Harden request PoW policy and P2P defaults

[richardikeda]

What

Completes the next coherent P0 remediation batch for request proof-of-work policy and P2P network exposure.

Why

The previous request path enforced only an implicit global PoW minimum. It did not expose a trusted receiver-owned policy, bind work to the request fields, enforce request freshness, or remember accepted requests across the normal persisted flow. The P2P configuration also described a localhost default while listening on all IPv4 interfaces.

Changes

• Add a strict default RequestPowPolicy owned by the receiver.
• Bind request PoW to sender, recipient, role, and creation timestamp.
• Enforce a five-minute request window and 30 seconds of future clock skew.
• Persist normalized accepted-request identifiers and reject exact replay.
• Add explicit policy APIs for integrations that need a stronger minimum or a deliberate PoW opt-out.
• Change the P2P default listener to /ip4/127.0.0.1/tcp/0.
• Preserve explicit external listeners supplied through --listen-addr.
• Mark the completed PoW and P2P items in docs/p0.md with evidence.

Security Impact

Yes.

• A malicious sender cannot lower the receiver-owned PoW minimum.
• A valid puzzle cannot be substituted onto another sender, recipient, role, or timestamp.
• Missing, malformed, stale, replayed, and under-difficulty requests are rejected.
• The persisted replay field uses serde(default), so existing local-state envelopes remain readable.
• External P2P exposure becomes an explicit operator decision.
• No protocol field, CBOR wire representation, signature algorithm, hash algorithm, cfg_hash, epoch rule, or cryptographic primitive changes.

Tests

• cargo test -p spex-client --lib --locked
• cargo test -p spex-client --test e2e_flow --locked
• cargo test -p spex-transport --lib --locked
• cargo fmt --all -- --check
• cargo clippy --workspace --locked --all-targets --all-features -- -D warnings
• cargo test --workspace --locked --all-features
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --all-features
• cargo audit
• cargo deny check
• scripts/release_gate_docs.sh through an in-memory CRLF normalization on Windows
• scripts/release_gate_negative_test.sh through an in-memory CRLF normalization on Windows

All commands passed locally on 2026-07-26. cargo audit retains the existing allowed paste maintenance warning; cargo deny retains the documented duplicate/advisory-not-detected warnings.

Documentation

• README.md
• TESTS.md
• CHANGELOG.md
• docs/p0.md
• docs/security.md
• docs/integration.md
• docs/cli.md

Versioning

New version in VERSION.md: 1.0.29.

Notes for Reviewers

• Review the receiver policy defaults and request-field domain separation.
• Confirm replay rejection occurs in the persisted CLI/client path.
• Confirm external P2P listeners still require an explicit multiaddress.
• The MLS backend decision remains the next major P0 architecture block and is intentionally not mixed into this PR.

Assisted-by: AI agent (reviewed by maintainer)