From 1f6b67c7bfc8078991a4607bb0419aea15bfd54c Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 23 Sep 2026 18:16:44 +0200 Subject: docs: qualify what an invitation link changes about the code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The security claims table, §3.4's property 2, the protocol's stated limits, the quickstart and the user guide's defaults now say where a link's code differs: bound to its account only when redeemed, and held by the hub when the inviter asks it to mail. Co-Authored-By: Claude Opus 5.5 --- docs/MESHBAY_NODE_PROTOCOL.md | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'docs/MESHBAY_NODE_PROTOCOL.md') diff --git a/docs/MESHBAY_NODE_PROTOCOL.md b/docs/MESHBAY_NODE_PROTOCOL.md index 3ae533b..48af939 100644 --- a/docs/MESHBAY_NODE_PROTOCOL.md +++ b/docs/MESHBAY_NODE_PROTOCOL.md @@ -2180,6 +2180,11 @@ walks through the gate meant to stop it. attacks apart: the pairing code defeats a hub that *lies in its directory* — silent, undetectable, per-request — not one that *rewrites the client*, which is an artifact that can be inspected and compared. +* **An invitation link's code is a bearer code** (§8.6). The node admits whoever brings + it first; what restricts who can bring it is the hub, which lets only the addressed + account reach the node — a rule an active hub does not have to keep. The challenge + signature (§6.5) keeps the code from reaching any node but the issuer; it does not + keep it from a hub the inviter asked to mail it, which then holds it. * **The pre-proof window is a disclosure surface.** A hub that forges a JWT can fetch a member's *encrypted* keypair bundle. It is bounded, audited, and closes when clients stop storing bundles on other people's nodes (§7). -- cgit v1.2.3