feat(mnp): sharing a folder is decided on the node's machine only (MNP 6.0)

root_add, root_update and group_attach leave MNP: adding a directory and
switching writable/removable go through the loopback API (native dialog in
the desktop app) or the CLI. The operator's Settings tab still lists the
roots from any browser, read-only. The desktop app refuses to sign those
ops; a loopback flag change now reaches open pages (publish_roots).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 7 insertions, 14 deletions

diff --git a/packages/meshbay-common/src/meshbay_common/adminop.py b/packages/meshbay-common/src/meshbay_common/adminop.py
index 4379519..11100b5 100644
--- a/packages/meshbay-common/src/meshbay_common/adminop.py
+++ b/packages/meshbay-common/src/meshbay_common/adminop.py
@@ -101,7 +101,6 @@ OP_TMDB_REMATCH = "tmdb_rematch"
 # the lesson was already learned once). Signed for the same reason as
 # tmdb_enabled.
 OP_MUSICBRAINZ_ENABLED = "musicbrainz_enabled"
-OP_ROOT_ADD = "root_add"
 OP_ROOT_REMOVE = "root_remove"
 # One op for every application's directories. The subject is
 # "<app>:<comma-joined sorted paths>" so what the operator is shown before
@@ -122,11 +121,16 @@ OP_SEARCH_LISTED = "search_listed"
 # There is no op for *enabling* chat encryption. It is not a setting — MNP 2.0
 # has no plaintext chat to fall back to.
 OP_CHAT_EPOCH = "chat_epoch"
-OP_ROOT_UPDATE = "root_update"
 OP_ROOT_EJECT = "root_eject"
 OP_ROOT_PLUG = "root_plug"
-OP_GROUP_ATTACH = "group_attach"
 OP_GROUP_DETACH = "group_detach"
+# OP_ROOT_ADD, OP_ROOT_UPDATE and OP_GROUP_ATTACH are gone (MNP 6.0). Each one
+# chose what of the operator's disk is shared and who may write there, and a
+# signature proves only that the operator's key signed — in a browser, through
+# code the hub serves; on the desktop, through a renderer that parses content
+# from nodes. Sharing a folder, hosting a group and opening a folder to writes
+# are done on the node's own machine (loopback, behind a native dialog) or with
+# the CLI, and a message that does not exist cannot be mis-authorized.
 # OP_GEK_BUNDLE_STORE is gone. Members no longer hand the node key material at
 # all: the node holds the GEK and wraps it itself, for a key the recipient proved
 # they hold (see `join.py` and docs/MESHBAY_DESIGN.md §3.4). The operation existed
@@ -159,17 +163,6 @@ def secret_digest(value: str | None) -> str | None:
     return "sha256:" + hashlib.sha256(value.encode()).hexdigest()
 
 
-def root_add_subject(path: str, name: str, kind: str, writable: bool,
-                     removable: bool) -> str:
-    return structured_subject({"path": path, "name": name, "kind": kind,
-                               "writable": writable, "removable": removable})
-
-
-def group_attach_subject(name: str, shared_dir: str, writable: bool) -> str:
-    return structured_subject({"name": name, "shared_dir": shared_dir,
-                               "writable": writable})
-
-
 def invite_create_subject(user_id: str, username: str) -> str:
     return structured_subject({"user_id": user_id, "username": username})