) === it.transport }
+    }
+}
@@ -42,6 +42,7 @@ import java.net.ServerSocket
 import java.net.Socket
 import java.nio.ByteBuffer
 import java.nio.ByteOrder
+import java.util.UUID
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.Executors
 import java.util.concurrent.atomic.AtomicBoolean
@@ -121,6 +122,10 @@ class WifiAwareMeshService(private val context: Context) : MeshService, Transpor

    // Transport state
    private val connectionTracker = WifiAwareConnectionTracker(serviceScope, cm)
+    private val ingressLinks = ConcurrentHashMap<
+        String,
+        AuthenticatedIngressLinkPolicy.Link<SyncedSocket>
+    >()
    private val handleToPeerId = ConcurrentHashMap<PeerHandle, String>() // discovery mapping
    private val discoveredTimestamps = ConcurrentHashMap<String, Long>() // peerID -> last seen time
    // Subscribe-session-scoped handles only. PeerHandles are session-scoped, so a handle obtained
@@ -167,8 +172,20 @@ class WifiAwareMeshService(private val context: Context) : MeshService, Transpor
                onAnnounceProcessed = { routed, _ ->
                    routed.peerID?.let { pid ->
                        try { meshCore.gossipSyncManager.scheduleInitialSyncToPeer(pid, 1_000) } catch (_: Exception) { }
+
+                        // Discovery IDs from older clients can be provisional. A verified direct
+                        // announce is enough to start a handshake for the canonical ID, but not to
+                        // rebind the socket. The resulting packet broadcasts when no canonical
+                        // alias exists; only a same-link Noise completion may promote that alias.
+                        val relay = routed.relayAddress
+                        if (routed.packet.ttl == MAX_TTL && relay != null && relay != pid) {
+                            meshCore.initiateNoiseHandshake(pid)
+                        }
                    }
                },
+                onDirectNoiseAuthenticated = { peerID, relayAddress, ingressLinkID, _ ->
+                    promoteAuthenticatedIngressLink(peerID, relayAddress, ingressLinkID)
+                },
                announcementNicknameProvider = {
                    try { com.bitchat.android.services.NicknameProvider.getNickname(context, myPeerID) } catch (_: Exception) { null }
                },
@@ -1241,6 +1258,60 @@ class WifiAwareMeshService(private val context: Context) : MeshService, Transpor
        else -> myPeerID < peerId
    }

+    /**
+     * Promote a provisional discovery alias only when the exact, still-active socket delivered the
+     * Noise frame that completed authentication for the canonical peer ID.
+     */
+    private fun promoteAuthenticatedIngressLink(
+        canonicalPeerId: String,
+        relayAddress: String,
+        ingressLinkID: String
+    ) {
+        val link = AuthenticatedIngressLinkPolicy.resolve(
+            authenticatedLinkID = ingressLinkID,
+            authenticatedRelayAddress = relayAddress,
+            links = ingressLinks,
+            currentTransportForRelay = connectionTracker::getSocketForPeer
+        ) ?: run {
+            Log.w(TAG, "Ignoring Noise link promotion for ${canonicalPeerId.take(8)}: ingress link is stale or mismatched")
+            return
+        }
+
+        val provisionalPeerId = link.relayAddress
+        val existingCanonical = connectionTracker.canonicalPeerId(provisionalPeerId)
+        if (existingCanonical == canonicalPeerId) {
+            try { meshCore.setDirectConnection(canonicalPeerId, true) } catch (_: Exception) { }
+            return
+        }
+        if (existingCanonical != provisionalPeerId) {
+            Log.w(
+                TAG,
+                "Refusing authenticated Wi-Fi rebind ${existingCanonical.take(8)} -> ${canonicalPeerId.take(8)} on an existing alias"
+            )
+            return
+        }
+
+        connectionTracker.rebindPeerId(provisionalPeerId, canonicalPeerId, link.transport)
+        handleToPeerId.forEach { (handle, peerId) ->
+            if (peerId == provisionalPeerId) handleToPeerId[handle] = canonicalPeerId
+        }
+        subscribeHandles.remove(provisionalPeerId)?.let { subscribeHandles[canonicalPeerId] = it }
+        publishHandles.remove(provisionalPeerId)?.let { publishHandles[canonicalPeerId] = it }
+        val discoveredAt = discoveredTimestamps.remove(provisionalPeerId) ?: System.currentTimeMillis()
+        discoveredTimestamps[canonicalPeerId] = discoveredAt
+
+        try { meshCore.setDirectConnection(provisionalPeerId, false) } catch (_: Exception) { }
+        try { meshCore.removePeer(provisionalPeerId) } catch (_: Exception) { }
+        try { meshCore.addOrUpdatePeer(canonicalPeerId, meshCore.getPeerNickname(canonicalPeerId) ?: canonicalPeerId) } catch (_: Exception) { }
+        try { meshCore.setDirectConnection(canonicalPeerId, true) } catch (_: Exception) { }
+        try { meshCore.gossipSyncManager.scheduleInitialSyncToPeer(canonicalPeerId, 1_000) } catch (_: Exception) { }
+
+        Log.i(
+            TAG,
+            "Noise-authenticated Wi-Fi peer ${provisionalPeerId.take(8)} -> ${canonicalPeerId.take(8)} on exact ingress link"
+        )
+    }
+
    /**
     * Listens for incoming packets from a connected peer and dispatches them through
     * the packet processor.
@@ -1249,7 +1320,10 @@ class WifiAwareMeshService(private val context: Context) : MeshService, Transpor
     * @param initialLogicalPeerId Temporary identifier before peer ID resolution
     */
    private fun listenToPeer(socket: SyncedSocket, initialLogicalPeerId: String) {
-        var logicalPeerId = initialLogicalPeerId
+        val logicalPeerId = initialLogicalPeerId
+        val ingressLinkID = UUID.randomUUID().toString()
+        val ingressLink = AuthenticatedIngressLinkPolicy.Link(logicalPeerId, socket)
+        ingressLinks[ingressLinkID] = ingressLink
        while (isActive) {
            val raw = socket.read() ?: break
            
@@ -1263,29 +1337,23 @@ class WifiAwareMeshService(private val context: Context) : MeshService, Transpor
            val senderPeerHex = pkt.senderID?.toHexString()?.take(16) ?: continue

            if (pkt.type == MessageType.ANNOUNCE.value && pkt.ttl >= MAX_TTL && senderPeerHex != logicalPeerId) {
-                val previousPeerId = logicalPeerId
-                logicalPeerId = connectionTracker.rebindPeerId(previousPeerId, senderPeerHex, socket)
-                handleToPeerId.forEach { (handle, peerId) ->
-                    if (peerId == previousPeerId) {
-                        handleToPeerId[handle] = senderPeerHex
-                    }
-                }
-                subscribeHandles.remove(previousPeerId)?.let { subscribeHandles[senderPeerHex] = it }
-                discoveredTimestamps.remove(previousPeerId)
-                discoveredTimestamps[senderPeerHex] = System.currentTimeMillis()
-                try { meshCore.setDirectConnection(previousPeerId, false) } catch (_: Exception) { }
-                try { meshCore.removePeer(previousPeerId) } catch (_: Exception) { }
-                try { meshCore.setDirectConnection(senderPeerHex, true) } catch (_: Exception) { }
-                publishHandles.remove(previousPeerId)?.let { publishHandles[senderPeerHex] = it }
-                Log.i(TAG, "RX: rebound Wi-Fi direct peer ${previousPeerId.take(8)} -> ${senderPeerHex.take(8)}")
+                // The socket's discovery identity remains provisional until Noise proves possession
+                // of the claimed static key on this link. A canonical self-signed announcement is
+                // only TOFU and cannot safely rebind/remove transport state on its own.
+                Log.w(
+                    TAG,
+                    "RX: deferred Wi-Fi peer rebind ${logicalPeerId.take(8)} -> ${senderPeerHex.take(8)} pending Noise proof"
+                )
            }
            
            // Route the packet: 
            // - peerID = Originator (who signed it)
            // - relayAddress = Neighbor (who sent it to us over this socket)
            Log.d(TAG, "RX: packet type=${pkt.type} from ${senderPeerHex.take(8)} via ${logicalPeerId.take(8)} (bytes=${raw.size})")
-            meshCore.processIncoming(pkt, senderPeerHex, logicalPeerId)
+            meshCore.processIncoming(pkt, senderPeerHex, logicalPeerId, ingressLinkID)
        }
+
+        ingressLinks.remove(ingressLinkID, ingressLink)
        
        // Breaking out of the loop means the socket is dead or service is stopping.
        Log.i(TAG, "Socket loop terminated for ${logicalPeerId.take(8)} removing peer.")
@@ -12,6 +12,11 @@ fun e(tag: String, msg: String): Int {
    return 0;
 }

+fun e(tag: String, msg: String, throwable: Throwable): Int {
+    println("ERROR: $tag: $msg (${throwable.message})")
+    return 0;
+}
+
 fun w(tag: String, msg: String): Int {
    println("WARN: $tag: $msg")
    return 0;
@@ -25,4 +30,4 @@ fun v(tag: String, msg: String): Int {
 fun i(tag: String, msg: String): Int {
    println("INFO: $tag: $msg")
    return 0;
-}
+}
@@ -3,6 +3,7 @@ package com.bitchat.android.mesh
 import android.os.Build
 import com.bitchat.android.model.IdentityAnnouncement
 import com.bitchat.android.model.RoutedPacket
+import com.bitchat.android.noise.NoisePeerIdentity
 import com.bitchat.android.protocol.BitchatPacket
 import com.bitchat.android.protocol.MessageType
 import com.bitchat.android.protocol.SpecialRecipients
@@ -17,7 +18,6 @@ import org.junit.Test
 import org.junit.runner.RunWith
 import org.mockito.kotlin.any
 import org.mockito.kotlin.eq
-import org.mockito.kotlin.isNull
 import org.mockito.kotlin.mock
 import org.mockito.kotlin.never
 import org.mockito.kotlin.verify
@@ -33,9 +33,9 @@ class MessageHandlerTest {
    private lateinit var delegate: MessageHandlerDelegate

    private val myPeerID = "1111222233334444"
-    private val peerID = "aaaabbbbccccdddd"
-    private val nickname = "peer"
    private val noiseKey = ByteArray(32) { 0x0B }
+    private val peerID = NoisePeerIdentity.derivePeerID(noiseKey)!!
+    private val nickname = "peer"
    private val signingKey = ByteArray(32) { 0x0A }
    private val signature = ByteArray(64) { 1 }
    private val announceClockSkewToleranceMs = 10 * 60 * 1000L
@@ -65,7 +65,7 @@ class MessageHandlerTest {

        assertTrue("Announce within clock skew tolerance should still store peer identity", result)
        verify(delegate).updatePeerInfo(eq(peerID), eq(nickname), any(), any(), eq(true))
-        verify(delegate).updatePeerIDBinding(eq(peerID), eq(nickname), any(), isNull())
+        Unit
    }

    @Test
@@ -87,16 +87,82 @@ class MessageHandlerTest {

        assertFalse("Announce older than clock skew tolerance should not store peer identity", result)
        verify(delegate, never()).updatePeerInfo(any(), any(), any(), any(), any())
-        verify(delegate, never()).updatePeerIDBinding(any(), any(), any(), any())
+        Unit
+    }
+
+    @Test
+    fun `first self-signed announce cannot claim an ID derived from another Noise key`() = runBlocking {
+        val attackerNoiseKey = ByteArray(32) { 0x6B }
+        val packet = announcePacket(ageMs = 0, noisePublicKey = attackerNoiseKey)
+
+        val result = handler.handleAnnounce(RoutedPacket(packet, peerID, "direct-link"))
+
+        assertFalse("A valid self-signature cannot bind an attacker key to a victim ID", result)
+        verify(delegate, never()).verifyEd25519Signature(any(), any(), any())
+        verify(delegate, never()).updatePeerInfo(any(), any(), any(), any(), any())
+        Unit
+    }
+
+    @Test
+    fun `announce requires a 32-byte Noise static key before peer update`() = runBlocking {
+        val malformedNoiseKey = ByteArray(31) { 0x0B }
+        val packet = announcePacket(ageMs = 0, noisePublicKey = malformedNoiseKey)
+
+        val result = handler.handleAnnounce(RoutedPacket(packet, peerID, "direct-link"))
+
+        assertFalse(result)
+        verify(delegate, never()).verifyEd25519Signature(any(), any(), any())
+        verify(delegate, never()).updatePeerInfo(any(), any(), any(), any(), any())
+        Unit
+    }
+
+    @Test
+    fun `announce packet sender cannot be processed under a different routed peer ID`() = runBlocking {
+        val otherPeerID = NoisePeerIdentity.derivePeerID(ByteArray(32) { 0x21 })!!
+        val packet = announcePacket(ageMs = 0)
+
+        val result = handler.handleAnnounce(RoutedPacket(packet, otherPeerID, "relay-link"))
+
+        assertFalse(result)
+        verify(delegate, never()).verifyEd25519Signature(any(), any(), any())
+        verify(delegate, never()).updatePeerInfo(any(), any(), any(), any(), any())
+        Unit
+    }
+
+    @Test
+    fun `known peer signing key cannot be replaced without bound Noise session`() = runBlocking {
+        whenever(delegate.getPeerInfo(peerID)).thenReturn(peerInfo(signingPublicKey = ByteArray(32) { 0x44 }))
+        whenever(delegate.hasNoiseSession(peerID)).thenReturn(false)
+        val packet = announcePacket(ageMs = 0)
+
+        val result = handler.handleAnnounce(RoutedPacket(packet, peerID, "direct-link"))
+
+        assertFalse(result)
+        verify(delegate, never()).updatePeerInfo(any(), any(), any(), any(), any())
+        Unit
+    }
+
+    @Test
+    fun `ambient bound Noise session does not authorize signing key replacement`() = runBlocking {
+        whenever(delegate.getPeerInfo(peerID)).thenReturn(peerInfo(signingPublicKey = ByteArray(32) { 0x44 }))
+        whenever(delegate.hasNoiseSession(peerID)).thenReturn(true)
+        val packet = announcePacket(ageMs = 0)
+
+        val result = handler.handleAnnounce(RoutedPacket(packet, peerID, "direct-link"))
+
+        assertFalse(result)
+        verify(delegate, never()).updatePeerInfo(any(), any(), any(), any(), any())
+        Unit
    }

    private fun announcePacket(
        ageMs: Long,
-        ttl: UByte = (AppConstants.MESSAGE_TTL_HOPS.toInt() - 1).toUByte()
+        ttl: UByte = (AppConstants.MESSAGE_TTL_HOPS.toInt() - 1).toUByte(),
+        noisePublicKey: ByteArray = noiseKey
    ): BitchatPacket {
        val announcement = IdentityAnnouncement(
            nickname = nickname,
-            noisePublicKey = noiseKey,
+            noisePublicKey = noisePublicKey,
            signingPublicKey = signingKey
        )
        return BitchatPacket(
@@ -114,4 +180,15 @@ class MessageHandlerTest {
    private fun String.hexToBytes(): ByteArray {
        return chunked(2).map { it.toInt(16).toByte() }.toByteArray()
    }
+
+    private fun peerInfo(signingPublicKey: ByteArray) = PeerInfo(
+        id = peerID,
+        nickname = nickname,
+        isConnected = true,
+        isDirectConnection = true,
+        noisePublicKey = noiseKey,
+        signingPublicKey = signingPublicKey,
+        isVerifiedNickname = true,
+        lastSeen = System.currentTimeMillis()
+    )
 }
@@ -0,0 +1,104 @@
+package com.bitchat.android.mesh
+
+import com.bitchat.android.model.RoutedPacket
+import com.bitchat.android.protocol.BitchatPacket
+import com.bitchat.android.protocol.MessageType
+import com.bitchat.android.protocol.SpecialRecipients
+import kotlinx.coroutines.CompletableDeferred
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import kotlinx.coroutines.withTimeoutOrNull
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class PacketProcessorAnnounceSideEffectTest {
+    private val processors = mutableListOf<PacketProcessor>()
+
+    @After
+    fun tearDown() {
+        processors.forEach(PacketProcessor::shutdown)
+    }
+
+    @Test
+    fun `rejected announce does not update last seen or relay`() = runBlocking {
+        val delegate = RecordingDelegate(acceptAnnounce = false)
+        val processor = processor(delegate)
+
+        processor.processPacket(announce())
+        withTimeout(1_000) { delegate.handled.await() }
+
+        assertNull(withTimeoutOrNull(250) { delegate.lastSeen.await() })
+        assertEquals(0, delegate.relayCount)
+    }
+
+    @Test
+    fun `accepted announce unlocks post-handler side effects`() = runBlocking {
+        val delegate = RecordingDelegate(acceptAnnounce = true)
+        val processor = processor(delegate)
+
+        processor.processPacket(announce())
+
+        assertEquals(PEER_ID, withTimeout(1_000) { delegate.lastSeen.await() })
+    }
+
+    private fun processor(delegate: RecordingDelegate): PacketProcessor =
+        PacketProcessor(MY_PEER_ID).also {
+            it.delegate = delegate
+            processors += it
+        }
+
+    private fun announce(): RoutedPacket {
+        val packet = BitchatPacket(
+            version = 1u,
+            type = MessageType.ANNOUNCE.value,
+            senderID = PEER_ID.hexToBytes(),
+            recipientID = SpecialRecipients.BROADCAST,
+            timestamp = System.currentTimeMillis().toULong(),
+            payload = byteArrayOf(0x01),
+            ttl = 7u
+        )
+        return RoutedPacket(packet, PEER_ID, "direct-link")
+    }
+
+    private class RecordingDelegate(
+        private val acceptAnnounce: Boolean
+    ) : PacketProcessorDelegate {
+        val handled = CompletableDeferred<Unit>()
+        val lastSeen = CompletableDeferred<String>()
+        @Volatile var relayCount = 0
+
+        override fun validatePacketSecurity(packet: BitchatPacket, peerID: String) = true
+        override fun updatePeerLastSeen(peerID: String) {
+            lastSeen.complete(peerID)
+        }
+        override fun getPeerNickname(peerID: String): String? = null
+        override fun getNetworkSize() = 1
+        override fun getBroadcastRecipient(): ByteArray = SpecialRecipients.BROADCAST
+        override fun handleNoiseHandshake(routed: RoutedPacket) = false
+        override fun handleNoiseEncrypted(routed: RoutedPacket) = Unit
+        override suspend fun handleAnnounce(routed: RoutedPacket): Boolean {
+            handled.complete(Unit)
+            return acceptAnnounce
+        }
+        override fun handleMessage(routed: RoutedPacket) = Unit
+        override fun handleLeave(routed: RoutedPacket) = Unit
+        override fun handleFragment(packet: BitchatPacket): BitchatPacket? = null
+        override fun handleRequestSync(routed: RoutedPacket) = Unit
+        override fun sendAnnouncementToPeer(peerID: String) = Unit
+        override fun sendCachedMessages(peerID: String) = Unit
+        override fun relayPacket(routed: RoutedPacket) {
+            relayCount += 1
+        }
+        override fun sendToPeer(peerID: String, routed: RoutedPacket) = false
+    }
+
+    private fun String.hexToBytes(): ByteArray =
+        chunked(2).map { it.toInt(16).toByte() }.toByteArray()
+
+    private companion object {
+        const val MY_PEER_ID = "1111222233334444"
+        const val PEER_ID = "aaaabbbbccccdddd"
+    }
+}
@@ -3,8 +3,13 @@ package com.bitchat.android.mesh
 import android.os.Build
 import com.bitchat.android.crypto.EncryptionService
 import com.bitchat.android.model.IdentityAnnouncement
+import com.bitchat.android.model.RoutedPacket
+import com.bitchat.android.noise.NoiseHandshakeProcessingResult
+import com.bitchat.android.noise.NoisePeerIdentity
+import com.bitchat.android.noise.NoiseSessionError
 import com.bitchat.android.protocol.BitchatPacket
 import com.bitchat.android.protocol.MessageType
+import kotlinx.coroutines.runBlocking
 import org.junit.After
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
@@ -26,21 +31,24 @@ class SecurityManagerTest {
    
    private val myPeerID = "1111222233334444"
    private val otherPeerID = "aaaabbbbccccdddd"
-    private val unknownPeerID = "9999888877776666"
+    // Key pairs (using dummy bytes for mock verification)
+    private val otherSigningKey = ByteArray(32) { 0xA }
+    private val otherNoiseKey = ByteArray(32) { 0xB }
+    private val unknownPeerID = NoisePeerIdentity.derivePeerID(otherNoiseKey)!!

    private val dummyPayload = "Hello World".toByteArray()
    private val validSignature = ByteArray(64) { 1 }
    private val invalidSignature = ByteArray(64) { 0 }
-    
-    // Key pairs (using dummy bytes for mock verification)
-    private val otherSigningKey = ByteArray(32) { 0xA }
-    private val otherNoiseKey = ByteArray(32) { 0xB }

    // Fake implementation to bypass initialization issues in tests
    open class FakeEncryptionService : EncryptionService(RuntimeEnvironment.getApplication()) {
        var shouldVerify: Boolean = true
        var lastVerifySignature: ByteArray? = null
        var lastVerifyKey: ByteArray? = null
+        var handshakeResult = NoiseHandshakeProcessingResult(null, false)
+        var handshakeError: Exception? = null
+        var handshakeCalls = 0
+        var removePeerCalls = 0

        override fun initialize() {
            // Do nothing to avoid KeyStore access in tests
@@ -57,6 +65,19 @@ class SecurityManagerTest {
            }
            return false
        }
+
+        override fun processHandshakeMessageWithResult(
+            data: ByteArray,
+            peerID: String
+        ): NoiseHandshakeProcessingResult {
+            handshakeCalls += 1
+            handshakeError?.let { throw it }
+            return handshakeResult
+        }
+
+        override fun removePeer(peerID: String) {
+            removePeerCalls += 1
+        }
    }

    @Before
@@ -141,6 +162,41 @@ class SecurityManagerTest {
        assertTrue("Valid signed packet from known peer should be accepted", result)
    }

+    @Test
+    fun `validatePacket rejects unsigned and invalidly signed LEAVE packets`() {
+        setupKnownPeer(otherPeerID, otherSigningKey)
+
+        val unsigned = BitchatPacket(
+            type = MessageType.LEAVE.value,
+            ttl = 7u,
+            senderID = otherPeerID,
+            payload = byteArrayOf()
+        )
+        assertFalse("Unsigned LEAVE must not evict or relay the claimed peer", securityManager.validatePacket(unsigned, otherPeerID))
+
+        val invalid = BitchatPacket(
+            type = MessageType.LEAVE.value,
+            ttl = 7u,
+            senderID = otherPeerID,
+            payload = "forged".toByteArray()
+        ).also { it.signature = invalidSignature }
+        assertFalse("Bad LEAVE signature must be rejected", securityManager.validatePacket(invalid, otherPeerID))
+    }
+
+    @Test
+    fun `validatePacket accepts signed LEAVE from known peer`() {
+        setupKnownPeer(otherPeerID, otherSigningKey)
+        val packet = BitchatPacket(
+            type = MessageType.LEAVE.value,
+            ttl = 7u,
+            senderID = otherPeerID,
+            payload = byteArrayOf()
+        ).also { it.signature = validSignature }
+
+        assertTrue("A valid signed LEAVE remains wire-compatible", securityManager.validatePacket(packet, otherPeerID))
+        assertTrue(fakeEncryptionService.lastVerifyKey.contentEquals(otherSigningKey))
+    }
+
    @Test
    fun `validatePacket - accepts ANNOUNCE packet from unknown peer (extracts key)`() {
        val announcement = IdentityAnnouncement(
@@ -205,6 +261,33 @@ class SecurityManagerTest {
        assertFalse("ANNOUNCE with malformed payload should be rejected (cannot extract key)", result)
    }

+    @Test
+    fun `validatePacket rejects self-signed announce whose Noise key derives another sender ID`() {
+        val attackerNoiseKey = ByteArray(32) { 0x6B }
+        val announcement = IdentityAnnouncement("Attacker", attackerNoiseKey, otherSigningKey)
+        val packet = BitchatPacket(
+            type = MessageType.ANNOUNCE.value,
+            ttl = 7u,
+            senderID = unknownPeerID,
+            payload = announcement.encode()!!
+        ).also { it.signature = validSignature }
+
+        assertFalse(securityManager.validatePacket(packet, unknownPeerID))
+    }
+
+    @Test
+    fun `validatePacket rejects announce packet under a different routed sender`() {
+        val announcement = IdentityAnnouncement("Peer", otherNoiseKey, otherSigningKey)
+        val packet = BitchatPacket(
+            type = MessageType.ANNOUNCE.value,
+            ttl = 7u,
+            senderID = unknownPeerID,
+            payload = announcement.encode()!!
+        ).also { it.signature = validSignature }
+
+        assertFalse(securityManager.validatePacket(packet, otherPeerID))
+    }
+
    @Test
    fun `validatePacket - ignores own packets`() {
        val packet = BitchatPacket(
@@ -270,6 +353,86 @@ class SecurityManagerTest {
        assertTrue("Fresh duplicate ANNOUNCE should be accepted", securityManager.validatePacket(packet3, unknownPeerID))
    }

+    @Test
+    fun `replacement message one sends response without evicting or falsely completing`() = runBlocking {
+        val response = byteArrayOf(0x31, 0x32)
+        fakeEncryptionService.handshakeResult = NoiseHandshakeProcessingResult(response, false)
+        val routed = handshakePacket(byteArrayOf(0x01, 0x02, 0x03))
+
+        val accepted = securityManager.handleNoiseHandshake(routed)
+
+        assertTrue(accepted)
+        assertTrue(fakeEncryptionService.removePeerCalls == 0)
+        verify(mockDelegate).sendHandshakeResponse(otherPeerID, response)
+        verify(mockDelegate, never()).onKeyExchangeCompleted(any(), any(), anyOrNull(), anyOrNull())
+    }
+
+    @Test
+    fun `identity mismatch preserves peer and does not poison retry or completion`() = runBlocking {
+        val routed = handshakePacket(byteArrayOf(0x41, 0x42, 0x43))
+        fakeEncryptionService.handshakeError = NoiseSessionError.PeerIdentityMismatch(
+            otherPeerID,
+            "0000000000000000"
+        )
+
+        assertFalse(securityManager.handleNoiseHandshake(routed))
+        assertTrue(fakeEncryptionService.removePeerCalls == 0)
+        verify(mockDelegate, never()).sendHandshakeResponse(any(), any())
+        verify(mockDelegate, never()).onKeyExchangeCompleted(any(), any(), anyOrNull(), anyOrNull())
+
+        fakeEncryptionService.handshakeError = null
+        fakeEncryptionService.handshakeResult = NoiseHandshakeProcessingResult(
+            response = null,
+            establishedNow = true,
+            authenticatedRemoteStaticKey = otherNoiseKey
+        )
+        assertTrue("Failed frames must not poison the processed-exchange cache", securityManager.handleNoiseHandshake(routed))
+        assertTrue(fakeEncryptionService.handshakeCalls == 2)
+        verify(mockDelegate).onKeyExchangeCompleted(
+            otherPeerID,
+            otherNoiseKey,
+            "direct-link",
+            "direct-link-token"
+        )
+    }
+
+    @Test
+    fun `completion callback fires only for the frame that establishes a bound session`() = runBlocking {
+        fakeEncryptionService.handshakeResult = NoiseHandshakeProcessingResult(
+            response = null,
+            establishedNow = true,
+            authenticatedRemoteStaticKey = otherNoiseKey
+        )
+        val routed = handshakePacket(byteArrayOf(0x51, 0x52, 0x53))
+
+        assertTrue(securityManager.handleNoiseHandshake(routed))
+
+        verify(mockDelegate, times(1)).onKeyExchangeCompleted(
+            otherPeerID,
+            otherNoiseKey,
+            "direct-link",
+            "direct-link-token"
+        )
+        verify(mockDelegate, never()).sendHandshakeResponse(any(), any())
+        assertTrue(fakeEncryptionService.removePeerCalls == 0)
+    }
+
+    @Test
+    fun `relayed completion does not authenticate the relay as the peer link`() = runBlocking {
+        fakeEncryptionService.handshakeResult = NoiseHandshakeProcessingResult(
+            response = null,
+            establishedNow = true,
+            authenticatedRemoteStaticKey = otherNoiseKey
+        )
+        val routed = handshakePacket(
+            payload = byteArrayOf(0x61, 0x62, 0x63),
+            ttl = 6u
+        )
+
+        assertTrue(securityManager.handleNoiseHandshake(routed))
+        verify(mockDelegate).onKeyExchangeCompleted(otherPeerID, otherNoiseKey, null, null)
+    }
+
    private fun setupKnownPeer(peerID: String, signingKey: ByteArray) {
        val info = PeerInfo(
            id = peerID,
@@ -283,4 +446,25 @@ class SecurityManagerTest {
        )
        whenever(mockDelegate.getPeerInfo(peerID)).thenReturn(info)
    }
+
+    private fun handshakePacket(payload: ByteArray, ttl: UByte = 7u): RoutedPacket {
+        val packet = BitchatPacket(
+            version = 1u,
+            type = MessageType.NOISE_HANDSHAKE.value,
+            senderID = otherPeerID.hexToBytes(),
+            recipientID = myPeerID.hexToBytes(),
+            timestamp = System.currentTimeMillis().toULong(),
+            payload = payload,
+            ttl = ttl
+        )
+        return RoutedPacket(
+            packet = packet,
+            peerID = otherPeerID,
+            relayAddress = "direct-link",
+            ingressLinkID = "direct-link-token"
+        )
+    }
+
+    private fun String.hexToBytes(): ByteArray =
+        chunked(2).map { it.toInt(16).toByte() }.toByteArray()
 }
@@ -0,0 +1,217 @@
+package com.bitchat.android.noise
+
+import com.bitchat.android.noise.southernstorm.protocol.Noise
+import org.junit.After
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotSame
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertSame
+import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
+import org.junit.Test
+
+class NoiseSessionManagerIdentityBindingTest {
+    private data class TestIdentity(
+        val privateKey: ByteArray,
+        val publicKey: ByteArray,
+        val peerID: String
+    )
+
+    private val managers = mutableListOf<NoiseSessionManager>()
+
+    @After
+    fun tearDown() {
+        managers.forEach(NoiseSessionManager::shutdown)
+    }
+
+    @Test
+    fun `valid derived identities establish in initiator and responder roles`() {
+        val alice = identity()
+        val bob = identity()
+        val aliceManager = manager(alice)
+        val bobManager = manager(bob)
+
+        completeHandshake(aliceManager, alice.peerID, bobManager, bob.peerID)
+
+        assertTrue(aliceManager.hasEstablishedSession(bob.peerID))
+        assertTrue(bobManager.hasEstablishedSession(alice.peerID))
+        assertArrayEquals(bob.publicKey, aliceManager.getRemoteStaticKey(bob.peerID))
+        assertArrayEquals(alice.publicKey, bobManager.getRemoteStaticKey(alice.peerID))
+
+        val plaintext = "bound transport".toByteArray()
+        val ciphertext = aliceManager.encrypt(plaintext, bob.peerID)
+        assertArrayEquals(plaintext, bobManager.decrypt(ciphertext, alice.peerID))
+    }
+
+    @Test
+    fun `initiator rejects remote static key before returning message three`() {
+        val alice = identity()
+        val bob = identity()
+        val victim = identity()
+        val aliceManager = manager(alice)
+        val bobManager = manager(bob)
+        var authenticatedCallbacks = 0
+        aliceManager.onSessionEstablished = { _, _ -> authenticatedCallbacks += 1 }
+
+        val message1 = aliceManager.initiateHandshake(victim.peerID)!!
+        val message2 = bobManager.processHandshakeMessage(alice.peerID, message1)!!
+
+        expectIdentityMismatch {
+            aliceManager.processHandshakeMessage(victim.peerID, message2)
+        }
+
+        assertFalse(aliceManager.hasEstablishedSession(victim.peerID))
+        assertNull(aliceManager.getSession(victim.peerID))
+        assertTrue("No authenticated callback may escape a mismatched initiator", authenticatedCallbacks == 0)
+    }
+
+    @Test
+    fun `responder rejects authenticated initiator key under a different claimed ID`() {
+        val alice = identity()
+        val bob = identity()
+        val victim = identity()
+        val aliceManager = manager(alice)
+        val bobManager = manager(bob)
+        var authenticatedCallbacks = 0
+        bobManager.onSessionEstablished = { _, _ -> authenticatedCallbacks += 1 }
+
+        val message1 = aliceManager.initiateHandshake(bob.peerID)!!
+        val message2 = bobManager.processHandshakeMessage(victim.peerID, message1)!!
+        val message3 = aliceManager.processHandshakeMessage(bob.peerID, message2)!!
+
+        expectIdentityMismatch {
+            bobManager.processHandshakeMessage(victim.peerID, message3)
+        }
+
+        assertFalse(bobManager.hasEstablishedSession(victim.peerID))
+        assertNull(bobManager.getSession(victim.peerID))
+        assertTrue("No authenticated callback may escape a mismatched responder", authenticatedCallbacks == 0)
+    }
+
+    @Test
+    fun `mismatched responder replacement preserves established session and transport keys`() {
+        val alice = identity()
+        val bob = identity()
+        val attacker = identity()
+        val aliceManager = manager(alice)
+        val bobManager = manager(bob)
+        val attackerManager = manager(attacker)
+        var aliceAuthenticatedCallbacks = 0
+        aliceManager.onSessionEstablished = { _, _ -> aliceAuthenticatedCallbacks += 1 }
+
+        completeHandshake(aliceManager, alice.peerID, bobManager, bob.peerID)
+        val originalSession = aliceManager.getSession(bob.peerID)
+        assertTrue(aliceAuthenticatedCallbacks == 1)
+
+        val attackerMessage1 = attackerManager.initiateHandshake(alice.peerID)!!
+        val aliceMessage2 = aliceManager.processHandshakeMessage(bob.peerID, attackerMessage1)!!
+        val attackerMessage3 = attackerManager.processHandshakeMessage(alice.peerID, aliceMessage2)!!
+
+        expectIdentityMismatch {
+            aliceManager.processHandshakeMessage(bob.peerID, attackerMessage3)
+        }
+
+        assertSame("Rejected candidate must not replace the working session", originalSession, aliceManager.getSession(bob.peerID))
+        assertTrue(aliceManager.hasEstablishedSession(bob.peerID))
+        assertArrayEquals(bob.publicKey, aliceManager.getRemoteStaticKey(bob.peerID))
+        assertTrue("Rejected replacement must not fire authentication callback", aliceAuthenticatedCallbacks == 1)
+
+        val plaintext = "original session survives".toByteArray()
+        val ciphertext = aliceManager.encrypt(plaintext, bob.peerID)
+        assertArrayEquals(plaintext, bobManager.decrypt(ciphertext, alice.peerID))
+
+        // The failed candidate must be fully removed so a later valid restart can replace cleanly.
+        val restartedBobManager = manager(bob)
+        val validMessage1 = restartedBobManager.initiateHandshake(alice.peerID)!!
+        val validMessage2 = aliceManager.processHandshakeMessage(bob.peerID, validMessage1)!!
+        val validMessage3 = restartedBobManager.processHandshakeMessage(alice.peerID, validMessage2)!!
+        assertNull(aliceManager.processHandshakeMessage(bob.peerID, validMessage3))
+        assertTrue(aliceAuthenticatedCallbacks == 2)
+
+        val retriedPlaintext = "valid retry promoted".toByteArray()
+        val retriedCiphertext = restartedBobManager.encrypt(retriedPlaintext, alice.peerID)
+        assertArrayEquals(retriedPlaintext, aliceManager.decrypt(retriedCiphertext, bob.peerID))
+    }
+
+    @Test
+    fun `valid responder replacement promotes only after bound handshake completes`() {
+        val alice = identity()
+        val bob = identity()
+        val aliceManager = manager(alice)
+        val originalBobManager = manager(bob)
+        var aliceAuthenticatedCallbacks = 0
+        aliceManager.onSessionEstablished = { _, _ -> aliceAuthenticatedCallbacks += 1 }
+
+        completeHandshake(aliceManager, alice.peerID, originalBobManager, bob.peerID)
+        val originalSession = aliceManager.getSession(bob.peerID)
+
+        // Simulate Bob restarting with the same persistent static identity and no session state.
+        val restartedBobManager = manager(bob)
+        val message1 = restartedBobManager.initiateHandshake(alice.peerID)!!
+        val message2 = aliceManager.processHandshakeMessage(bob.peerID, message1)!!
+        val message3 = restartedBobManager.processHandshakeMessage(alice.peerID, message2)!!
+        assertNull(aliceManager.processHandshakeMessage(bob.peerID, message3))
+
+        assertNotSame(originalSession, aliceManager.getSession(bob.peerID))
+        assertTrue(aliceManager.hasEstablishedSession(bob.peerID))
+        assertArrayEquals(bob.publicKey, aliceManager.getRemoteStaticKey(bob.peerID))
+        assertTrue(aliceAuthenticatedCallbacks == 2)
+
+        val plaintext = "replacement transport".toByteArray()
+        val ciphertext = restartedBobManager.encrypt(plaintext, alice.peerID)
+        assertArrayEquals(plaintext, aliceManager.decrypt(ciphertext, bob.peerID))
+    }
+
+    @Test
+    fun `peer ID derivation rejects malformed keys and non-wire claims`() {
+        val peer = identity()
+
+        assertTrue(NoisePeerIdentity.matchesClaimedPeerID(peer.peerID, peer.publicKey))
+        assertFalse(NoisePeerIdentity.matchesClaimedPeerID(peer.peerID.uppercase(), peer.publicKey))
+        assertFalse(NoisePeerIdentity.matchesClaimedPeerID("not-a-wire-id", peer.publicKey))
+        assertFalse(NoisePeerIdentity.matchesClaimedPeerID(peer.peerID, ByteArray(31)))
+        assertNull(NoisePeerIdentity.derivePeerID(ByteArray(31)))
+    }
+
+    private fun completeHandshake(
+        initiator: NoiseSessionManager,
+        initiatorPeerID: String,
+        responder: NoiseSessionManager,
+        responderPeerID: String
+    ) {
+        val message1 = initiator.initiateHandshake(responderPeerID)!!
+        val message2 = responder.processHandshakeMessage(initiatorPeerID, message1)!!
+        val message3 = initiator.processHandshakeMessage(responderPeerID, message2)!!
+        assertNull(responder.processHandshakeMessage(initiatorPeerID, message3))
+    }
+
+    private fun expectIdentityMismatch(block: () -> Unit) {
+        try {
+            block()
+            fail("Expected authenticated Noise key to be rejected for the claimed peer ID")
+        } catch (_: NoiseSessionError.PeerIdentityMismatch) {
+            // Expected.
+        }
+    }
+
+    private fun manager(identity: TestIdentity): NoiseSessionManager = NoiseSessionManager(
+        localStaticPrivateKey = identity.privateKey,
+        localStaticPublicKey = identity.publicKey,
+        localPeerID = identity.peerID
+    ).also { managers += it }
+
+    private fun identity(): TestIdentity {
+        val dh = Noise.createDH("25519")
+        return try {
+            dh.generateKeyPair()
+            val privateKey = ByteArray(32)
+            val publicKey = ByteArray(32)
+            dh.getPrivateKey(privateKey, 0)
+            dh.getPublicKey(publicKey, 0)
+            TestIdentity(privateKey, publicKey, NoisePeerIdentity.derivePeerID(publicKey)!!)
+        } finally {
+            dh.destroy()
+        }
+    }
+}
@@ -0,0 +1,64 @@
+package com.bitchat.android.wifiaware
+
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertSame
+import org.junit.Test
+
+class AuthenticatedIngressLinkPolicyTest {
+    @Test
+    fun `authentication promotes only the exact ingress link`() {
+        val attackerSocket = Any()
+        val victimSocket = Any()
+        val links = mapOf(
+            "attacker-link" to AuthenticatedIngressLinkPolicy.Link("provisional-attacker", attackerSocket),
+            "victim-link" to AuthenticatedIngressLinkPolicy.Link("provisional-victim", victimSocket)
+        )
+        val current = mapOf(
+            "provisional-attacker" to attackerSocket,
+            "provisional-victim" to victimSocket
+        )
+
+        val resolved = AuthenticatedIngressLinkPolicy.resolve(
+            authenticatedLinkID = "victim-link",
+            authenticatedRelayAddress = "provisional-victim",
+            links = links,
+            currentTransportForRelay = current::get
+        )
+
+        assertSame(victimSocket, resolved?.transport)
+    }
+
+    @Test
+    fun `stale replaced or mismatched ingress links cannot be promoted`() {
+        val completedSocket = Any()
+        val replacementSocket = Any()
+        val links = mapOf(
+            "completed-link" to AuthenticatedIngressLinkPolicy.Link("provisional", completedSocket)
+        )
+
+        assertNull(
+            AuthenticatedIngressLinkPolicy.resolve(
+                authenticatedLinkID = "missing-link",
+                authenticatedRelayAddress = "provisional",
+                links = links,
+                currentTransportForRelay = { completedSocket }
+            )
+        )
+        assertNull(
+            AuthenticatedIngressLinkPolicy.resolve(
+                authenticatedLinkID = "completed-link",
+                authenticatedRelayAddress = "different-provisional",
+                links = links,
+                currentTransportForRelay = { completedSocket }
+            )
+        )
+        assertNull(
+            AuthenticatedIngressLinkPolicy.resolve(
+                authenticatedLinkID = "completed-link",
+                authenticatedRelayAddress = "provisional",
+                links = links,
+                currentTransportForRelay = { replacementSocket }
+            )
+        )
+    }
+}
@@ -0,0 +1,49 @@
+# Noise peer-ID binding
+
+Mesh wire peer IDs are exactly 16 lowercase hexadecimal characters derived as
+`hex(SHA-256(noiseStaticPublicKey)[0..<8])`. Android enforces that binding at
+both identity entry points:
+
+- A verified announcement must carry a 32-byte Noise static key whose derived
+  ID matches both the packet sender and routed sender.
+- A Noise XX initiator or responder must authenticate a remote static key whose
+  derived ID matches the claimed session key before transport ciphers are
+  exposed or an authentication callback runs.
+
+Inbound rehandshakes use a separate responder candidate. An established
+session remains active until the candidate completes and passes the binding;
+failure or mismatch destroys only the candidate. BLE mappings, Wi-Fi socket
+rebinds, gossip, sync, and peer-last-seen effects run only after announcement
+validation succeeds. A Wi-Fi discovery identity is not destructively rebound
+from a self-signed announce. A direct announce may start the canonical
+handshake, but the alias is promoted only when the exact, still-active socket
+delivers the Noise frame that completes bound authentication. A peer-ID-only
+or stale-socket callback cannot authorize that rebind.
+
+Leave packets use the existing signed wire format and are accepted only when
+the signature matches the key learned from a verified announcement. Invalid or
+unsigned leaves therefore cannot evict the claimed peer or be relayed. A valid
+leave removes the peer through the normal peer-manager path, which also clears
+its active Noise session.
+
+Announcements no longer write fingerprint mappings. Those mappings are created
+only by the authenticated Noise-session callback. A known peer's signing key
+also cannot change based on an announcement or merely because some session for
+that peer ID is active. Rotation requires an authenticated peer-state proof
+tied to the exact Noise channel; ambient session presence is not enough.
+The same authenticated callback restores any existing Noise-key-to-Nostr
+relationship under the canonical 16-hex mesh ID; unproven announcements never
+write that routing index.
+
+## Remaining TOFU boundary
+
+The first public announcement is still self-signed trust-on-first-use. An
+attacker can copy a public Noise key and self-sign an announcement, but cannot
+complete the bound Noise handshake for that ID. Public-mesh identity admission
+is intentionally not gated behind an automatic handshake in this change; doing
+so is a separate availability/protocol decision.
+
+Consequently, discovery metadata or capability bits in an announcement are
+hints, not proof of Noise-key possession. Security-sensitive capabilities must
+be confirmed inside the authenticated Noise channel before they are pinned or
+used to authorize a downgrade-sensitive behavior.