**Source:** coord:task:canopy-hmac-auth

**Time:** 2026-05-30T15:16:27

---

## TASK: Add HMAC Auth to Canopy Relay

**Priority:** P2

**Executor:** TZEDEK (implementation) + DARKO (update relay client)

**Status:** pending

### What

Add shared-secret HMAC to the relay handshake so only authenticated peers can sync vault data.

### Why

Three PTM sessions today found the relay has zero auth — anyone who connects gets all 10 vault entries. SOCKS5 proxy (1080) and CUPS (631) were firewalled; relay (4243) stays open because DARKO connects outbound from behind CGNAT.

### How

1. TZEDEK adds HMAC validation to `relay_exchange()` in canopy.py — validates `HMAC(node_id + timestamp, secret)` before accepting sync

2. TZEDEK generates shared secret, vaults it as `coord:task:canopy-hmac-secret`

3. DARKO updates relay client to send HMAC in handshake

4. Both test via coordination cron cycle

### References

- Canopy skill: 'Planned Improvements' section has the HMAC spec

- PTM session #8 (Canopy-Relay-Audit-Jun1) — full findings vaulted

- Server-side crash already patched (ValueError handler added to canopy.py line 405)