fix: swarm privacy, revocation persistence, keystore KDF, audit integrity

Phase 11.5 hardening batch — H7, H4, M2, M6, M7, L1, L3, L6.

H7 — private content hashes leaked to the hub. The daemon registered blake3
hashes for every group it hosted, private ones included, giving the hub a
content fingerprint of every private file and letting anyone confirm whether a
known file exists in the network. The leak was dormant only because the routes
were declared on the groups router with a full path and mounted at
/v1/groups/v1/swarm/* — the node's calls 404'd into a swallowed exception.
Fixing the path alone would have activated the leak, so both land together:
registration is gated on group visibility, the routes moved to a real
/v1/swarm router, and the lookup now requires authentication.

H4 — revocation was advisory. Group revocations were signed and broadcast by
the hub and then dropped by the node, whose handler understood only "user" and
"jti", so "suspend a group" enforced nothing. The denylist was also in-memory
only, so a restart silently un-revoked everyone. Now persisted to
data_dir/denylist.json, group targets honoured on both transports, and live
sessions for a revoked group are closed.

M2 — the node keystore, which protects the node's Ed25519 and X25519 private
keys, was still deriving at 64 MB long after the hub's password verifier moved
to 256 MB; the docs recorded the bump as done, true for the hub only. Raising
the constant alone would have made every existing keystore permanently
undecryptable, so envelopes now record the parameters they were written with
and pre-M2 files continue to open under the legacy profile.

M6 — registration inserted its audit row with a NULL user_id and then ran
UPDATE ip_logs SET user_id=<new> WHERE user_id IS NULL, claiming every
unattributed row in the table: failed logins for other usernames, concurrent
registrations. In logs retained a year for legal requests, that attributed
other people's connections to the wrong account.

M7 — X-Forwarded-For was trusted unconditionally at four call sites, so anyone
could forge the IP written to the compliance log and evade per-IP rate limits.
New netutil.client_ip honours the header only from a trusted proxy and takes
the rightmost hop (the one our proxy appended); no direct header reads remain.

L1 dead GEK_REQUEST/GEK_RESPONSE constants removed; L3 peer errors no longer
echo exception text (paths, internal state); L6 email sanity-checked instead of
accepting any string — deliberately not RFC 5322, to avoid a new dependency.

test_daemon_index_change_pushes_to_peers asserted that a PRIVATE group's hashes
are registered with the hub. Split: private asserts not-called (index push to
members still asserted), and a new test proves public groups still register.
That is the fourth pre-existing test found asserting a vulnerability as
intended behaviour, after gek auto-activation, the transport-wide chat_store
and the blind admin challenge.

Tests: 116 node, 132 hub+common. Regression suite now 43.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 117 insertions, 0 deletions

diff --git a/packages/meshbay-node/tests/test_security_regressions.py b/packages/meshbay-node/tests/test_security_regressions.py
index a480d21..9552848 100644
--- a/packages/meshbay-node/tests/test_security_regressions.py
+++ b/packages/meshbay-node/tests/test_security_regressions.py
@@ -348,6 +348,123 @@ def test_admin_challenge_expires(tmp_path):
                for m in session.sent)
 
 
+def test_denylist_persists_and_honours_groups(tmp_path):
+    """
+    H4: revocations lived only in memory, so a node restart silently un-revoked
+    everyone, and 'group' targets were dropped entirely — the hub signed and
+    broadcast them, the node's handler understood only 'user' and 'jti'.
+    """
+    from meshbay_node.transport import Denylist
+
+    path = tmp_path / "denylist.json"
+    first = Denylist(path=path)
+    first.deny_group("g-revoked")
+    first.deny_user("u-revoked")
+    first.deny_jti("j-revoked")
+
+    # A fresh instance stands in for a daemon restart.
+    reloaded = Denylist(path=path)
+    assert reloaded.is_denied("", "", "g-revoked"), "group revocation not honoured"
+    assert reloaded.is_denied("u-revoked", "")
+    assert reloaded.is_denied("", "j-revoked")
+    assert not reloaded.is_denied("someone", "other", "g-allowed")
+
+
+def test_swarm_registration_skips_private_groups():
+    """
+    H7: the daemon registered content hashes for every group, private included,
+    handing the hub a fingerprint of every private file. The bug was masked by a
+    mis-mounted route, so fixing the route without this filter would have turned a
+    dormant leak into a live one.
+    """
+    source = (Path(__file__).parent.parent / "src" / "meshbay_node"
+              / "daemon.py").read_text()
+    assert 'visibility' in source and '_register_swarm' in source
+    # Both registration sites must gate on public visibility.
+    for marker in ['gctx.get("visibility") != "public"',
+                   'group_cfg.visibility == "public"']:
+        assert marker in source, f"swarm registration not gated: {marker}"
+
+
+def test_keystore_argon2_is_production_strength():
+    """M2: the keystore protects the node's private keys and sat at 64 MB."""
+    from meshbay_common.crypto import ARGON2_MEMORY_COST
+    assert ARGON2_MEMORY_COST >= 262144
+
+
+def test_keystore_records_argon2_params_for_migration(tmp_path):
+    """
+    M2: raising the parameters must not orphan existing keystores, so each
+    envelope records the parameters it was written with.
+    """
+    import json
+    from meshbay_node.keystore import create_keystore, load_keystore
+
+    path = tmp_path / "keystore.enc"
+    created = create_keystore(path=path, password="correct horse battery")
+    envelope = json.loads(path.read_text())
+    assert envelope["argon2"]["memory_cost"] >= 262144
+
+    reopened = load_keystore(path=path, password="correct horse battery")
+    assert reopened.pk_ed25519_b64 == created.pk_ed25519_b64
+
+
+def test_legacy_keystore_still_opens(tmp_path):
+    """M2: a keystore written under the 64 MB profile must still unlock."""
+    import base64 as _b64
+    import json
+    import msgpack
+    from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
+    from meshbay_common.crypto import (
+        LEGACY_ARGON2_ITERATIONS, LEGACY_ARGON2_LANES, LEGACY_ARGON2_MEMORY_COST,
+        derive_keystore_key, encrypt_keystore, pk_to_b64, sk_to_b64,
+    )
+    from meshbay_node.keystore import load_keystore
+
+    sk_ed, sk_x = Ed25519PrivateKey.generate(), X25519PrivateKey.generate()
+    payload = msgpack.packb({
+        "sk_ed25519_b64": sk_to_b64(sk_ed),
+        "sk_x25519_b64": sk_to_b64(sk_x),
+    }, use_bin_type=True)
+
+    salt = b"\x01" * 16
+    key = derive_keystore_key(
+        "legacy-pass", salt,
+        iterations=LEGACY_ARGON2_ITERATIONS,
+        memory_cost=LEGACY_ARGON2_MEMORY_COST,
+        lanes=LEGACY_ARGON2_LANES,
+    )
+    iv, ct, tag = encrypt_keystore(payload, key)
+
+    path = tmp_path / "legacy.enc"
+    # No "argon2" key — exactly how pre-M2 envelopes look.
+    path.write_text(json.dumps({
+        "version": 1,
+        "argon2_salt_b64": _b64.b64encode(salt).decode(),
+        "iv_b64": _b64.b64encode(iv).decode(),
+        "tag_b64": _b64.b64encode(tag).decode(),
+        "ciphertext_b64": _b64.b64encode(ct).decode(),
+    }))
+
+    keys = load_keystore(path=path, password="legacy-pass")
+    assert keys.pk_ed25519_b64 == pk_to_b64(sk_ed.public_key())
+    assert keys.pk_x25519_b64 == pk_to_b64(sk_x.public_key())
+
+
+def test_dead_gek_protocol_constants_removed():
+    """L1: the node never serves a GEK; the message types should not suggest it."""
+    from meshbay_common.protocol import MNP
+    assert not hasattr(MNP, "GEK_REQUEST")
+    assert not hasattr(MNP, "GEK_RESPONSE")
+
+
+def test_peer_errors_do_not_leak_internals():
+    """L3: exception text carries filesystem paths and internal state."""
+    source = (Path(__file__).parent.parent / "src" / "meshbay_node"
+              / "transport" / "webrtc_server.py").read_text()
+    assert '"detail": str(e)' not in source
+
+
 def test_admin_ui_escapes_filenames(tmp_path):
     """
     H2: filenames are chosen by any group member and were rendered into the