[polius]

Follow-up to a senior production-readiness audit of the project. Each change is empirically verified — the full -race suite, golangci-lint, and deadcode -test are all green.

Findings addressed

#	Sev	Finding	Fix
1	MEDIUM	Receiver didn't enforce the sender's declared FileInfo.Size	A PAKE-authenticated but misbehaving sender could advertise a small size yet stream unbounded chunks (the root-hash check only runs after the loop), exhausting the receiver's disk. The receive loop now rejects once bytesWritten + len > info.Size for non-streaming files; streaming items (stdin/--text) stay exempt by design.
3	LOW	Three production methods with no production caller	Removed connpath.Info.Glyph (its logic was duplicated inline in printPath), signaling.Client.Health (the Docker probe uses a raw http.Get), and quicconn.Listener.LocalAddr, plus their now-redundant tests.
4	LOW	--connect default,<pw> silently dropped the password	Now returns E024 — --connect default takes no password.
5	LOW	--connect conflict list omitted --exclude	Added exclude and mode (both transfer-only) to the conflict list.
6	LOW	Post-quantum guarantee was unpinned and untested	Pinned CurvePreferences = {X25519MLKEM768, X25519} explicitly in both TLS configs so a toolchain default change or GODEBUG=tlsmlkem=0 can't silently downgrade the advertised PQ exchange. New TestNegotiatesPostQuantum asserts two peers land on the hybrid on the wire.
7	LOW	/v1/relay/status lacked per-session auth	Bearer-gated with the session role token, matching /v1/relay/allocate. A third party who only sniffed the session_id could previously probe eviction state; missing-session and unauthorized callers now both return "unknown" (no existence oracle).

Finding #2 (the server unconditionally trusts X-Real-IP/X-Forwarded-For — safe behind the shipped Caddy config, a footgun for direct-exposure self-hosters) is intentionally not in this PR; it needs a deployment-policy decision (TrustProxyHeaders config vs. docs-only).

Verification

• go build / go vet — clean
• go test -race -count=1 ./... — all 18 packages pass, 0 races (incl. the 40s e2e suite)
• golangci-lint run — 0 issues
• deadcode -test ./... — clean (the CI gate)
• Rebuilt binary: confirmed Bump golangci/golangci-lint-action from 8 to 9 #4/Bump docker/setup-buildx-action from 3 to 4 #5 reject with E024 while legitimate --connect host,pw / --connect default still work

Notes

• While wiring Bump actions/attest-build-provenance from 2 to 4 #3, swapping the removed Health() for Create() in two transport-error tests made internal/signaling hang under -race (a POST-with-body teardown left the test's hanging server handler alive, blocking httptest.Close). Switched those to the bodyless RelayStatus GET.
• Bump actions/checkout from 4 to 6 #1 has no bespoke adversarial test: a protocol-faithful malicious sender would be ~100 lines of fragile wire-mirroring, the happy path (no false-trigger) is already covered by every roundtrip/e2e test, and the negative branch is trivially correct.

🤖 Generated with Claude Code