[vikranthreddimasu]

Summary

• Strictly validate all known HardwareExchange fields before accepting peer JSON.
• Reject invalid local hardware profiles before signing or serializing them.
• Validate signed APING and APONG hardware payloads before heartbeat success.
• Strengthen fuzz coverage so malformed fields always fail with HandshakeHwValidationError.

Security changes

• Reject booleans and numeric strings for numeric fields.
• Require finite, bounded GPU, RAM, memory-bandwidth, wire-version, and port values.
• Require exact booleans and bounded printable UTF-8 chip names.
• Reject malformed but correctly signed heartbeat metadata in both directions.

Usability changes

• Prevent invalid peer telemetry from corrupting coordinator scores or data-port selection.
• Keep validation errors field-specific for diagnosis.

Tests/checks run

• 94 focused handshake, heartbeat, and fuzz tests passed.
• Full suite: 1150 passed, 3 skipped, 2 existing deprecation warnings.
• make lint passed: Ruff clean; mypy clean across 55 source files.
• Wheel build passed.
• git diff --check passed.
• Gitleaks scanned all 4 commits; no leaks found.
• No new torch or mlx imports in communication or pool changes.
• All 11 GitHub Actions checks passed.

Commits

• de567af Validate peer hardware exchange fields
• cff6798 Reject invalid local hardware profiles
• b7cc326 Reject malformed heartbeat hardware
• 39d56d7 Validate gossip hardware responses

Risks / manual review notes

• This changes validation on authenticated handshake and heartbeat metadata.
• Please manually review compatibility bounds and fail-closed behavior.
• Intentionally not auto-merged under the security-change gate.

Merge status

• Not merged; awaiting manual security review.