docs(openwrt): correct open-SSID/mesh security framing — peering is open by design

The fips-ap-setup/fips-mesh-setup comments and both how-tos claimed a
stranger "cannot pass the FIPS handshake" / "their frames die at the
handshake" / the handshake surface "drops them". That is wrong: FIPS
peer admission is open. An inbound handshake from any net-new identity
is promoted (node::handlers:🤝:promote_connection), gated only
by the daemon's max-peers cap — there is no allowlist, no PSK, and the
AuthChallenge path is not wired to admission. The Noise IK handshake
provides authentication (no impersonation of another identity, no MITM),
not authorization.

Restate the model accurately in all five places: a stranger on the open
SSID (or the open mesh) can associate AND form a FIPS peer link — that
is the point of open access. Containment is the isolated fips_ap zone
(no path to br-lan or the WAN) plus the max-peers cap, not the
handshake. Clarify that AP client isolation is an L2 control only: a
peered stranger is an overlay peer like any other, so the FIPS overlay,
not L2, is the trust boundary between clients.

docs/how-to/set-up-80211s-mesh-backhaul.md

@@ -21,12 +21,14 @@ Two deliberate choices distinguish this from a stock 802.11s setup:
   handshake, so SAE at L2 would duplicate that work, add a shared
   credential to provision across routers, and (on ath10k) force the
   firmware into its slower raw Tx/Rx mode. A stranger can form an
-  802.11s peering with your router, but their frames die at the FIPS
-  handshake — the same security model as mDNS and BLE discovery, where
-  the advert is only a hint and the handshake is the authentication.
-  What you concede: L2 metadata (MAC addresses, frame sizes) is
-  visible in the air, and a hostile radio can burn airtime — both true
-  of any radio link regardless of L2 encryption.
+  802.11s peering with your router *and* a FIPS peer link on top of it —
+  the same open model as mDNS and BLE discovery, where the advert is
+  only a hint and the handshake authenticates each link (no
+  impersonation, no MITM) rather than gating who may peer. Admission is
+  open up to the daemon's max-peers cap. What you concede: any nearby
+  radio can peer and reach the FIPS overlay surface; L2 metadata (MAC
+  addresses, frame sizes) is visible in the air; a hostile radio can
+  burn airtime — all inherent to an open radio link.
 - **`mesh_fwding 0`** — disables 802.11s's own HWMP routing so each
   mesh link is a plain neighbor link. FIPS is the routing layer; two
   routing layers would fight, and broadcast discovery beacons would

docs/how-to/set-up-open-access-ssid.md

@@ -30,10 +30,16 @@ Three deliberate choices distinguish this from a stock guest network:
   only security type that needs zero provisioning, and OWE is left out
   for now for exactly this uniformity reason (OWE-transition mode is
   inconsistent across client vendors). Every FIPS peer link is already
-  authenticated and encrypted by the Noise IK handshake — a stranger
-  can associate, but their traffic dies at the FIPS handshake. What
-  you concede: L2 metadata is visible in the air and a hostile radio
-  can burn airtime — both true of any radio link.
+  authenticated and encrypted by the Noise IK handshake. A stranger
+  can associate *and* form a FIPS peer link — that is the point of open
+  access; the handshake authenticates each link (no impersonation, no
+  MITM) but does not gate who may peer, and admission is open up to the
+  daemon's max-peers cap. What confines a hostile peer is the isolated
+  `fips_ap` zone (no path to br-lan or the WAN — see below), not the
+  handshake. What you concede: any nearby device can reach the FIPS
+  overlay surface (handshake, discovery, lookup, routing) and peer with
+  the router; L2 metadata is visible in the air; a hostile radio can
+  burn airtime — all inherent to an open radio link.
 - **No DHCP — IPv6 router advertisements only.** odhcpd announces a
   ULA prefix (`fd..`-range) for stateless SLAAC: no DHCPv4, no DHCPv6,
   no lease state. FIPS itself only needs link-local + mDNS, but
@@ -214,10 +220,13 @@ stays associated — that is the designed steady state, not an error.
 - **Airtime is shared per radio.** An access AP and a mesh backhaul
   on the same radio share one channel. On dual/tri-band hardware,
   dedicate a band to the backhaul and serve clients on the others.
-- **Strangers can associate — by design.** They reach only the FIPS
-  handshake surface, which drops them. Do not add forwardings to the
-  `fips_ap` zone: that would turn the open SSID into a hotspot and
-  hand the isolation away.
+- **Strangers can associate and peer — by design.** Open access means
+  any nearby device can complete the Noise handshake and become a FIPS
+  peer (up to the max-peers cap); the handshake authenticates each link,
+  it does not restrict who joins. They reach only the FIPS overlay
+  surface — the isolated zone gives no path to br-lan or the WAN. Do not
+  add forwardings to the `fips_ap` zone: that would turn the open SSID
+  into a hotspot and hand the isolation away.
 - **Roaming is client-driven.** Clients decide when to hop BSSIDs
   (standard ESS behavior) and renumber on each router; FIPS sessions
   ride through because the overlay identity is the anchor. Expect a

packaging/openwrt-ipk/files/usr/bin/fips-ap-setup

@@ -16,7 +16,12 @@
 #     the security type must be uniform across ALL routers anyway: clients
 #     key a saved network on SSID + security type, so one router with a PSK
 #     splits the ESS into a different saved network. A stranger can
-#     associate but cannot pass the FIPS handshake.
+#     associate AND form a FIPS peer link — that is the point of open
+#     access. The Noise handshake authenticates each link (no
+#     impersonation of another identity, no MITM); it does NOT gate who
+#     may peer. Admission is open up to the daemon's max-peers cap; the
+#     firewall zone below is what confines every client to the FIPS
+#     overlay (no path to br-lan or the WAN).
 #   - NO DHCP            — odhcpd announces a ULA prefix in router
 #     advertisements (stateless SLAAC, no lease state). FIPS itself only
 #     needs link-local + mDNS, but Android's provisioning check requires an
@@ -174,9 +179,10 @@ fi
 
 # ---------------------------------------------------------------------------
 # Wireless: open AP with client isolation. Clients of the same AP cannot
-# exchange L2 frames — two FIPS phones on one router still reach each other
-# through the router at the overlay layer, while a stranger cannot reach
-# other clients at all.
+# exchange L2 frames directly — two FIPS phones on one router still reach
+# each other through the router at the overlay layer. Isolation is an L2
+# control only: a stranger who peers is an overlay peer like any other, so
+# the FIPS overlay (not L2) is the trust boundary between clients.
 # ---------------------------------------------------------------------------
 
 uci -q delete "wireless.$SECTION"

packaging/openwrt-ipk/files/usr/bin/fips-mesh-setup

@@ -14,8 +14,10 @@
 #   - encryption 'none'  — the mesh is OPEN on purpose. FIPS's Noise IK
 #     handshake authenticates and encrypts every peer link, so SAE would
 #     only duplicate that (and on ath10k it forces the slower raw Tx/Rx
-#     firmware mode). A stranger can form an 802.11s peering but cannot
-#     pass the FIPS handshake.
+#     firmware mode). A stranger can form an 802.11s peering AND a FIPS
+#     peer link — the Noise handshake authenticates each link (no
+#     impersonation of another identity, no MITM), it does not gate who
+#     may peer. Admission is open up to the daemon's max-peers cap.
 #   - mesh_fwding '0'    — disables 802.11s HWMP forwarding so each mesh
 #     link is a plain L2 neighbor link. FIPS is the routing layer; two
 #     routing layers would fight.