1 files changed, 22 insertions, 1 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/relay.py b/packages/meshbay-hub/src/meshbay_hub/api/relay.py
index c6ef26e..08d935b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/relay.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/relay.py
@@ -32,7 +32,28 @@ from meshbay_hub.db.models import User
 
 log = logging.getLogger(__name__)
 
-router = APIRouter(prefix="/v1/relays", tags=["relay"])
+# **Closed, the same way and for a similar reason as federation.** Nothing in the
+# tree calls these routes — no node asks for a relay, no client offers one — and
+# §11.1 measured two ISPs with no TURN relay needed. Two of the three take no
+# account and answer anyone who can reach the hub, so a registry nothing uses
+# was an unauthenticated surface kept for its own sake. A constant, not a
+# setting: re-opening it means building the node side first, then flipping this.
+RELAYS_ENABLED = False
+
+
+def _relays_open() -> None:
+    """Refuse every route on this router while the registry is closed.
+
+    On the router rather than in each handler, so a route added later is closed
+    before anybody remembers to write the check (C6).
+    """
+    if not RELAYS_ENABLED:
+        raise HTTPException(status_code=503,
+                            detail="The relay registry is not enabled on this hub")
+
+
+router = APIRouter(prefix="/v1/relays", tags=["relay"],
+                   dependencies=[Depends(_relays_open)])
 
 # In-memory relay registry (production: DB table)
 _relays: dict[str, dict] = {}   # relay_id → {endpoint, pk, last_seen, capacity}