fix(gateway): pin paired reconnect metadata for node policy

2026-02-26 14:10:00 +01:00
parent cf311978ea
commit 7d8aeaaf06
13 changed files with 282 additions and 39 deletions
--- a/docs/concepts/architecture.md
+++ b/docs/concepts/architecture.md
@@ -98,6 +98,9 @@ sequenceDiagram
 - **Local** connects (loopback or the gateway host’s own tailnet address) can be
  auto‑approved to keep same‑host UX smooth.
 - All connects must sign the `connect.challenge` nonce.
+- Signature payload `v3` also binds `platform` + `deviceFamily`; the gateway
+  pins paired metadata on reconnect and requires repair pairing for metadata
+  changes.
 - **Non‑local** connects still require explicit approval.
 - Gateway auth (`gateway.auth.*`) still applies to **all** connections, local or
  remote.