refactor!: one file_chunk and index_sync encoder for every transport

`file_chunk` and `index_sync` were each built twice, once per transport, and
the two copies did not agree. WebRTC sent binary, unsigned chunks carrying a
`file_id`; QUIC sent base64 fields, two BLAKE3 hashes, a per-chunk Ed25519
signature and no `file_id`. `index_sync` was plain entries on one transport
and a `GroupIndex.serialize()` envelope on the other. One message type, two
shapes, one consumer each, and nothing that failed when they drifted — finding
C6 one size down, in the two places the handshake unification did not reach.

Phase 9.15 moved WebRTC to the binary format and dropped the per-chunk
signature; the QUIC encoder was never brought along. It is dropped here rather
than reintroduced: the AES-GCM tag authenticates the ciphertext under a
GEK-derived key, and since C3 the node authenticates itself once in the
handshake instead of once per megabyte.

`meshbay_common.protocol` now owns the chunk codec (`chunk_ciphertext`,
`file_chunk_wire`, `file_chunk_plaintext`) and `meshbay_node/transport/wire.py`
the index builder, which also absorbs the delta the daemon used to hand-build.
`test_transport_wire_parity.py` fails if either server grows its own copy back.

`ChunkRequest`/`ChunkResponse` are deleted. `ChunkResponse` described the QUIC
half while reading like the contract for both, which is what made the fork hard
to see at all.

BREAKING CHANGE: MNP 0.15 changes the encoding of `file_chunk` and `index_sync`
on the QUIC transport. The WebRTC shapes are byte for byte unchanged and no
QUIC client ships, which is why this is a MINOR bump; a deployed QUIC peer
would have made it MAJOR.

Also fixes a test fixture that put a `Path` where the daemon puts a `RootSet`.
Nothing caught it: the old QUIC index handler never touched `roots`, and
`entry_abs_path` fell through `Path.resolve(strict=...)`, reading the virtual
path as a truthy flag and returning the right file by accident.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AsoWC3GmhNdwVFomW3QjH3

1 files changed, 10 insertions, 1 deletions

diff --git a/packages/meshbay-common/src/meshbay_common/__init__.py b/packages/meshbay-common/src/meshbay_common/__init__.py
index fdf6d86..61502c9 100644
--- a/packages/meshbay-common/src/meshbay_common/__init__.py
+++ b/packages/meshbay-common/src/meshbay_common/__init__.py
@@ -61,5 +61,14 @@ __version__ = "0.10.0"
 # under the account's recovery key, so a forgotten passphrase does not strand
 # the identity (docs/auth-confirm.md §4.3). Additive: an older node ignores the
 # field on store and never returns one; an older client never sends it.
-MNP_VERSION = "0.14"
+# 0.15: `file_chunk` and `index_sync` had forked between the transports — WebRTC
+# sent binary, unsigned chunks and plain index entries, QUIC sent base64 chunks
+# with a per-chunk Ed25519 signature and a `GroupIndex.serialize()` envelope. One
+# type, two shapes, a single consumer each and no test that they agreed. Both now
+# come from one encoder (`protocol.file_chunk_wire`, `transport/wire.py`), which is
+# QUIC adopting what WebRTC already sent. **Breaking on the QUIC wire**, and only
+# there: the WebRTC shape — the one every deployed client speaks — is byte for byte
+# what it was, and no QUIC client ships. Recorded as a MINOR bump for that reason;
+# a deployed QUIC peer would have made it a MAJOR one.
+MNP_VERSION = "0.15"
 MHP_VERSION = "0.1"