3 files changed, 52 insertions, 4 deletions
diff --git a/packages/meshbay-common/src/meshbay_common/__init__.py b/packages/meshbay-common/src/meshbay_common/__init__.py
index 77e6fac..842c52d 100644
--- a/packages/meshbay-common/src/meshbay_common/__init__.py
+++ b/packages/meshbay-common/src/meshbay_common/__init__.py
@@ -1,6 +1,6 @@
 """MeshBay common — shared crypto primitives and protocol types."""
 
-__version__ = "0.15.0"
+__version__ = "0.16.0"
 # 0.2: added PING/PONG, and `before`/`has_more` on chat history. Both are
 # additive — an 0.1 peer sends no `before` and gets the newest page, which is
 # what it wanted — so this is a MINOR bump, not a MAJOR one.
@@ -241,5 +241,13 @@ __version__ = "0.15.0"
 # `invite_link_result` and `invite_cancel`, a code bound to no account until it
 # is redeemed. Additive in the same way — a 3.3 node answers `unknown message
 # type`, and no client can hold a link code for a node that could not issue one.
-MNP_VERSION = "3.4"
+#
+# 4.0 (2026-09-25) is a MAJOR — a change to what a peer must *present*, not an
+# additive message (§5.6). A member now authenticates to a node with a
+# short-lived MNP-audience token (aud=MNP_AUD), never its hub session token: the
+# node operator holds whatever is presented, and the session token opens the hub
+# API. A pre-4.0 client presents the session token and is refused at the
+# handshake — there is no compatibility branch, because leaving one would keep
+# the disclosure reachable on every node. So the floor moves with it.
+MNP_VERSION = "4.0"
 MHP_VERSION = "0.1"
diff --git a/packages/meshbay-common/src/meshbay_common/handshake.py b/packages/meshbay-common/src/meshbay_common/handshake.py
index 73e0b2e..dedfeb1 100644
--- a/packages/meshbay-common/src/meshbay_common/handshake.py
+++ b/packages/meshbay-common/src/meshbay_common/handshake.py
@@ -63,6 +63,7 @@ from typing import Any, Protocol
 import jwt
 
 from meshbay_common import MNP_VERSION
+from meshbay_common.tokens import MNP_AUD
 
 HANDSHAKE_PREFIX = b"meshbay:mnp:handshake:v1"
 CHALLENGE_PREFIX = b"meshbay:mnp:challenge:v1"
@@ -84,7 +85,11 @@ CHALLENGE_PREFIX = b"meshbay:mnp:challenge:v1"
 # has no vocabulary to understand — or serving it outside every cap the operator
 # set, which makes the caps decoration. Neither is honest, so it is refused
 # here, with a code and a sentence.
-MNP_MIN_SUPPORTED = "3.0"
+# 4.0 (2026-09-25): a member authenticates with an MNP-audience token, not the
+# hub session token (MNP_VERSION note). A pre-4.0 peer presents the session
+# token, which this node now refuses — so the floor moves to 4.0 rather than
+# leaving a branch that would keep a hub credential reachable by every node.
+MNP_MIN_SUPPORTED = "4.0"
 
 ROLE_CLIENT = "client"
 ROLE_NODE = "node"
@@ -274,8 +279,15 @@ def authorize_token(
     """
     try:
         decoded = jwt.decode(token, hub_pk_pem, algorithms=["EdDSA"],
-                             leeway=JWT_LEEWAY_SECONDS)
+                             leeway=JWT_LEEWAY_SECONDS,
+                             audience=MNP_AUD,
+                             options={"require": ["exp", "sub", "scope"]})
     except Exception as exc:
+        # An audience mismatch lands here too: a hub *session* token
+        # (aud=HUB_API_AUD) presented to a node is refused. That is the point —
+        # the credential a member hands a node must not be one that also opens
+        # the hub API (see meshbay_common.tokens). A member presents the
+        # short-lived MNP token instead.
         raise HandshakeError(f"Invalid JWT: {exc}") from exc
 
     # A node-scoped daemon token must not be usable as a client token (M9).
diff --git a/packages/meshbay-common/src/meshbay_common/tokens.py b/packages/meshbay-common/src/meshbay_common/tokens.py
new file mode 100644
index 0000000..c393be5
--- /dev/null
+++ b/packages/meshbay-common/src/meshbay_common/tokens.py
@@ -0,0 +1,28 @@
+"""Token audiences — one hub key, two purposes, never interchangeable.
+
+The hub signs everything with one Ed25519 key, but a token has to say what it is
+*for*, or a credential minted for one purpose is honoured for another. Two
+audiences settle it:
+
+- ``HUB_API_AUD`` — a session token, presented to the **hub API** (``hubFetch``,
+  signaling). Carried by the browser and the desktop client, and by a node for
+  its own hub calls.
+- ``MNP_AUD`` — a short-lived token a member presents to a **node** in the MNP
+  handshake, and to nothing else. It authorises the member to that node
+  (``sub``, ``groups``, ``jti``) and is **useless at the hub API**.
+
+The reason this exists: a member hands whatever token it holds to every node it
+connects to (the handshake authenticates with it). If that were the session
+token, a node operator — who is in the threat model — would hold a live hub
+credential for the member and could act as them at the hub. Separating the
+audiences means the credential a node receives opens nothing at the hub, and the
+credential the hub API accepts is never disclosed to a node.
+
+The hub API decode (:func:`meshbay_hub.auth.decode_access_token`) binds
+``HUB_API_AUD``; the node handshake decode
+(:func:`meshbay_common.handshake.authorize_token`) binds ``MNP_AUD``. Each
+rejects the other's audience.
+"""
+
+HUB_API_AUD = "meshbay:hub-api"
+MNP_AUD = "meshbay:mnp"