config: extract LIBP2P_ALPN_PROTOCOL constant and add spec test

src/lean_spec/subspecs/networking/config.py

@@ -64,3 +64,11 @@
 
 MAX_ERROR_MESSAGE_SIZE: Final[int] = 256
 """Maximum error message size in bytes per Ethereum P2P spec (ErrorMessage: List[byte, 256])."""
+
+LIBP2P_ALPN_PROTOCOL: Final[str] = "libp2p"
+"""ALPN protocol identifier for libp2p connections.
+
+Per the libp2p TLS spec (https://github.com/libp2p/specs/blob/master/tls/tls.md):
+"libp2p" is the Application-Layer Protocol Negotiation (ALPN) value used
+during the TLS 1.3 handshake to identify libp2p connections.
+"""

src/lean_spec/subspecs/networking/transport/quic/connection.py

@@ -41,6 +41,7 @@
     StreamReset,
 )
 
+from lean_spec.subspecs.networking.config import LIBP2P_ALPN_PROTOCOL
 from lean_spec.subspecs.networking.types import ProtocolId
 
 from ..identity import IdentityKeypair
@@ -520,7 +521,7 @@ async def create(
 
         # Configure QUIC.
         config = QuicConfiguration(
-            alpn_protocols=["libp2p"],
+            alpn_protocols=[LIBP2P_ALPN_PROTOCOL],
             is_client=True,
             verify_mode=ssl.CERT_NONE,  # We verify via libp2p extension, not CA
         )
@@ -640,7 +641,7 @@ async def listen(
 
         # Create server configuration.
         server_config = QuicConfiguration(
-            alpn_protocols=["libp2p"],
+            alpn_protocols=[LIBP2P_ALPN_PROTOCOL],
             is_client=False,
             verify_mode=ssl.CERT_NONE,  # We verify via libp2p extension
         )

tests/lean_spec/subspecs/networking/transport/quic/test_connection.py

@@ -10,6 +10,7 @@
 
 import pytest
 
+from lean_spec.subspecs.networking.config import LIBP2P_ALPN_PROTOCOL
 from lean_spec.subspecs.networking.transport.peer_id import PeerId
 from lean_spec.subspecs.networking.transport.quic.connection import (
     ConnectionTerminated,
@@ -176,6 +177,27 @@ def test_no_quic_tag_returns_none_transport(self) -> None:
         assert (host, port, transport) == ("10.0.0.1", 3000, None)
 
 
+# ---------------------------------------------------------------------------
+# ALPN protocol — per the libp2p TLS spec
+#
+# https://github.com/libp2p/specs/blob/master/tls/tls.md
+# "Endpoints MUST NOT send (and MUST NOT accept) any ALPN extension that
+#  does not include "libp2p" as the ALPN protocol string."
+# ---------------------------------------------------------------------------
+
+
+class TestAlpnProtocol:
+    """Verify the ALPN protocol value per the libp2p TLS spec."""
+
+    def test_alpn_is_libp2p(self) -> None:
+        """The ALPN value is 'libp2p' as mandated by the libp2p TLS spec.
+
+        Spec reference (https://github.com/libp2p/specs/blob/master/tls/tls.md):
+        the ALPN extension MUST include "libp2p" as the protocol string.
+        """
+        assert LIBP2P_ALPN_PROTOCOL == "libp2p"
+
+
 # ---------------------------------------------------------------------------
 # QuicStream — read behavior per RFC 9000 Section 3
 #