feat(protocol): bind the MNP token to the node it is for (E10)

The audience split stopped a member's node credential from opening the hub API.
It did not stop the credential being *replayed to another node*: the MNP token
carried the member's whole group set and named no node, so a token handed to
node A's operator could be presented to node B the member also belongs to. That
does not read content on B — the handshake still requires proving node B's group
key, which the operator lacks — but it reaches B's pre-proof window and fetches
the member's *encrypted* keypair bundle for B (offline-attackable, bounded,
audited): a disclosure §2.4 says should not follow from hosting a member on A.

The token now names the node it is minted for (a `node` claim = that node's
Ed25519 key), and authorize_token refuses one that names a different key. The
client already knows the target node's key (from /v1/groups/{id}/nodes) and asks
for a token bound to it: POST /v1/nodes/mnp-token takes node_pk, and
transport.connect threads it (group-page, the connection pool and rewrap pass
n.pk_node; reconnect preserves it). A token that names no node is still
accepted, because the hub only mints one for the authenticated requester, so an
unbound token grants nothing across accounts — which also keeps non-binding
callers working with no churn.

Done before deploy, so it folds into the MNP 4.0 flag day rather than needing
its own. Docs: §5.2, register E10, MESHBAY_NODE_PROTOCOL.md §6.3.
test_handshake.py and test_mnp_token.py hold the binding (a token for node A is
refused by node B, accepted by node A; an unbound token still works); red
before, green after. common/node/hub suites green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 21 insertions, 0 deletions

diff --git a/packages/meshbay-common/tests/test_handshake.py b/packages/meshbay-common/tests/test_handshake.py
index 8f385bb..f42d597 100644
--- a/packages/meshbay-common/tests/test_handshake.py
+++ b/packages/meshbay-common/tests/test_handshake.py
@@ -120,6 +120,27 @@ def test_a_token_with_no_audience_is_refused(hub_key):
         authorize_token(no_aud, pk_pem, group_id=GROUP)
 
 
+def test_a_token_bound_to_another_node_is_refused(hub_key):
+    """E10: a token names the node it is for. A member's token captured by one
+    node's operator cannot be replayed to a second node the member also uses."""
+    sk_pem, pk_pem = hub_key
+    token_for_A = _token(sk_pem, node="node-A-pk")
+    # Node B (its own key is 'node-B-pk') refuses it.
+    with pytest.raises(HandshakeError, match="this node"):
+        authorize_token(token_for_A, pk_pem, group_id=GROUP, node_pk_b64="node-B-pk")
+    # Node A accepts it.
+    peer = authorize_token(token_for_A, pk_pem, group_id=GROUP, node_pk_b64="node-A-pk")
+    assert peer.user_id == "user-1"
+
+
+def test_a_token_naming_no_node_is_still_accepted(hub_key):
+    """Lenient by design: the hub mints an unbound token only for the requester,
+    so it grants nothing across accounts, and older callers keep working."""
+    sk_pem, pk_pem = hub_key
+    peer = authorize_token(_token(sk_pem), pk_pem, group_id=GROUP, node_pk_b64="node-B-pk")
+    assert peer.group_id == GROUP
+
+
 def test_unhosted_group_refused(hub_key):
     sk_pem, pk_pem = hub_key
     with pytest.raises(HandshakeError, match="not hosted"):