feat(node): several named roots per group, and one implementation per operation

Stage A — a group's content is a set of named roots
---------------------------------------------------
`shared_dir` becomes a list of {name, path, kind}. The name is the directory's
basename, derived once at add time and *stored*: recomputing it would
re-identify a whole library the day someone renames a folder on disk. Duplicate
names are refused case-insensitively and no root may contain another — both
compared with NFC folding, because most of these directories live on exFAT or
NTFS where `Films` and `films` are one directory.

Every index path carries its root name, in a one-root group as much as in a
five-root one. One path shape has to be got right once; two have to be kept
right for ever.

**A root that goes away freezes; it never empties.** Unmounting a volume makes
watchdog report every file under it as deleted, or presents an empty directory
to the next scan. Acting on either propagates deletions for a whole library to
every member, as though the owner had erased it. So a deletion is acted on only
once its root is confirmed readable, and availability is tracked per root — one
unplugged drive leaves the others serving. 12 tests, verified to fail against an
indexer without the check.

Events are not trusted to be complete either: ReadDirectoryChangesW drops them
under load and inotify on a FUSE mount misses changes made outside it. A
periodic reconciliation sweep is the only thing that recovers a missed event.

MNP 0.2 → 0.3 (additive). The hub needs no change: SwarmSource carries a content
hash, a node id and an endpoint — no paths, no filenames — and private groups
register nothing (H7).

Stage B — one implementation behind every front door
----------------------------------------------------
C1 and C6 were both "a second path into the node with its own weaker
handshake". Two implementations of `revoke` with two authorization checks is
that shape one size down. `meshbay_node/ops.py` holds each operation once,
takes the daemon state, and knows nothing about HTTP, argv or MNP. The loopback
API is one `_op(...)` line per endpoint; the MNP handlers call the same
functions. test_ops.py asserts the shape rather than trusting it.

Phase 14 is finished on top of it — `group list`, `gek init|rotate`, `reload`
(SIGHUP), `denylist show|clear`, `file list|rm`. **No operator action requires a
browser any more.** Plus `gek_rotate` and `member_unpin` as operator-signed MNP
operations: rotation is the half of revocation that revocation cannot do, since
the ex-member holds the current key, and the node generates the replacement
with its own CSPRNG — no key material crosses the wire, which is what the C5b
rule is actually about.

Two bugs found by running it rather than by testing it
------------------------------------------------------
GroupIndex is keyed by **content hash**, so the same bytes at two paths are one
entry — which is also why a scan reports ten files and indexes nine.
Reconciliation compared paths, so it decided the second path was a missed event
every 60 s, rewrote the entry and pushed an index update to every connected
peer. Seen in a live node's log.

`meshbay-node reload` crashed on first use with `subprocess` unimported: the
module compiles fine, which is the "syntax, not names" trap already recorded for
the SPA. test_cli_dispatch.py now walks every verb and refuses to let one be
added to the parser without an entry there.

Also corrected: protocol.py declared a second MNP_VERSION of "0.1" while the
wire carried "0.2" — harmless only because nothing imported it. And
_do_dir_create/_do_dir_delete referenced an undefined `filename` on their error
path.

740 tests pass; QE/deploy/e2e.py passes end to end against the live deployment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 179 insertions, 0 deletions

diff --git a/packages/meshbay-node/tests/test_ops.py b/packages/meshbay-node/tests/test_ops.py
new file mode 100644
index 0000000..f7fd259
--- /dev/null
+++ b/packages/meshbay-node/tests/test_ops.py
@@ -0,0 +1,179 @@
+"""
+One implementation, several front doors.
+
+The point of `meshbay_node.ops` is not tidiness. C1 and C6 were both "a second
+path into the node with its own weaker handshake", and two implementations of
+`revoke` with two authorization checks is that shape one size down. So the tests
+that matter here are the ones that would fail if a second implementation
+appeared: the adapters must be thin, and the operations must not decide who may
+call them.
+"""
+
+import inspect
+from pathlib import Path
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from conftest import one_root
+from meshbay_node import ops
+from meshbay_node.indexer.group_index import GroupIndex
+from meshbay_node.transport.quic_server import Denylist
+
+
+
+def _state(tmp_path: Path) -> dict:
+    shared = tmp_path / "shared"
+    shared.mkdir(exist_ok=True)
+    index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate())
+    return {
+        "groups_ctx": {"g" * 32: {"index": index, "roots": one_root(shared),
+                                  "gek": None}},
+        "denylist": Denylist(path=tmp_path / "denylist.json"),
+        "indexes": {"g" * 32: index},
+    }
+
+
+# ── The adapters stay thin ───────────────────────────────────────────────────
+
+def test_operations_take_state_and_nothing_web_shaped():
+    """
+    An operation that knew about HTTP could not be called from MNP without a
+    second copy. Every public operation therefore takes `state` first and
+    returns plain data.
+    """
+    public = [(n, f) for n, f in vars(ops).items()
+              if inspect.iscoroutinefunction(f) and not n.startswith("_")]
+    assert public, "no operations found — did the module move?"
+    for name, fn in public:
+        params = list(inspect.signature(fn).parameters)
+        assert params and params[0] == "state", (
+            f"{name} does not take state first — an adapter would have to "
+            f"assemble something for it, which is where a second implementation "
+            f"begins")
+
+
+def test_the_http_adapter_adds_no_logic():
+    """
+    Each loopback handler should be a call into `ops` and nothing else. A
+    handler that grew a check of its own would be a rule the MNP path does not
+    have.
+    """
+    import meshbay_node.ui.app as ui
+    source = inspect.getsource(ui)
+    # Every endpoint that performs an operation routes through _op(...).
+    for endpoint in ("operator_pair", "create_invite", "revoke_member",
+                     "unpin_member", "init_gek", "attach_group", "delete_file"):
+        start = source.index(f"async def {endpoint}(")
+        body = source[start:start + 700]
+        assert "_op(" in body.split("\n\n")[0] + body, (
+            f"{endpoint} does not go through the shared adapter")
+        assert "roster.set_status" not in body and "generate_gek" not in body, (
+            f"{endpoint} performs the operation itself instead of calling ops")
+
+
+def test_op_errors_carry_a_status_without_importing_http():
+    source = inspect.getsource(ops)
+    for forbidden in ("JSONResponse", "fastapi", "starlette", "HTTPException"):
+        assert forbidden not in source, (
+            f"ops imports {forbidden} — it must not know which adapter called it")
+
+
+# ── Denylist (14.10) ─────────────────────────────────────────────────────────
+
+async def test_denylist_reports_what_it_refuses(tmp_path):
+    state = _state(tmp_path)
+    state["denylist"].deny_user("alice")
+    state["denylist"].deny_group("g" * 32)
+
+    out = await ops.read_denylist(state)
+
+    assert out["users"] == ["alice"]
+    assert out["groups"] == ["g" * 32]
+    assert out["count"] == 2
+
+
+async def test_clearing_one_subject_leaves_the_rest(tmp_path):
+    state = _state(tmp_path)
+    state["denylist"].deny_user("alice")
+    state["denylist"].deny_user("bob")
+
+    out = await ops.clear_denylist(state, subject="alice")
+
+    assert out["removed"] == 1
+    assert (await ops.read_denylist(state))["users"] == ["bob"]
+
+
+async def test_clearing_everything_says_how_much(tmp_path):
+    """The count is the point: it tells the operator whether they undid one
+    revocation or all of them."""
+    state = _state(tmp_path)
+    for name in ("a", "b", "c"):
+        state["denylist"].deny_user(name)
+
+    out = await ops.clear_denylist(state)
+
+    assert out["removed"] == 3
+    assert (await ops.read_denylist(state))["count"] == 0
+
+
+async def test_denylist_survives_a_restart(tmp_path):
+    """Finding H4: revocations used to live only in memory, so a restart
+    silently un-revoked everyone."""
+    state = _state(tmp_path)
+    state["denylist"].deny_user("alice")
+
+    reopened = Denylist(path=tmp_path / "denylist.json")
+    assert reopened.is_denied("alice", jti="", group_id="")
+
+
+# ── File deletion (14.11) ────────────────────────────────────────────────────
+
+async def test_deleting_a_file_removes_it_from_disk_and_index(tmp_path):
+    state = _state(tmp_path)
+    ctx = state["groups_ctx"]["g" * 32]
+    target = ctx["roots"].roots[0].path / "gone.txt"
+    target.write_text("x")
+    from meshbay_common.protocol import IndexEntry
+    ctx["index"].add_entry(IndexEntry(id="a" * 64, name="gone.txt", path="shared",
+                                      size=1, type="other", added_at=0))
+
+    out = await ops.delete_file(state, "g" * 32, "a" * 64)
+
+    assert out["status"] == "deleted"
+    assert not target.exists()
+    assert ctx["index"].get_entry("a" * 64) is None
+
+
+async def test_deleting_from_an_unavailable_root_is_refused(tmp_path):
+    """
+    A frozen root's files are still listed. Deleting one would either fail
+    obscurely or — worse, once the drive returns — leave the index and the disk
+    disagreeing.
+    """
+    state = _state(tmp_path)
+    ctx = state["groups_ctx"]["g" * 32]
+    from meshbay_common.protocol import IndexEntry
+    ctx["index"].add_entry(IndexEntry(id="a" * 64, name="frozen.txt", path="shared",
+                                      size=1, type="other", added_at=0))
+    ctx["roots"].roots[0].available = False
+
+    with pytest.raises(ops.OpError, match="frozen, not gone"):
+        await ops.delete_file(state, "g" * 32, "a" * 64)
+
+    assert ctx["index"].get_entry("a" * 64) is not None
+
+
+async def test_deleting_an_unknown_file_says_so(tmp_path):
+    state = _state(tmp_path)
+    with pytest.raises(ops.OpError, match="No such file"):
+        await ops.delete_file(state, "g" * 32, "f" * 64)
+
+
+async def test_an_unhosted_group_offers_what_it_does_host(tmp_path):
+    """A bare "no such group" leaves an operator guessing at a UUID."""
+    state = _state(tmp_path)
+    with pytest.raises(ops.OpError) as exc:
+        await ops.delete_file(state, "z" * 32, "a" * 64)
+    assert exc.value.status == 404
+    assert exc.value.extra.get("available")