fix: preserve authentication transcript order

Defer RSA, ECDH, and handshake completion until after each received packet
has been added to the authentication transcript, matching the upstream
workqueue ordering and preventing the controller from rejecting host secret.

Co-Authored-By: openai/gpt-5.6-luna: fixed GIP authentication ordering

CMakeLists.txt

@@ -6,7 +6,7 @@ if(NOT CMAKE_GENERATOR MATCHES "^(Ninja|Xcode)$")
 endif()
 
 cmake_minimum_required(VERSION 3.21)
-project(xone_macos VERSION 0.1.13 LANGUAGES CXX Swift)
+project(xone_macos VERSION 0.1.14 LANGUAGES CXX Swift)
 
 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 

include/auth/auth.hpp

@@ -69,6 +69,7 @@ private:
     auto complete_handshake() -> void;
     auto handle_pkt_acknowledge() -> int;
     auto handle_pkt_data(std::span<u8 const> data) -> int;
+    auto run_deferred_action() -> void;
     auto dispatch_pkt(u8 cmd, std::span<u8 const> data) -> int;
     auto handle_hello(std::span<u8 const> data) -> int;
     auto handle_certificate(std::span<u8 const> data) -> int;
@@ -87,6 +88,14 @@ private:
     std::array<u8, k_pubkey_len> pubkey_client_{};
     std::array<u8, k_pubkey2_len> pubkey_client2_{};
     std::array<u8, k_secret_len> master_secret_{};
+
+    enum class deferred_action {
+        none,
+        exchange_rsa,
+        exchange_ecdh,
+        complete,
+    };
+    deferred_action deferred_action_ = deferred_action::none;
 };
 
 } // namespace xone::auth

src/auth/auth.cpp

@@ -367,9 +367,30 @@ auto auth::handle_pkt_data(std::span<u8 const> data) -> int
         return err;
 
     transcript_.update(data.subspan(sizeof(hdr->handshake)));
+    run_deferred_action();
     return 0;
 }
 
+auto auth::run_deferred_action() -> void
+{
+    auto action = deferred_action_;
+    deferred_action_ = deferred_action::none;
+
+    switch (action) {
+    case deferred_action::exchange_rsa:
+        exchange_rsa();
+        break;
+    case deferred_action::exchange_ecdh:
+        exchange_ecdh();
+        break;
+    case deferred_action::complete:
+        complete_handshake();
+        break;
+    case deferred_action::none:
+        break;
+    }
+}
+
 auto auth::dispatch_pkt(u8 cmd, std::span<u8 const> data) -> int
 {
     switch (cmd) {
@@ -420,7 +441,7 @@ auto auth::handle_certificate(std::span<u8 const> data) -> int
             return -EINVAL;
 
         std::memcpy(pubkey_client_.data(), data.data() + i, k_pubkey_len);
-        exchange_rsa();
+        deferred_action_ = deferred_action::exchange_rsa;
         return 0;
     }
 
@@ -443,7 +464,7 @@ auto auth::handle_finish(std::span<u8 const> data) -> int
         return -EPROTO;
     }
 
-    complete_handshake();
+    deferred_action_ = deferred_action::complete;
     return 0;
 }
 
@@ -488,7 +509,7 @@ auto auth::handle_pubkey(std::span<u8 const> data) -> int
         return -EINVAL;
 
     std::memcpy(pubkey_client2_.data(), pkt->pubkey.data(), k_pubkey2_len);
-    exchange_ecdh();
+    deferred_action_ = deferred_action::exchange_ecdh;
     return 0;
 }