feat: Phase 6 complete — chat, multi-group, federation, replication, webcrypto

6.1 Double Ratchet (meshbay_common/ratchet.py):
  Forward secrecy, break-in recovery, out-of-order delivery.
  Signal-spec KDF_RK/KDF_CK via HKDF-SHA256. 11/11 tests.

6.2 Multi-group node (config.py):
  [[groups]] TOML array, per-group ports, back-compat [group].

6.3 MHP federation persistence (db/models.py FederatedGroup + SwarmSource):
  receive_directory() now persists to federated_groups table.
  list_public_groups() includes federated results with source attribution.

6.4 Content replication (node/replication.py + hub SwarmSource):
  ContentReplicator: fetch-index, download, hash-verify, register-swarm.
  Hub: POST /v1/swarm/register, GET /v1/swarm/{hash} for multi-source.

6.5 Browser private group (webcrypto.py + static/crypto.js):
  AES-256-GCM variant of GEK for WebCrypto-compatible groups.
  crypto.js: SubtleCrypto importGEK + deriveChunkKey + decryptChunk.
  Keys distinct from ChaCha20 via :aes HKDF info suffix. 4/4 tests.

74/74 tests total.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

1 files changed, 36 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py
index 63cc8c3..b76870d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/models.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py
@@ -142,6 +142,42 @@ class RefreshToken(Base):
 
 # ── IP logs (legal compliance) ────────────────────────────────────────────────
 
+class FederatedGroup(Base):
+    """
+    Groups received from peer hubs via MHP federation.
+    Included in public /v1/groups search results with hub_id attribution.
+    """
+    __tablename__ = "federated_groups"
+
+    id:          Mapped[str] = mapped_column(String(36), primary_key=True)
+    name:        Mapped[str] = mapped_column(String(128), nullable=False)
+    source_hub:  Mapped[str] = mapped_column(String(128), nullable=False)
+    join_policy: Mapped[str] = mapped_column(String(16), default="invite")
+    received_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
+    updated_at:  Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
+
+    __table_args__ = (
+        Index("ix_federated_groups_source", "source_hub"),
+        Index("ix_federated_groups_name", "name"),
+    )
+
+
+class SwarmSource(Base):
+    """
+    Tracks which nodes can serve a given content hash (public swarm).
+    Hub maintains this for load-balanced public content delivery.
+    """
+    __tablename__ = "swarm_sources"
+
+    content_hash: Mapped[str] = mapped_column(String(64), primary_key=True)
+    node_id:      Mapped[str] = mapped_column(String(36), primary_key=True)
+    endpoint:     Mapped[str] = mapped_column(String(128), nullable=False)
+    registered_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
+    last_seen:    Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_now)
+
+    __table_args__ = (Index("ix_swarm_hash", "content_hash"),)
+
+
 class ContentReport(Base):
     """
     Report of a public content hash for moderation.