1 files changed, 33 insertions, 2 deletions
diff --git a/packages/meshbay-common/src/meshbay_common/handshake.py b/packages/meshbay-common/src/meshbay_common/handshake.py
index 73e0b2e..992fe8a 100644
--- a/packages/meshbay-common/src/meshbay_common/handshake.py
+++ b/packages/meshbay-common/src/meshbay_common/handshake.py
@@ -63,6 +63,7 @@ from typing import Any, Protocol
 import jwt
 
 from meshbay_common import MNP_VERSION
+from meshbay_common.tokens import MNP_AUD
 
 HANDSHAKE_PREFIX = b"meshbay:mnp:handshake:v1"
 CHALLENGE_PREFIX = b"meshbay:mnp:challenge:v1"
@@ -84,7 +85,11 @@ CHALLENGE_PREFIX = b"meshbay:mnp:challenge:v1"
 # has no vocabulary to understand — or serving it outside every cap the operator
 # set, which makes the caps decoration. Neither is honest, so it is refused
 # here, with a code and a sentence.
-MNP_MIN_SUPPORTED = "3.0"
+# 4.0 (2026-09-25): a member authenticates with an MNP-audience token, not the
+# hub session token (MNP_VERSION note). A pre-4.0 peer presents the session
+# token, which this node now refuses — so the floor moves to 4.0 rather than
+# leaving a branch that would keep a hub credential reachable by every node.
+MNP_MIN_SUPPORTED = "4.0"
 
 ROLE_CLIENT = "client"
 ROLE_NODE = "node"
@@ -264,6 +269,7 @@ def authorize_token(
     hosted_groups: Any | None = None,
     denylist: DenylistLike | None = None,
     require_scope: str | None = "user",
+    node_pk_b64: str | None = None,
 ) -> AuthorizedPeer:
     """
     Everything decided from the JWT, before any proof is exchanged.
@@ -271,17 +277,42 @@ def authorize_token(
     Raises HandshakeError with a peer-safe message. Deliberately strict about
     `group_id`: it used to be optional, and omitting it skipped the membership
     check entirely and fell back to the node's first group (M1).
+
+    `node_pk_b64` binds the token to **this** node (E10). The MNP token names
+    the node it was minted for (`node` claim), so a member's token captured by
+    the operator of one node cannot be replayed to another node the member also
+    belongs to — not even to reach the pre-proof window there. A node always
+    passes its own key; a caller that passes `None` (a unit test not exercising
+    this) skips the check.
     """
     try:
         decoded = jwt.decode(token, hub_pk_pem, algorithms=["EdDSA"],
-                             leeway=JWT_LEEWAY_SECONDS)
+                             leeway=JWT_LEEWAY_SECONDS,
+                             audience=MNP_AUD,
+                             options={"require": ["exp", "sub", "scope"]})
     except Exception as exc:
+        # An audience mismatch lands here too: a hub *session* token
+        # (aud=HUB_API_AUD) presented to a node is refused. That is the point —
+        # the credential a member hands a node must not be one that also opens
+        # the hub API (see meshbay_common.tokens). A member presents the
+        # short-lived MNP token instead.
         raise HandshakeError(f"Invalid JWT: {exc}") from exc
 
     # A node-scoped daemon token must not be usable as a client token (M9).
     if require_scope is not None and decoded.get("scope", "user") != require_scope:
         raise HandshakeError("Wrong token scope")
 
+    # The token names the node it was minted for (`node` claim). A member's real
+    # client always binds it to the node it is reaching, so a token captured by
+    # that node's operator and replayed to a *second* node the member also uses
+    # is refused here — before the pre-proof window can serve anything (E10).
+    # A token that names no node is not refused: the hub only ever mints one for
+    # the authenticated requester, so an unbound token grants nothing across
+    # accounts, and this keeps older or non-binding callers working.
+    node_claim = decoded.get("node", "")
+    if node_pk_b64 is not None and node_claim and node_claim != node_pk_b64:
+        raise HandshakeError("Token is not for this node", code="wrong_node")
+
     user_id = decoded.get("sub", "")
     jti = decoded.get("jti", "")
     if not user_id: