feat: one-way trust + require hardware-backed key storage

[YairEtzion]

Summary

One-way trust directionality (new)

• Enforce asymmetric trust — after pairing, controllers can authenticate to targets but targets cannot authenticate back. Limits blast radius of a compromised server.
• Role field added to AllowListDevice (controller | target), enforced in verification middleware (Step 3b)
• Single-controller default — targets allow one controller by default. Configurable via amesh init --max-controllers N
• amesh list now shows [controller] / [target] role tags
• Legacy migration — existing allow lists without role field default to controller on first read
• ADR-010 documents the design decision and trade-offs
• All docs, landing page, sitemap updated to reflect one-way trust model

Hardware-only key storage

• Dropped the encrypted-file backend — amesh now requires Secure Enclave, macOS Keychain, or TPM 2.0. No software-only fallback.
• Removed all passphrase / AUTH_MESH_PASSPHRASE plumbing from CLI, SDK, detection chain, and all documentation.
• Removed CI/CD and Kubernetes use case pages from the landing page — ephemeral compute without hardware is not supported.

Files changed (22 files, +357/-92 in latest commit)

Code

• packages/keystore/src/allow-list.ts — role field, countByRole(), replaceByRole(), legacy migration
• packages/sdk/src/middleware.ts — Step 3b directionality check (rejects role: "target")
• packages/sdk/src/amesh.ts — Same directionality check in simple verify API
• packages/cli/src/commands/listen.ts — Sets peer role to controller, enforces maxControllers limit with replace prompt
• packages/cli/src/commands/invite.ts — Sets peer role to target
• packages/cli/src/commands/init.ts — --max-controllers flag
• packages/cli/src/commands/list.ts — Shows [controller]/[target] tags
• packages/cli/src/identity.ts — maxControllers optional field
• packages/sdk/src/bootstrap.ts — Sets role to controller for bootstrap flow
• packages/keystore/src/detect.ts — Hardware-only detection

Tests

• packages/keystore/src/__tests__/allow-list.test.ts — 4 new tests (role storage, countByRole, replaceByRole, legacy migration)
• packages/sdk/src/__tests__/middleware.test.ts — 1 new test (rejects target-role device)

Documentation

• README.md — One-way trust in architecture diagram and "How It Works"
• docs/protocol-spec.md — Step 3b, role field in allow list schema, security considerations
• docs/architecture-decisions.md — ADR-010: One-way trust directionality
• docs/guide.md — Role tags in amesh list, pairing section explains one-way trust
• docs/integration-guide.md — Architecture diagrams, setup comments, microservices recipe
• docs/self-hosting.md — Architecture diagram with controller/target labels
• docs/why-amesh.md — Security model sentence

Landing page

• landpage/src/routes/+page.svelte — CLI output, feature card, step descriptions
• landpage/src/routes/docs/integration/+page.svelte — Architecture overview, setup comments
• landpage/src/routes/use-cases/microservices/+page.svelte — Terminal tab
• landpage/static/sitemap.xml — Updated lastmod dates

Test plan

• bun run build passes (all packages + landing page)
• bun run test passes (all existing + 5 new tests)
• Middleware rejects requests from devices with role: "target" (401)
• Legacy allow lists without role field migrate to controller on read
• replaceByRole() correctly swaps controllers and preserves targets
• Manual: pair two devices, verify amesh list shows correct roles
• Visual review of landing page after deploy

🤖 Generated with Claude Code