feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist)

Implements all 8 milestones (7.0-7.7):

- 7.0: JWT carries `groups` claim; node verifies group membership at
  MNP handshake (QUIC + TCP+TLS). Resolves security review C2.
- 7.1: QUIC 0-RTT session resumption via stored session tickets
  (17-21ms reconnect vs 47ms cold).
- 7.2: Hub→node WebSocket signaling for NAT punch coordination
  (`client_incoming`/`punch_ready`) + jti denylist push. Denylist
  class blocks revoked users/jtis at handshake.
- 7.3: Multi-group daemon — one QUIC port serves N groups with
  per-group GEK, shared_root, and index routing.
- 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg
  segment extraction).
- 7.5: Sender Keys protocol for group chat (Signal Groups approach).
  Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM
  encryption, Ed25519 signing. Resolves security review C1.
- 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type
  with peer broadcast, web UI with WebSocket push.
- 7.7: Argon2id calibration CLI.

First security review included (first-review.md). 109 tests, demo-v3
validated against meshbay.org production hub.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

4 files changed, 109 insertions, 4 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
index c1697a7..bb88283 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/revocation.py
@@ -25,6 +25,7 @@ On receipt: immediately refuse JWT tokens matching the revoked user_id,
 and close active connections for that user.
 """
 
+import asyncio
 import base64
 import json
 import logging
@@ -50,6 +51,7 @@ router = APIRouter(tags=["revocation"])
 # ── Connected node registry ───────────────────────────────────────────────────
 
 _connected_nodes: dict[str, WebSocket] = {}   # node_id → websocket
+_punch_events: dict[str, asyncio.Event] = {}  # node_id → signaling event
 
 
 def get_connected_node_count() -> int:
@@ -122,12 +124,16 @@ async def node_websocket(ws: WebSocket):
         log.info("Node WS connected: %s", node_id[:8])
         await ws.send_text(json.dumps({"type": "auth_ok", "node_id": node_id}))
 
-        # Keep-alive loop — wait for ping or disconnect
+        # Message loop — handle ping, punch_ready, etc.
         while True:
             raw = await ws.receive_text()
             msg = json.loads(raw)
             if msg.get("type") == "ping":
                 await ws.send_text(json.dumps({"type": "pong"}))
+            elif msg.get("type") == "punch_ready":
+                event = _punch_events.get(node_id)
+                if event:
+                    event.set()
 
     except WebSocketDisconnect:
         log.info("Node WS disconnected: %s", (node_id or "unknown")[:8])
@@ -140,6 +146,44 @@ async def node_websocket(ws: WebSocket):
 
 # ── Admin revocation endpoint ─────────────────────────────────────────────────
 
+class IncomingRequest(BaseModel):
+    peer_ip:   str
+    peer_port: int
+
+
+@router.post("/v1/nodes/{node_id}/incoming", status_code=200)
+async def notify_incoming(
+    node_id: str,
+    body: IncomingRequest,
+    current_user: User = Depends(get_current_user),
+):
+    """
+    Signal a node that a client wants to connect (NAT punch coordination).
+    Hub forwards the request via WebSocket; node punches NAT and replies punch_ready.
+    """
+    ws = _connected_nodes.get(node_id)
+    if not ws:
+        raise HTTPException(status_code=404, detail="Node not connected")
+
+    event = asyncio.Event()
+    _punch_events[node_id] = event
+
+    await ws.send_text(json.dumps({
+        "type": "client_incoming",
+        "peer_ip": body.peer_ip,
+        "peer_port": body.peer_port,
+    }))
+
+    try:
+        await asyncio.wait_for(event.wait(), timeout=5.0)
+    except asyncio.TimeoutError:
+        raise HTTPException(status_code=504, detail="Node did not respond in time")
+    finally:
+        _punch_events.pop(node_id, None)
+
+    return {"status": "ready", "node_id": node_id}
+
+
 class RevokeRequest(BaseModel):
     target:    str   # "user" or "group"
     target_id: str
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index 5a7a3b4..5a2c7be 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -18,7 +18,7 @@ from meshbay_hub.auth import (
 )
 from meshbay_hub.config import HubConfig
 from meshbay_hub.db.engine import get_db
-from meshbay_hub.db.models import IPLog, RefreshToken, User
+from meshbay_hub.db.models import GroupMember, IPLog, RefreshToken, User
 from meshbay_hub.api.deps import get_current_user
 
 router = APIRouter(prefix="/v1/users", tags=["users"])
@@ -136,7 +136,11 @@ async def login(
     if user.status != "active":
         raise HTTPException(status_code=403, detail=f"Account {user.status}")
 
-    access_token = issue_access_token(user.id, user.pk_ed25519, ttl=_ttl())
+    memberships = await db.execute(
+        select(GroupMember.group_id).where(GroupMember.user_id == user.id))
+    group_ids = [gid for (gid,) in memberships.all()]
+    access_token = issue_access_token(
+        user.id, user.pk_ed25519, ttl=_ttl(), groups=group_ids)
     raw_rt, rt_hash = generate_refresh_token()
 
     expires_at = datetime.now(timezone.utc) + timedelta(seconds=_refresh_ttl())
@@ -175,7 +179,11 @@ async def token_refresh(
     if not user or user.status != "active":
         raise HTTPException(status_code=401, detail="User not found or suspended")
 
-    new_token = issue_access_token(user.id, user.pk_ed25519, ttl=_ttl())
+    memberships = await db.execute(
+        select(GroupMember.group_id).where(GroupMember.user_id == user.id))
+    group_ids = [gid for (gid,) in memberships.all()]
+    new_token = issue_access_token(
+        user.id, user.pk_ed25519, ttl=_ttl(), groups=group_ids)
     return {"access_token": new_token, "token_type": "bearer", "expires_in": _ttl()}
 
 
diff --git a/packages/meshbay-hub/src/meshbay_hub/auth.py b/packages/meshbay-hub/src/meshbay_hub/auth.py
index a4c3bfb..2b2c61e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/auth.py
+++ b/packages/meshbay-hub/src/meshbay_hub/auth.py
@@ -105,10 +105,12 @@ def issue_access_token(
     user_id: str,
     pk_user: str,
     ttl: int = 3600,
+    groups: list[str] | None = None,
 ) -> str:
     """
     Issue a signed JWT access token.
     Includes jti (UUID4) — required to prevent replay and enable revocation.
+    Includes groups — list of group_ids the user is a member of (node-side authz).
     """
     if _hub_sk_pem is None:
         raise RuntimeError("Hub keypair not loaded")
@@ -121,6 +123,7 @@ def issue_access_token(
         "jti":     str(uuid.uuid4()),
         "iat":     now,
         "exp":     now + ttl,
+        "groups":  groups or [],
     }
     return jwt.encode(payload, _hub_sk_pem, algorithm="EdDSA")
 
diff --git a/packages/meshbay-hub/tests/test_hub_api.py b/packages/meshbay-hub/tests/test_hub_api.py
index ea59f17..568d5d9 100644
--- a/packages/meshbay-hub/tests/test_hub_api.py
+++ b/packages/meshbay-hub/tests/test_hub_api.py
@@ -261,3 +261,53 @@ async def test_non_admin_cannot_add_member(client):
                           json=bundle,
                           headers={"Authorization": f"Bearer {dan_token}"})
     assert r.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_jwt_contains_groups_claim(client):
+    """JWT must contain a 'groups' list with group_ids the user is a member of."""
+    import jwt as pyjwt
+    pk_ed_a, pk_x_a, _ = _gen_user_keys()
+    pk_ed_b, pk_x_b, sk_x_b = _gen_user_keys()
+
+    await client.post("/v1/users/register", json={
+        "username": "grp_alice", "email": "ga@x.com", "password": "alicepass99",
+        "pk_user_ed25519": pk_ed_a, "pk_user_x25519": pk_x_a})
+    await client.post("/v1/users/register", json={
+        "username": "grp_bob", "email": "gb@x.com", "password": "bobpass99",
+        "pk_user_ed25519": pk_ed_b, "pk_user_x25519": pk_x_b})
+
+    # Login before joining any group — groups should be empty
+    r = await client.post("/v1/users/login", json={
+        "username": "grp_bob", "password": "bobpass99"})
+    token_pre = r.json()["access_token"]
+    r_pk = await client.get("/v1/hub/pubkey")
+    hub_pk = r_pk.json()["pk_hub_pem"].encode()
+    decoded_pre = pyjwt.decode(token_pre, hub_pk, algorithms=["EdDSA"])
+    assert decoded_pre["groups"] == []
+
+    # Alice creates a group and adds Bob
+    alice_token = (await client.post("/v1/users/login",
+                   json={"username": "grp_alice", "password": "alicepass99"})).json()["access_token"]
+    r = await client.post("/v1/groups", json={"name": "testgroup"},
+                          headers={"Authorization": f"Bearer {alice_token}"})
+    group_id = r.json()["group_id"]
+
+    gek = generate_gek()
+    bundle = wrap_gek(gek, base64.b64decode(pk_x_b))
+    await client.post(f"/v1/groups/{group_id}/members/grp_bob/gek",
+                      json=bundle,
+                      headers={"Authorization": f"Bearer {alice_token}"})
+
+    # Login again — groups should contain the new group
+    r = await client.post("/v1/users/login", json={
+        "username": "grp_bob", "password": "bobpass99"})
+    token_post = r.json()["access_token"]
+    decoded_post = pyjwt.decode(token_post, hub_pk, algorithms=["EdDSA"])
+    assert group_id in decoded_post["groups"]
+
+    # Alice (admin) should also have the group in her JWT
+    r = await client.post("/v1/users/login", json={
+        "username": "grp_alice", "password": "alicepass99"})
+    decoded_alice = pyjwt.decode(r.json()["access_token"], hub_pk, algorithms=["EdDSA"])
+    assert group_id in decoded_alice["groups"]