Waf challenge mode startup perf#4458

Draft

buixor wants to merge 14 commits into

waf-challenge-modefrom

waf-challenge-mode-startup-perf

Commits on May 7, 2026

appsec/challenge: bake-in pre-obfuscated initial bundle to remove startup blocker
buixor
committed
appsec/challenge: replace hardcoded masterSecret with configurable shared secret

buixor
and
claude
committed
appsec/challenge: HKDF-derived per-epoch keys + cookie format v1

buixor
and
claude
committed
appsec/challenge: split bundle so the per-epoch signing key lives inside obfuscation

buixor
and
claude
committed
appsec/challenge: document the JS pipeline + add make target for regeneration

buixor
and
claude
committed
avoid race condition when we re-offuscate the payload
buixor
committed
logging when we rotate keys
buixor
committed
tests
buixor
committed