feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist)

Implements all 8 milestones (7.0-7.7):

- 7.0: JWT carries `groups` claim; node verifies group membership at
  MNP handshake (QUIC + TCP+TLS). Resolves security review C2.
- 7.1: QUIC 0-RTT session resumption via stored session tickets
  (17-21ms reconnect vs 47ms cold).
- 7.2: Hub→node WebSocket signaling for NAT punch coordination
  (`client_incoming`/`punch_ready`) + jti denylist push. Denylist
  class blocks revoked users/jtis at handshake.
- 7.3: Multi-group daemon — one QUIC port serves N groups with
  per-group GEK, shared_root, and index routing.
- 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg
  segment extraction).
- 7.5: Sender Keys protocol for group chat (Signal Groups approach).
  Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM
  encryption, Ed25519 signing. Resolves security review C1.
- 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type
  with peer broadcast, web UI with WebSocket push.
- 7.7: Argon2id calibration CLI.

First security review included (first-review.md). 109 tests, demo-v3
validated against meshbay.org production hub.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 25 insertions, 1 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index c2895f5..bd09752 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -96,6 +96,25 @@ Scope: `hub`, `node`, `common`, or omitted for cross-cutting
 - **Never log GEK, private keys, or plaintext passwords** — even at DEBUG level
 - **meshbay.org is internet-facing** — open port → test → close port + kill processes in same block
 
+## First security review (2026-08-10) — see `first-review.md`
+
+**Critical (before Phase 7):**
+- **C1** Chat: Sender Keys protocol, NOT shared Double Ratchet (pairwise protocol
+  would cause key/nonce reuse in group context). `ratchet.py` kept for future 1:1 DM.
+- **C2** JWT must carry `"groups": [group_ids]` claim. Node MNP handshake must verify
+  group membership before serving content. Without this, any authenticated user
+  accesses any group.
+
+**Significant (Phase 7-8):**
+- **S1** Admin revocation endpoint has no authz check → Phase 8.1
+- **S2** Email stored in plaintext (spec says encrypted at rest) → Phase 8.2
+- **S3** jti denylist push via hub→node WebSocket → Phase 7.2
+- **S4** AES-GCM keystore IV fixed: 128-bit → 96-bit (NIST SP 800-38D) ✅ DONE
+- **S5** Refresh token rotation (one-time use) → Phase 8.3
+
+**Architecture validated:** crypto primitives, GEK wrapping (ECIES), trust model,
+key hierarchy, on-the-fly encryption, transport abstraction.
+
 ## Known calibration TODOs
 
 - Argon2id `memory_cost`: currently 65536 (64 MB, 78ms) — increase to 262144 (256 MB) before prod
@@ -121,7 +140,8 @@ SFR résidentiel Fedora 44 → meshbay.org OVH VPS :
 | Dérivation clés depuis password | `meshbay_common.keyderive` | `keyderive.py` |
 | Bundle clés (web) | `meshbay_common.keyderive` | `keyderive.py` + `static/keyderive.js` |
 | GEK wrap/unwrap (ECIES) | `meshbay_common.crypto` | `crypto.py` |
-| Double Ratchet (chat) | `meshbay_common.ratchet` | `ratchet.py` |
+| Double Ratchet (1:1 DM, future) | `meshbay_common.ratchet` | `ratchet.py` |
+| Sender Keys (group chat) | `meshbay_common.senderkeys` | `senderkeys.py` (Phase 7.5) |
 | AES-GCM (navigateur) | `meshbay_common.webcrypto` | `webcrypto.py` + `static/crypto.js` |
 | Keystore node | `meshbay_node.keystore` | `keystore.py` |
 | NAT traversal | `QE/demo-v2/nat.py` | non versionné — résultats dans devel-phases.md |
@@ -137,3 +157,7 @@ SFR résidentiel Fedora 44 → meshbay.org OVH VPS :
 - Services légitimes : `meshbay-hub.service`, Caddy, PostgreSQL (local)
 - Inventaire détaillé : `QE/server-state/meshbay.org.md`
 - Deploy hub : voir `QE/server-state/meshbay.org.md`
+
+## new rules, from now
+Documents and demo/comments are written in english unless requested in french.
+