diff options
Diffstat (limited to 'docs/MESHBAY_DESIGN.md')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 39a24da..f125825 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1519,7 +1519,17 @@ account has and when each last signed in. Registration on the node socket requires a **node-scoped token**, verifies the node record against the token subject, and **derives group claims from the database**: a node may narrow the set to what it hosts but cannot widen it, and cannot displace a -live registration (**C2**). +live registration (**C2**). Narrowing goes all the way down: **an empty +claim is a claim on nothing**, never on everything. Reading it as "all of this +account's groups" made an unconfigured node a registered source for groups it could +not serve — including other members' — and since `/v1/groups/{id}/nodes` answers in +registration order, one such node reaching the hub first made a group unopenable for +everyone in it (2026-09-11). The ceiling applies to **every** message that changes the +set, not only to the registration: a node that may narrow on connecting and widen on +reload has no ceiling. + +A client must therefore treat that list as candidates rather than a ranking, and try +the next node on a `not_hosted` refusal (`MESHBAY_NODE_PROTOCOL.md` §6.3). The node authenticates to the hub with an Ed25519 signature over a domain-separated timestamped message — **no password and no auth key on a node** — and receives a |