aboutsummaryrefslogtreecommitdiffstats
path: root/packages/meshbay-common/src/meshbay_common/__init__.py
diff options
context:
space:
mode:
Diffstat (limited to 'packages/meshbay-common/src/meshbay_common/__init__.py')
-rw-r--r--packages/meshbay-common/src/meshbay_common/__init__.py10
1 files changed, 9 insertions, 1 deletions
diff --git a/packages/meshbay-common/src/meshbay_common/__init__.py b/packages/meshbay-common/src/meshbay_common/__init__.py
index 216a18f..842c52d 100644
--- a/packages/meshbay-common/src/meshbay_common/__init__.py
+++ b/packages/meshbay-common/src/meshbay_common/__init__.py
@@ -241,5 +241,13 @@ __version__ = "0.16.0"
# `invite_link_result` and `invite_cancel`, a code bound to no account until it
# is redeemed. Additive in the same way — a 3.3 node answers `unknown message
# type`, and no client can hold a link code for a node that could not issue one.
-MNP_VERSION = "3.4"
+#
+# 4.0 (2026-09-25) is a MAJOR — a change to what a peer must *present*, not an
+# additive message (§5.6). A member now authenticates to a node with a
+# short-lived MNP-audience token (aud=MNP_AUD), never its hub session token: the
+# node operator holds whatever is presented, and the session token opens the hub
+# API. A pre-4.0 client presents the session token and is refused at the
+# handshake — there is no compatibility branch, because leaving one would keep
+# the disclosure reachable on every node. So the floor moves with it.
+MNP_VERSION = "4.0"
MHP_VERSION = "0.1"