feat(protocol): bind the MNP token to the node it is for (E10)

The audience split stopped a member's node credential from opening the hub API.
It did not stop the credential being *replayed to another node*: the MNP token
carried the member's whole group set and named no node, so a token handed to
node A's operator could be presented to node B the member also belongs to. That
does not read content on B — the handshake still requires proving node B's group
key, which the operator lacks — but it reaches B's pre-proof window and fetches
the member's *encrypted* keypair bundle for B (offline-attackable, bounded,
audited): a disclosure §2.4 says should not follow from hosting a member on A.

The token now names the node it is minted for (a `node` claim = that node's
Ed25519 key), and authorize_token refuses one that names a different key. The
client already knows the target node's key (from /v1/groups/{id}/nodes) and asks
for a token bound to it: POST /v1/nodes/mnp-token takes node_pk, and
transport.connect threads it (group-page, the connection pool and rewrap pass
n.pk_node; reconnect preserves it). A token that names no node is still
accepted, because the hub only mints one for the authenticated requester, so an
unbound token grants nothing across accounts — which also keeps non-binding
callers working with no churn.

Done before deploy, so it folds into the MNP 4.0 flag day rather than needing
its own. Docs: §5.2, register E10, MESHBAY_NODE_PROTOCOL.md §6.3.
test_handshake.py and test_mnp_token.py hold the binding (a token for node A is
refused by node B, accepted by node A; an unbound token still works); red
before, green after. common/node/hub suites green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 19 insertions, 0 deletions

diff --git a/packages/meshbay-common/src/meshbay_common/handshake.py b/packages/meshbay-common/src/meshbay_common/handshake.py
index dedfeb1..992fe8a 100644
--- a/packages/meshbay-common/src/meshbay_common/handshake.py
+++ b/packages/meshbay-common/src/meshbay_common/handshake.py
@@ -269,6 +269,7 @@ def authorize_token(
     hosted_groups: Any | None = None,
     denylist: DenylistLike | None = None,
     require_scope: str | None = "user",
+    node_pk_b64: str | None = None,
 ) -> AuthorizedPeer:
     """
     Everything decided from the JWT, before any proof is exchanged.
@@ -276,6 +277,13 @@ def authorize_token(
     Raises HandshakeError with a peer-safe message. Deliberately strict about
     `group_id`: it used to be optional, and omitting it skipped the membership
     check entirely and fell back to the node's first group (M1).
+
+    `node_pk_b64` binds the token to **this** node (E10). The MNP token names
+    the node it was minted for (`node` claim), so a member's token captured by
+    the operator of one node cannot be replayed to another node the member also
+    belongs to — not even to reach the pre-proof window there. A node always
+    passes its own key; a caller that passes `None` (a unit test not exercising
+    this) skips the check.
     """
     try:
         decoded = jwt.decode(token, hub_pk_pem, algorithms=["EdDSA"],
@@ -294,6 +302,17 @@ def authorize_token(
     if require_scope is not None and decoded.get("scope", "user") != require_scope:
         raise HandshakeError("Wrong token scope")
 
+    # The token names the node it was minted for (`node` claim). A member's real
+    # client always binds it to the node it is reaching, so a token captured by
+    # that node's operator and replayed to a *second* node the member also uses
+    # is refused here — before the pre-proof window can serve anything (E10).
+    # A token that names no node is not refused: the hub only ever mints one for
+    # the authenticated requester, so an unbound token grants nothing across
+    # accounts, and this keeps older or non-binding callers working.
+    node_claim = decoded.get("node", "")
+    if node_pk_b64 is not None and node_claim and node_claim != node_pk_b64:
+        raise HandshakeError("Token is not for this node", code="wrong_node")
+
     user_id = decoded.get("sub", "")
     jti = decoded.get("jti", "")
     if not user_id: