feat(node): Phase 11 — production-ready daemon with WebRTC, WS, chat, HTTP

The node daemon was previously a skeleton that only started QUIC/TCP
servers and the local web UI. All browser-facing functionality (WebRTC,
hub WebSocket, chat store, HTTP file API) lived in QE demo scripts.

This rewrites daemon.py to be fully self-contained:
- WebRTC transport for browser clients (aiortc DataChannel)
- Hub WebSocket task (signaling, revocations, WebRTC offers)
- ChatStore per group (SQLite in ~/.local/share/meshbay/)
- HTTP file API per group (create_http_app on configured port)
- Graceful shutdown (all transports, stores, tasks)
- hub_client: _ws tracking + send_ws() for chat notifications
- config: data_dir field for persistent state
- systemd: security hardening (ProtectSystem, StateDirectory)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 66 insertions, 33 deletions

diff --git a/devel-phases-next.md b/devel-phases-next.md
index 1f6f0b4..533f5e8 100644
--- a/devel-phases-next.md
+++ b/devel-phases-next.md
@@ -1,6 +1,6 @@
 # MeshBay — Next Implementation Phases
 
-> Base: Phases 1–10c complete (except 10.9 → Phase 13). 167 tests. Web SPA + admin panel + self-service UI + MSE video streaming live on meshbay.org.
+> Base: Phases 1–11 complete (except 10.9 → Phase 13, 11.5/11.9 deferred). 169 tests. Web SPA + admin panel + self-service UI + MSE video streaming live on meshbay.org. Node daemon is now production-ready (WebRTC, WS, chat, HTTP all wired).
 > Architecture reference: docs/meshbay-draft-v4.md
 > First security review: first-review.md (2026-08-10)
 
@@ -494,42 +494,76 @@ Browser                          Node
 
 ---
 
-## Phase 11 — Node daemon: production-ready
+## Phase 11 — Node daemon: production-ready ✅ DONE
+
+Pending commit — 169 tests.
 
 **Objective:** the node daemon (`meshbay-node`) runs as a complete, self-contained
-service. Today the daemon starts QUIC/TCP servers and the local web UI, but
-everything else (WebRTC, hub WS, chat store, index push, HTTP file API) is only
-wired up in the QE demo script. This phase moves all that logic into the daemon.
+service. Previously the daemon only started QUIC/TCP servers and the local web UI;
+everything browser-facing (WebRTC, hub WS, chat store, HTTP API) was only wired
+in QE demo scripts. This phase moved all that logic into the daemon.
+
+### What changed
+
+**`daemon.py` — complete rewrite.** The daemon now starts all transports and
+services in a single process:
+
+1. Keystore + hub login (unchanged)
+2. Per-group directory indexers (unchanged)
+3. **ChatStore** per group (new) — SQLite DB in `~/.local/share/meshbay/{group_id}/chat.db`
+4. **WebRTC transport** (new) — browser clients via DataChannel, wired as
+   `on_webrtc_offer` callback on the hub WS
+5. QUIC + TCP servers (unchanged)
+6. **Hub WebSocket** (new) — `maintain_ws()` as asyncio task, receives signaling,
+   revocation tokens, WebRTC offers. Auto-reconnect on disconnect.
+7. **HTTP file API** (new) — one `create_http_app()` per group on configured port
+8. Local web UI (unchanged)
+9. **Graceful shutdown** (enhanced) — cancels WS task, closes WebRTC peers, closes
+   chat stores, stops HTTP/QUIC/TCP servers, stops indexers
 
-**Current daemon gap (what `run_node_simple.py` does that `daemon.py` doesn't):**
-- Starts `maintain_ws()` (hub WebSocket for signaling, revocation, WebRTC offers)
-- Creates `WebRTCTransport` and passes it as `on_webrtc_offer` callback
-- Creates `ChatStore` per group and injects it into the WebRTC context
-- Sets `hub_ws` in WebRTC context (for chat notifications)
-- Sets `node_user_id` in WebRTC context (for file delete authorization)
-- Starts the HTTP file API server (`create_http_app()`)
-- None of these are in `daemon.py`
+**`hub_client.py`** — added `_ws` tracking and `send_ws()` method so the WebRTC
+context can send `chat_notify` messages to the hub for real-time chat notifications.
+
+**`config.py`** — added `data_dir` field (default `~/.local/share/meshbay/`)
+for chat DBs and other persistent state.
+
+**`meshbay-node.service`** — updated systemd unit with `StateDirectory=meshbay`,
+`ProtectSystem=strict`, `ReadWritePaths` for config and data directories.
 
 ### Milestones
 
-| # | Component | Description |
+| # | Component | Status |
 |---|---|---|
-| 11.1 | Daemon: hub WS integration | `maintain_ws()` as asyncio task, auto-reconnect, pass group_ids |
-| 11.2 | Daemon: WebRTC transport | Create `WebRTCTransport`, wire as `on_webrtc_offer` callback |
-| 11.3 | Daemon: chat store | Create `ChatStore` per group, inject into WebRTC + QUIC contexts |
-| 11.4 | Daemon: HTTP file API | Start `create_http_app()` on configured `http_port` |
-| 11.5 | Daemon: index push on change | Wire `DirectoryIndexer.on_change` to push `INDEX_DELTA` to connected peers |
-| 11.6 | Daemon: node_user_id + hub_ws context | Set `node_user_id` and `hub_ws` in transport contexts for authorization + notifications |
-| 11.7 | Daemon: graceful shutdown | Cancel WS task, close WebRTC peers, close chat stores, stop HTTP server |
-| 11.8 | Systemd unit file | `meshbay-node.service` with `EnvironmentFile=` for unlock key, restart on failure |
-| 11.9 | Swarm registration | Register own public files with hub swarm table on index change |
-| 11.10 | Integration test | Daemon starts, connects WS, accepts WebRTC offer, serves file, shuts down clean |
+| 11.1 | Daemon: hub WS integration | ✅ |
+| 11.2 | Daemon: WebRTC transport | ✅ |
+| 11.3 | Daemon: chat store | ✅ |
+| 11.4 | Daemon: HTTP file API | ✅ |
+| 11.5 | Daemon: index push on change | Deferred — indexer `on_change` callback not yet implemented |
+| 11.6 | Daemon: node_user_id + hub_ws context | ✅ |
+| 11.7 | Daemon: graceful shutdown | ✅ |
+| 11.8 | Systemd unit file | ✅ |
+| 11.9 | Swarm registration | Deferred — hub endpoint exists but node-side trigger not yet wired |
+| 11.10 | Integration test | ✅ (2 tests: full lifecycle + no-groups-exit) |
+
+### File changes
+
+**Modified:**
+- `packages/meshbay-node/src/meshbay_node/daemon.py` — complete rewrite
+- `packages/meshbay-node/src/meshbay_node/hub_client.py` — `_ws` tracking, `send_ws()`
+- `packages/meshbay-node/src/meshbay_node/config.py` — `data_dir` field
+- `packaging/systemd/meshbay-node.service` — hardening, StateDirectory
+
+**Added:**
+- `packages/meshbay-node/tests/test_daemon.py` — 2 integration tests
 
-### Priority
+### Deferred items
 
-This is the **most important next phase**. Without it, every node deployment
-requires a custom demo script. The daemon must be self-sufficient — start it,
-it does everything. No glue code.
+- **11.5 Index push**: requires `DirectoryIndexer` to have an `on_change` callback
+  that fires when watchdog detects file changes, then the daemon pushes `INDEX_DELTA`
+  to all connected WebRTC peers. The indexer currently rebuilds the full index but
+  doesn't notify consumers of incremental changes.
+- **11.9 Swarm registration**: hub `/v1/swarm/register` endpoint exists. Node needs
+  to register file hashes after each index rebuild. Depends on 11.5 (index change events).
 
 ---
 
@@ -685,8 +719,7 @@ community developers. Core functionality must be complete and stable first.
 ## Recommended order
 
 ```
-Phase 11 (Node daemon)     ← CRITICAL: daemon must be self-sufficient
-Phase 12 (Node CLI)        ← management UX
+Phase 12 (Node CLI)        ← management UX, now the critical path
 Phase 13 (Sender Keys)     ← chat security upgrade
 Phase 14 (Android)         ← mobile client, long effort
 Phase 16 (Packaging)       ← distribution
@@ -694,9 +727,9 @@ Phase 15 (Resilience)      ← optional, edge cases only
 Phase 17 (Extensions)      ← future, community-driven
 ```
 
-Phase 11 is the critical path now. The web client and hub are production-ready,
-but every node deployment requires a custom demo script. Fixing this unblocks
-everything else — packaging, multiple installations, community adoption.
+Phase 11 (daemon) is complete. Phase 12 (CLI) is now the critical path — without
+it, managing groups and members requires manual API calls. After that, Phase 13
+(Sender Keys) closes the chat encryption gap flagged in the security review.
 
 ---