feat!: identity keys per node — C4's blast radius drops to one operator

One keypair was copied to every node its owner joined, so cracking the bundle on
any single node yielded the identity used on all of them: their content on other
operators' machines, and the ability to sign as them anywhere. That lateral reach
was the part of C4 worth attacking.

Each node now gets its own keypair, generated the first time its owner joins it
and left with that node alone. An operator who cracks what sits on their own disk
holds a key that is a stranger to every other node — and on their own node, one
that unlocks nothing they did not already hold: they serve the content, the index
and every byte of it by design.

Nothing changes for the user. A first contact with a node already needed that
operator's code, and the key is created in the same step; a second browser still
recovers it from the node with the passphrase alone. Two operators can also no
longer tell they host the same person by comparing keys.

BREAKING, and deliberately without a compatibility path — the deployment is wiped
for the next demo:

  - users.pk_ed25519 / pk_x25519 dropped (migration a7c31f9e40b2)
  - registration no longer sends or stores a key
  - PUT /v1/users/me/keys and regenerateKeys() gone; rotation is now
    `member unpin` plus a fresh code, decided on the machine that pinned it
  - /pubkeys returns an account id and a node's linking key. It was the directory
    H3 read, and nothing wraps for it any more
  - the pk_user JWT claim is gone

That last one closed a live defect the inventory turned up: the node recorded
pk_user as the uploader's identity and authorized deletion against it, so a hub
issuing a token naming its own key could delete anyone's uploads on any node.
Attribution now uses the key the node itself pinned.

A simplification falls out. Registration generates nothing, so a scripted signup
is a real account: `demo.py bootstrap` takes a wiped hub and node to a working
demo with no browser, which was impossible while keys were born in one.

Also fixes, found by running it on a wiped deployment: the key handed back on a
join now belongs to the group the connection is for, not the group named in the
invitation — an operator pairs node-wide but redeems the code while opening a
group, and expects to read it.

Tests: 343, including the two that state the property — a key pinned by one node
is refused at another, and someone else's code does not admit it. Verified end to
end against a wiped hub and node: bootstrap, pair, invite, join, download,
stream, second browser, revoke.

Design: docs/per-node-identity-v1.md

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 16 insertions, 5 deletions

diff --git a/packages/meshbay-hub/tests/test_hub_api.py b/packages/meshbay-hub/tests/test_hub_api.py
index 7b75fd1..5a2cf86 100644
--- a/packages/meshbay-hub/tests/test_hub_api.py
+++ b/packages/meshbay-hub/tests/test_hub_api.py
@@ -144,8 +144,11 @@ async def test_jwt_offline_verify(client, hub_key_path):
     hub_pk_pem = r_pk.json()["pk_hub_pem"].encode()
 
     decoded = pyjwt.decode(token, hub_pk_pem, algorithms=["EdDSA"])
-    assert decoded["pk_user"] == pk_ed
     assert "jti" in decoded   # mandatory
+    # The token carries no user key. It used to, and the node recorded it as the
+    # uploader's identity — so whoever issued tokens decided who could delete a
+    # file. The hub certifies accounts; nodes pin keys.
+    assert "pk_user" not in decoded
 
 
 @pytest.mark.asyncio
@@ -194,11 +197,17 @@ async def test_refresh_token_rotation_old_rejected(client):
 
 @pytest.mark.asyncio
 async def test_get_user_pubkeys(client):
+    """
+    The endpoint resolves an account; it is not a key directory any more.
+
+    Publishing user identity keys is what finding H3 exploited — the invite flow
+    wrapped the group key for whatever came back. Keys are now generated per node
+    and pinned there, so there is nothing here to substitute.
+    """
     pk_ed, pk_x, _ = _gen_user_keys()
     await client.post("/v1/users/register", json={
         "username": "frank", "email": "frank@example.com",
-        "password": "frankpass99",
-        "pk_user_ed25519": pk_ed, "pk_user_x25519": pk_x})
+        "password": "frankpass99"})
     login = await client.post("/v1/users/login", json={
         "username": "frank", "password": "frankpass99"})
     token = login.json()["access_token"]
@@ -206,8 +215,10 @@ async def test_get_user_pubkeys(client):
     r = await client.get("/v1/users/frank/pubkeys",
                          headers={"Authorization": f"Bearer {token}"})
     assert r.status_code == 200
-    assert r.json()["pk_ed25519"] == pk_ed
-    assert r.json()["pk_x25519"]  == pk_x
+    body = r.json()
+    assert body["user_id"] and body["username"] == "frank"
+    assert "pk_ed25519" not in body, "user identity keys must not be published (H3)"
+    assert "pk_x25519" not in body, "user identity keys must not be published (H3)"
 
 
 # ── Nodes ─────────────────────────────────────────────────────────────────────