Bump 0.3.0-preview.1 -> 0.3.0-preview.2 (release the v1->v2 remediation)

- All three packages bumped in lockstep: csproj <Version> and new explicit
  <FileVersion>0.3.0.2</FileVersion>. AssemblyVersion stays at 0.3.0.0 by SDK
  default (verified against produced DLLs).
- Updated <PackageReleaseNotes> on all three to call out the wire-format break.
- README install commands point at 0.3.0-preview.2.
- CHANGELOG restructured: new [0.3.0-preview.2] section carries the protocol-v2
  remediation (HKDF HkdfLabel framing, transcript length-prefix framing,
  AntiReplayWindow Commit guard, five pinned-KAT test files, maturity-framing
  docs); [0.3.0-preview.1] reverts to the original ecosystem-foundation
  description that matches what is actually live on NuGet.
- 450/450 tests pass on net8.0 / net9.0 / net10.0 at preview.2.

This is the release of commit 6a7e6d2's content.

Soli Deo gloria - 1 Corinthians 10:31

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: systemslibrarian

CHANGELOG.md

@@ -4,34 +4,26 @@ All notable changes to PostQuantum.SecureChannel are documented here. This proje
 [Semantic Versioning](https://semver.org/). While pre-1.0, the wire format and API may change between
 preview releases.
 
-## [0.3.0-preview.1]
+## [0.3.0-preview.2]
+
+**External-review remediation of the protocol glue.** This release bumps `PqProtocol.Version` from
+`1` to `2`. It is a **wire-format break with `0.3.0-preview.1`** — v1 and v2 peers fail cleanly at
+version negotiation (`PqProtocolException("No mutually supported protocol version...")`); they do
+not silently mis-decrypt. Adopters running `0.3.0-preview.1` must update both ends to talk again.
+See `KNOWN-GAPS.md` §13 and `docs/protocol.md` §10 for the full statement.
+
+### Wire-format & protocol-version bump to 2
 
-> **Post-publication remediation note.** This release window also incorporates an external-review
-> wire-format change (protocol version `1` → `2`). Peers built from the pre-remediation snapshot of
-> `0.3.0-preview.1` are NOT interoperable with peers built from the post-remediation snapshot —
-> handshakes fail cleanly at version negotiation. The package version stays at `0.3.0-preview.1`
-> because preview tags absorb wire changes; see "Wire-format & protocol-version bump to 2" below
-> and `KNOWN-GAPS.md` §13 for adopter guidance.
-
-An **ecosystem-foundation release**. The original 0.3.0 line was an ecosystem release with no core
-wire-format changes (0.3.0 talked to 0.2.x peers). The post-remediation snapshot is wire-incompatible
-with both 0.2.x and the pre-remediation 0.3.0-preview.1 snapshot.
-What's new is shape: companion packages, samples that look like real production, and the
-documentation real engineers ask for before adopting a crypto library.
-
-### Wire-format & protocol-version bump to 2 (post-publication remediation)
-
-`PqProtocol.Version` is now `2`. Two findings from an external adversarial review of the protocol
-glue land here:
-
-- **HKDF info construction is now RFC 5869 / TLS 1.3-HkdfLabel compliant.** The previous wrapper
-  concatenated `ASCII label ‖ context` with no length framing, working only because every call site
-  used fixed labels and `context` was empty everywhere except the master expansion. The new
-  construction is `uint16_BE(length) ‖ uint8(label_len) ‖ label ‖ uint8(context_len) ‖ context`,
-  making `(length, label, context)` triples unambiguous by design and structurally precluding any
-  future label addition from silently colliding. Source: external review, Finding 2.
+Two findings from an external adversarial review of the protocol glue land here:
+
+- **HKDF info construction is now RFC 5869 / TLS 1.3-HkdfLabel compliant.** v1's wrapper concatenated
+  `ASCII label ‖ context` with no length framing, working only because every call site used fixed
+  labels and `context` was empty everywhere except the master expansion. The new construction is
+  `uint16_BE(length) ‖ uint8(label_len) ‖ label ‖ uint8(context_len) ‖ context`, making
+  `(length, label, context)` triples unambiguous by design and structurally precluding any future
+  label addition from silently colliding. Source: external review, Finding 2.
 - **Transcript hashing now length-prefixes each fragment.** `Transcript.Hash(a, b, …)` feeds
-  `uint32_BE(len(a)) ‖ a ‖ uint32_BE(len(b)) ‖ b ‖ …` into SHA-256. Today's call sites pass two
+  `uint32_BE(len(a)) ‖ a ‖ uint32_BE(len(b)) ‖ b ‖ …` into SHA-256. v1's call sites passed two
   self-framed messages and were unambiguous in practice, but the helper signature accepts any
   fragment list — length framing makes future ambiguity impossible. Source: external review,
   Finding 3.
@@ -42,10 +34,6 @@ glue land here:
 anti-replay bitmap shape, NIST SP 800-38D caps, and the three-message handshake state machine. This
 is a key-schedule and transcript-framing change, not a protocol-redesign.
 
-**Adopter action:** if you have any peer built from the pre-remediation snapshot of
-`0.3.0-preview.1`, both ends must update to this build before they can talk again. There is no
-negotiation between v1 and v2.
-
 ### Hardening (not wire-affecting)
 
 - `AntiReplayWindow.Commit` actively enforces the precondition documented since 0.2.1: committing a
@@ -61,24 +49,36 @@ negotiation between v1 and v2.
   label additions cannot silently collide.
 - `TranscriptFramingTests` — pins the per-fragment length-prefix and the boundary-distinguishing
   property.
-- `AntiReplayWrapTests` — regression-locks Step-0's analysis that sequence wrap rejects correctly.
+- `AntiReplayWrapTests` — regression-locks the analysis that sequence wrap rejects correctly.
 - `RecordNonceKatTests` — round-trips at and across an explicit `Ratchet()` boundary; asserts the
   nonce-prefix actually changes and that the sequence counter resets to 0.
 
+Suite is now 134 tests in the core project (450 total across the three projects × three TFMs).
+
 ### Honesty / maturity framing (no behavior change)
 
 - README gains a prominent top-of-file status banner: preview, NOT independently audited, evaluation
-  / internal-use only today. The existing security-properties table is unchanged but now prefaced
+  / internal-use only today. The existing security-properties table is unchanged but is now prefaced
   with "these are design intentions validated by the project's own tests, not audited guarantees."
 - `docs/AUDIT-SCOPE.md` (new) — per-surface scope and test-coverage map for an external reviewer.
 - `KNOWN-GAPS.md` §1 expanded with explicit protocol-composition risk language; §2 expanded with
-  concrete IETF-draft wire-format consequences; new §13 covering the v1↔v2 non-interop window.
+  concrete IETF-draft wire-format consequences; new §13 covering the v1↔v2 non-interop.
 - `docs/threat-model.md` — caveat above Goals and a key above the adversary-capability table
   clarifying that ✅ means "designed-and-tested-against", not "independently verified".
 
-### Original 0.3.0 content (pre-remediation)
+### Companion packages
+
+`PostQuantum.SecureChannel.AspNetCore` and `PostQuantum.SecureChannel.Testing` ship in lockstep at
+`0.3.0-preview.2`. They `<ProjectReference>` the core, so they inherit the wire-format break — a
+0.3.0-preview.2 AspNetCore endpoint requires 0.3.0-preview.2 clients and vice versa.
+
+## [0.3.0-preview.1]
 
-A no-core-wire-change ecosystem release adding:
+An **ecosystem-foundation release**. No core wire-format changes — 0.3.0-preview.1 talks to 0.2.x
+peers. What's new is shape: companion packages, samples that look like real production, and the
+documentation real engineers ask for before adopting a crypto library. *(Superseded for new
+adoption by `0.3.0-preview.2`, which is a wire-format break for the protocol-glue remediation
+above.)*
 
 ### New packages
 - **`PostQuantum.SecureChannel.AspNetCore`** — DI registration

README.md

@@ -57,11 +57,11 @@ no way to configure your way into a weak session.
 ## Install
 
 ```bash
-dotnet add package PostQuantum.SecureChannel --version 0.3.0-preview.1
+dotnet add package PostQuantum.SecureChannel --version 0.3.0-preview.2
 
 # Optional companions:
-dotnet add package PostQuantum.SecureChannel.AspNetCore --version 0.3.0-preview.1   # DI, WebSocket
-dotnet add package PostQuantum.SecureChannel.Testing    --version 0.3.0-preview.1   # tests only
+dotnet add package PostQuantum.SecureChannel.AspNetCore --version 0.3.0-preview.2   # DI, WebSocket
+dotnet add package PostQuantum.SecureChannel.Testing    --version 0.3.0-preview.2   # tests only
 ```
 
 Targets `net8.0`, `net9.0`, and `net10.0`. Wire-format-stable across the 0.2.x → 0.3.x line.

src/PostQuantum.SecureChannel.AspNetCore/PostQuantum.SecureChannel.AspNetCore.csproj

@@ -13,8 +13,9 @@
 
   <PropertyGroup>
     <PackageId>PostQuantum.SecureChannel.AspNetCore</PackageId>
-    <Version>0.3.0-preview.1</Version>
-    <PackageReleaseNotes>0.3.0-preview.1: Initial release of ASP.NET Core integration for PostQuantum.SecureChannel. Adds AddPostQuantumSecureChannel() DI registration with IConfiguration binding for pinned identities, a WebSocket adapter that wraps any HTTP WebSocket as a PqSecureChannelStream, and MapPqEndpoint() / MapPqWebSocket() endpoint helpers for minimal APIs.</PackageReleaseNotes>
+    <Version>0.3.0-preview.2</Version>
+    <FileVersion>0.3.0.2</FileVersion>
+    <PackageReleaseNotes>0.3.0-preview.2: Lockstep release with PostQuantum.SecureChannel 0.3.0-preview.2 (external-review remediation of the protocol glue: protocol-version bump 1 -> 2; HKDF + transcript-framing wire-format break). This package has no behavior changes of its own; it ProjectReferences PostQuantum.SecureChannel and therefore inherits the wire-format change. AspNetCore endpoints established with a 0.3.0-preview.2 server require 0.3.0-preview.2 clients (and vice versa); v1 peers fail cleanly at version negotiation.</PackageReleaseNotes>
     <Authors>Paul Clark</Authors>
     <Description>ASP.NET Core integration for PostQuantum.SecureChannel. Adds AddPostQuantumSecureChannel() DI registration with IConfiguration binding (server identity seed, pinned client keys, session preset), a PqWebSocketStream adapter that wraps any WebSocket as an encrypted Stream, a MapPqWebSocket() endpoint helper for minimal APIs, and a ws.AcceptPqClientAsync() client-side extension. Host a post-quantum secure WebSocket endpoint in roughly five lines of Program.cs.</Description>
     <Summary>ASP.NET Core integration (DI, IConfiguration, WebSocket adapter, endpoint helpers) for PostQuantum.SecureChannel.</Summary>

src/PostQuantum.SecureChannel.Testing/PostQuantum.SecureChannel.Testing.csproj

@@ -13,8 +13,9 @@
 
   <PropertyGroup>
     <PackageId>PostQuantum.SecureChannel.Testing</PackageId>
-    <Version>0.3.0-preview.1</Version>
-    <PackageReleaseNotes>0.3.0-preview.1: Initial release of test helpers for PostQuantum.SecureChannel. Provides PqDuplexStream (in-memory pair, no TCP) and PqHandshakeHarness (one-call client/server session pair) so tests stay focused on behavior instead of plumbing.</PackageReleaseNotes>
+    <Version>0.3.0-preview.2</Version>
+    <FileVersion>0.3.0.2</FileVersion>
+    <PackageReleaseNotes>0.3.0-preview.2: Lockstep release with PostQuantum.SecureChannel 0.3.0-preview.2 (external-review remediation: protocol-version bump 1 -> 2; wire-format break). No API changes here; the in-memory duplex and PqHandshakeHarness now produce sessions speaking v2. Use this version with the matching 0.3.0-preview.2 core.</PackageReleaseNotes>
     <Authors>Paul Clark</Authors>
     <Description>Test helpers for PostQuantum.SecureChannel. Provides PqInMemoryDuplex.CreatePair() for a pair of in-memory Streams (no TCP, no sockets, no port allocation) and PqHandshakeHarness.Create() that returns a connected client+server PqSession pair in one call (with opt-in mutual auth, resumption secret, and session presets). Intended for test projects; not for production code paths.</Description>
     <Summary>Test helpers for PostQuantum.SecureChannel: in-memory duplex transport and a one-call handshake harness.</Summary>

src/PostQuantum.SecureChannel/PostQuantum.SecureChannel.csproj

@@ -15,8 +15,9 @@
   <!-- ============================ NuGet packaging metadata ============================ -->
   <PropertyGroup>
     <PackageId>PostQuantum.SecureChannel</PackageId>
-    <Version>0.3.0-preview.1</Version>
-    <PackageReleaseNotes>0.3.0-preview.1: Ecosystem-foundation release (wire-compatible with 0.2.x). Adds OpenTelemetry-friendly distributed tracing via System.Diagnostics.ActivitySource alongside the existing Meter/EventSource. Releases two companion packages: PostQuantum.SecureChannel.AspNetCore (DI registration, IConfiguration binding, WebSocket-to-Stream adapter, MapPqWebSocket endpoint helper) and PostQuantum.SecureChannel.Testing (in-memory duplex transport, one-call handshake harness). Adds production-shaped samples (MicroserviceWebSocket, WorkerControlPlane, QueueEnvelope) and architecture/threat-model/decision/operations/troubleshooting docs. Includes 0.2.1-preview.1 hardening: DoS-safe bitmap replay window, NIST SP 800-38D record + byte caps with PqEpochExhaustedException, IDisposable handshakes, AllowedServerIdentities for staged rotation, and named PqSessionOptions presets.</PackageReleaseNotes>
+    <Version>0.3.0-preview.2</Version>
+    <FileVersion>0.3.0.2</FileVersion>
+    <PackageReleaseNotes>0.3.0-preview.2: External-review remediation of the protocol glue. Bumps PqProtocol.Version 1 -> 2 (WIRE-FORMAT BREAK; v1 and v2 peers fail cleanly at version negotiation). HKDF info construction is now RFC 5869 / TLS 1.3 HkdfLabel with explicit length framing (Finding 2). Transcript hashing length-prefixes each fragment (Finding 3). Domain-separation labels rebased pqsc/v1 -> pqsc/v2. AntiReplayWindow.Commit enforces the IsAcceptable precondition in code (Finding 1e). Adds five pinned-KAT test files (key schedule, HKDF info bytes, transcript framing, replay-window wrap, record nonce / epoch boundary); 450/450 tests pass on net8.0 / net9.0 / net10.0. README gains a prominent preview-and-unaudited status banner; docs/AUDIT-SCOPE.md added. No changes to the X-Wing combiner, ML-DSA-65 signature flow, AES-256-GCM record framing, anti-replay bitmap shape, or the three-message handshake state machine. Adopters running 0.3.0-preview.1 must update both ends to talk again.</PackageReleaseNotes>
     <Authors>Paul Clark</Authors>
     <Company>Paul Clark</Company>
     <Product>PostQuantum.SecureChannel</Product>