feat(node): operator surface — member list, invite, revoke, unpin over SSH

A node admits people from its own roster, and until now a headless operator had
no way to put anyone on it: pairing worked from the CLI, everything else needed a
browser on a machine that does not have one. Absorbs milestones 14.3/14.4.

  member list                 who is admitted, role, status, when and how pinned
  member invite <username>     one-time code; the node wraps the key when they
                               connect, so nobody has to be online then
  member revoke <username>     stop serving them the key
  member unpin <username>      forget the pin so they can pair again after a reset

All of it goes through the daemon's loopback API with the per-run session token
(11.5.3) — _daemon_api() in daemon.py, which also replaced three hand-rolled
urllib blocks. `status` deliberately still reads the keystore, config and roster
directly, so it works while the daemon is stopped.

Two things the commands say out loud, because getting them wrong is silent:

  - revoke ends by telling the operator to rotate the key. The ex-member stops
    receiving it on their next connection, but they hold the current one, and
    "revoked" reads like it took the key back.
  - revoke/unpin refuse a username the roster does not know instead of acting on
    nobody. A typo must not look like success.

Code lifetimes now differ by what the act is: 7 days for an invitation, which
crosses a human conversation and gets answered whenever someone reads their
messages, and 24 h for operator pairing, which is typed during the SSH session
that printed it. Both configurable ([node] invite_ttl_hours, pair_ttl_hours). A
day was long enough for the second and not for the first — a code that dies over
a weekend means finding a browser to issue another one.

The roster is also in the local admin UI, escaped: usernames come from the hub
and land on the page that can re-key groups and read the audit log, so H2's rule
covers them exactly as it covers filenames.

Verified by driving the real CLI against a stub daemon over a socket, which is
how the "known: <nothing>" bug in the not-found path turned up.

Tests: 89 node here (roster, endpoints, CLI routing, TTL config).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 21 insertions, 3 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/roster.py b/packages/meshbay-node/src/meshbay_node/roster.py
index f231792..dab1497 100644
--- a/packages/meshbay-node/src/meshbay_node/roster.py
+++ b/packages/meshbay-node/src/meshbay_node/roster.py
@@ -36,7 +36,22 @@ log = logging.getLogger(__name__)
 # when reading a code aloud or typing it from a phone screen.
 _ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"
 CODE_LEN = 8                      # 8 × 5 bits = 40 bits of entropy
-DEFAULT_INVITE_TTL = 24 * 3600    # seconds
+
+# Two different rhythms, so two different lifetimes.
+#
+# An invitation crosses a human conversation: it is sent by mail or message and
+# answered whenever the other person next looks. A day is not enough — the code
+# dies over a weekend and someone has to be at a browser, with the node online, to
+# issue another one.
+#
+# Operator pairing crosses an SSH session: the code is printed and typed minutes
+# later. There is no reason for it to outlive the sitting.
+#
+# The longer window costs little: a code is single use, bound to one account,
+# never seen by the hub, and 40 bits do not fall to guessing in a week against the
+# node-wide lockout.
+DEFAULT_INVITE_TTL = 7 * 24 * 3600   # seconds — member invitations
+DEFAULT_PAIR_TTL = 24 * 3600         # seconds — operator pairing
 
 _SCHEMA = """\
 CREATE TABLE IF NOT EXISTS identities (
@@ -358,14 +373,17 @@ async def open_roster(data_dir: Path) -> Roster:
     return roster
 
 
-def write_code_file(data_dir: Path, code: str, expires_at: str) -> Path:
+def write_code_file(data_dir: Path, code: str, expires_at: str,
+                    name: str = "pair-code") -> Path:
     """
     Leave the code in a file as well as on stdout.
 
     An operator working over SSH may not be able to copy out of their terminal,
     and a code that can only be read off a scrolled-away screen is a dead end.
+    Pairing and invitation codes go to different files so one does not overwrite
+    the other.
     """
-    path = data_dir / "pair-code"
+    path = data_dir / name
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(f"{code}\nexpires {expires_at}\n")
     os.chmod(path, 0o600)