Member tokens: reusable account credential authorizing key enrollment per node

AGENTS.md

@@ -32,7 +32,7 @@
 - Relay backpressure is global: any member's full queue 429s every publisher until drained (visible per §3, but one lagging member can stall the firehose — revisit before scale).
 - Member authority (Draft 0.5 §6): the MA-signed registry snapshot is authoritative when configured (`[node] registry` = file path or URL, `ma_key` pinned; monotonic version — rollback and forgery close the node; file path is mtime-reloaded, URL is fetched at start + every 60s and cached to `<data_dir>/registry-cache.json`, so outage fails static). Keys carry optional validity windows (`not_before`/`not_after`); rotation = `registry add-key` then `revoke-key`.
 - `<data_dir>/members.toml` (name, pubkey, class, `previous` keys, mtime-reloaded) is a dev/local fallback used only when no registry is configured; empty directory without a registry is open bootstrap only when `dev_bootstrap = true` (RFC §6: explicit dev flag). Receivers drop content-bearing responses from enrichment-class senders (metadata-only, §6).
-- MA tooling: `frxd registry init|add|add-key|revoke-key|remove|list|applications|approve|invite|set-relays|show|serve` (signed `registry.json` + `ma-key.hex` in `--dir`); `frxd init --id/--registry/--ma-key`; `frxd key show|rotate`; `member add --previous <old>` for the fallback path. A node with no `[node] relays` discovers them from the registry snapshot (`doc.relays`).
+- MA tooling: `frxd registry init|add|add-key|revoke-key|remove|list|applications|approve|invite|token|revoke-token|set-relays|show|serve` (signed `registry.json` + `ma-key.hex` in `--dir`); `frxd init --id/--registry/--ma-key`; `frxd key show|rotate`; `member add --previous <old>` for the fallback path. A node with no `[node] relays` discovers them from the registry snapshot (`doc.relays`).
 - Aggregate semantics are our implementation choices from a terse spec: requests are `aggregate` envelopes carrying only `period`; replies carry `sent` (broadcasts that month) / `passed` (responses consumed from that member); granularity floor is enforced as YYYY or YYYY-MM only (finer rejected), yearly rolls up months. Revisit with §10 sufficiency review.
 
 ## Known gaps (Phase 2/3, intentional — don't fake them)
@@ -50,6 +50,6 @@
 - Roles are not exclusive: a single node may issue queries and answer them concurrently (I5, §3 "any member"). Implement querier/responder as independent enable flags — never an exclusive mode enum or fixed deployment role.
 - Matching floor: boundary tokenizer (`src/tokenizer.rs` — letter/digit splits so `5555` matches `DLEX5555`, lowercase, ASCII fold, English stopwords+stemmer) → coverage gate (`[match] min_coverage`, default 0.4; 1–2 term queries require all terms) → title boost 2.0 + phrase boost 3.0 + query-time snippets. Schema changes require a fresh index dir (`open_or_create` errors on mismatch).
 - Engine seam: `src/engine.rs` `SearchEngine` trait (`search` → `EngineOutput { hits, total: Option<u64> }`, `doc_count`); `respond()` in `src/node.rs` is the conformance wrapper (budget clamp, truncation from engine total — unknown total forces `truncated = true`). Power users can implement the trait (HTTP adapter or subprocess to an external engine).
-- Onboarding: `frxd --onboarding` runs a wizard consuming a credential block (`id=.. token=.. registry=.. ma_key=..`) issued by the MA (`registry serve`; HTML page at `/`, `POST /v1/signup` queues a pending application, `POST /v1/enroll` binds keys and re-signs). Identity registration stays MA-side; the wizard never creates identities, only binds locally generated keys. Applications live in `<registry dir>/applications.json` (mode 600, MA contract data — never in the signed snapshot); `frxd registry approve <id>` promotes one (member stub + invite + credential block), and `frxd registry invite <id>` mints another single-use 24h token — one per node the member runs. Invites live in `<registry dir>/invites.json`. Prompts accept empty input as the default; scripted stdin works for tests.
+- Onboarding: `frxd --onboarding` runs a wizard consuming a credential block (`id=.. token=.. registry=.. ma_key=..`) issued by the MA (`registry serve`; HTML page at `/`, `POST /v1/signup` queues a pending application, `POST /v1/enroll` binds keys and re-signs). Identity registration stays MA-side; the wizard never creates identities, only binds locally generated keys. Applications live in `<registry dir>/applications.json` (mode 600, MA contract data — never in the signed snapshot); `frxd registry approve <id>` promotes one (member stub + credential block whose token is the member's reusable account credential, hashed in `<registry dir>/tokens.json` — authorizes key enrollment for every node the member runs); `frxd registry token <id>` mints another member token, `revoke-token <id>` revokes all of a member's tokens; `frxd registry invite <id>` mints a single-use 24h handoff token (`<registry dir>/invites.json`). Prompts accept empty input as the default; scripted stdin works for tests.
 - Next matching steps: eval harness with a small golden set (precision@k + false-silence rate), then a dense recall leg (model2vec-rs 0.2.1 exists but needs `default-features = false, features = ["fancy-regex", "local-only"]` for musl/airgapped; verify crate + model licenses before bundling), then an optional cross-encoder reranker. Embeddings are for recall; reranking is the precision tier.
 - Identity/registry (RFC Draft 0.5 §4/§6): MA-hosted FQDN identifiers first (`<label>.frx.<ma-domain>`, no DNS needed by users), signed versioned registry snapshot with the MA key pinned; envelope `from` = identifier, `key` = pubkey; registry outage fails static. Member-hosted identities, MA anchor rollover, and unicast confidentiality are §10 open. Implementation phases: A (signed registry snapshot) and B (identifier + `key` + JCS on the wire) are built and tested. Prioritize frictionless onboarding (users may be department-level and cannot create DNS).

DEPLOY.md

@@ -29,7 +29,7 @@ frxd registry --dir ./ma init --zone frx.federatedsearch.org
 frxd registry --dir ./ma serve --listen 127.0.0.1:7800
 ```
 
-(put Caddy in front for a real domain). The page at `/` collects the registration form (short name, organization details) and queues it for MA review — `frxd registry --dir <dir> applications` lists applications and `frxd registry --dir <dir> approve <id> --registry-url <url>` creates the member and prints the credential block to hand over. Each node the member runs needs its own token: `frxd registry --dir <dir> invite <id>` mints another single-use 24h invite for the same identifier. The block is `id=... token=... registry=... ma_key=...`. Organization details (legal name, representative, contacts, payment) are recorded privately by the MA in `<registry dir>/applications.json` — contract data, never in the public signed snapshot.
+(put Caddy in front for a real domain). The page at `/` collects the registration form (short name, organization details) and queues it for MA review — `frxd registry --dir <dir> applications` lists applications and `frxd registry --dir <dir> approve <id> --registry-url <url>` creates the member, mints its account credential, and prints the credential block to hand over. The token is reusable: it authorizes key enrollment for every node the member runs (`registry token <id>` mints an additional one; `registry revoke-token <id>` revokes all after a leak). A single-use 24h invite (`registry invite <id>`) remains for constrained handoffs. The block is `id=... token=... registry=... ma_key=...`. Organization details (legal name, representative, contacts, payment) are recorded privately by the MA in `<registry dir>/applications.json` — contract data, never in the public signed snapshot.
 
 New member:
 

src/commands.rs

@@ -472,10 +472,11 @@ pub fn registry_approve(dir: &Path, id: &str, registry_url: Option<&str>) -> Res
         });
         Ok(())
     })?;
-    let invite = registry::create_invite(dir, id, 24 * 3600)?;
+    let token = registry::create_token(dir, id)?;
     let (_, signed) = open_registry(dir)?;
     println!("approved {id} ({class})");
-    print_credential_block(id, &invite.token, registry_url, &signed.doc.ma_key);
+    println!("member token — reusable for every node the member runs; keep private:");
+    print_credential_block(id, &token, registry_url, &signed.doc.ma_key);
     Ok(())
 }
 
@@ -487,13 +488,33 @@ pub fn registry_invite(dir: &Path, id: &str, registry_url: Option<&str>) -> Resu
         return Err(anyhow!("no member named {id}"));
     }
     let invite = registry::create_invite(dir, id, 24 * 3600)?;
+    println!("single-use handoff invite for {id} (valid 24h):");
     print_credential_block(id, &invite.token, registry_url, &signed.doc.ma_key);
     Ok(())
 }
 
+/// Mints an additional member token (account credential) and prints the block.
+/// Returns the raw token for programmatic use.
+pub fn registry_token(dir: &Path, id: &str, registry_url: Option<&str>) -> Result<String> {
+    let (_, signed) = open_registry(dir)?;
+    if !signed.doc.members.iter().any(|member| member.id == id) {
+        return Err(anyhow!("no member named {id}"));
+    }
+    let token = registry::create_token(dir, id)?;
+    println!("member token for {id} — reusable for every node they run; keep private:");
+    print_credential_block(id, &token, registry_url, &signed.doc.ma_key);
+    Ok(token)
+}
+
+/// Revokes all of a member's tokens (e.g. after a leak); mint fresh with `registry token`.
+pub fn registry_revoke_token(dir: &Path, id: &str) -> Result<()> {
+    let revoked = registry::revoke_tokens(dir, id)?;
+    println!("revoked {revoked} token(s) for {id}");
+    Ok(())
+}
+
 fn print_credential_block(id: &str, token: &str, registry_url: Option<&str>, ma_key: &str) {
     let registry_url = registry_url.unwrap_or("<registry-url>");
-    println!("hand this credential block to the member (single use, valid 24h):");
     println!("id={id} token={token} registry={registry_url} ma_key={ma_key}");
 }
 
@@ -741,12 +762,16 @@ async fn registry_enroll(
                 .into_response();
         }
     };
-    if let Err(error) = registry::redeem_invite(&server.dir, &request.id, &request.token) {
-        return (
-            StatusCode::FORBIDDEN,
-            Json(serde_json::json!({ "error": error.to_string() })),
-        )
-            .into_response();
+    if registry::redeem_invite(&server.dir, &request.id, &request.token).is_err() {
+        let valid = registry::validate_token(&server.dir, &request.id, &request.token)
+            .unwrap_or(false);
+        if !valid {
+            return (
+                StatusCode::FORBIDDEN,
+                Json(serde_json::json!({ "error": "unknown invite or member token" })),
+            )
+                .into_response();
+        }
     }
     let result = mutate_registry(&server.dir, |doc| {
         let Some(member) = doc
@@ -872,10 +897,10 @@ the MA for the membership contract — never published, never on the wire.</p>
 <h2>2. Download</h2>
 <div class="card">
 <p>Static Linux x86_64 binaries (musl — no runtime dependencies):</p>
-<pre class="cmd">curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.3/frxd-linux-amd64
-curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.3/frxd-linux-amd64.sha256
-curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.3/frx-linux-amd64
-curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.3/frx-linux-amd64.sha256</pre>
+<pre class="cmd">curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.4/frxd-linux-amd64
+curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.4/frxd-linux-amd64.sha256
+curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.4/frx-linux-amd64
+curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.4/frx-linux-amd64.sha256</pre>
 <p class="muted">All releases: <a href="https://git.federatedsearch.org/frx/frxd/releases">git.federatedsearch.org/frx/frxd/releases</a>.
 Source and spec (<code>rfc.txt</code>): <a href="https://git.federatedsearch.org/frx/frxd">git.federatedsearch.org/frx/frxd</a>.</p>
 </div>
@@ -899,6 +924,9 @@ against the pinned MA key, and wires the federation relays — no domains, DNS,
 needed on your side.</li>
 <li>Index a directory and mark what you share:</li>
 </ol>
+<p class="muted">The credential block is reusable: run the wizard on every node you operate —
+each node binds its own key to your identifier. If the token leaks, the MA revokes it and
+issues a fresh one.</p>
 <pre class="cmd">frxd add ~/documents --name docs --shared --exposure metadata
 frxd serve</pre>
 <p class="muted">Search local-first with <code>frx search "..."</code>; broadcast to the federation with

src/main.rs

@@ -190,6 +190,14 @@ enum RegistryCommand {
         #[arg(long)]
         registry_url: Option<String>,
     },
+    Token {
+        id: String,
+        #[arg(long)]
+        registry_url: Option<String>,
+    },
+    RevokeToken {
+        id: String,
+    },
     SetRelays {
         #[arg(required = true)]
         relays: Vec<String>,
@@ -368,6 +376,10 @@ async fn main() -> Result<()> {
             RegistryCommand::Invite { id, registry_url } => {
                 commands::registry_invite(&dir, &id, registry_url.as_deref())?
             }
+            RegistryCommand::Token { id, registry_url } => {
+                commands::registry_token(&dir, &id, registry_url.as_deref())?;
+            }
+            RegistryCommand::RevokeToken { id } => commands::registry_revoke_token(&dir, &id)?,
             RegistryCommand::SetRelays { relays } => commands::registry_set_relays(&dir, &relays)?,
             RegistryCommand::Show => commands::registry_show(&dir)?,
             RegistryCommand::Serve { listen } => commands::registry_serve(&dir, &listen).await?,

src/registry.rs

@@ -6,6 +6,7 @@ use std::time::SystemTime;
 
 use anyhow::{Context, Result, anyhow};
 use serde::{Deserialize, Serialize};
+use sha2::Digest;
 
 use crate::PROTOCOL;
 use crate::crypto::{Keypair, canonical_json, now_ts, verify_signature};
@@ -183,6 +184,74 @@ pub fn approve_application(dir: &Path, id: &str) -> Result<Application> {
     Ok(approved)
 }
 
+/// Member token: the member's account credential at the MA. Authorizes key
+/// enrollment for every node the member runs. Stored hashed; MA-private.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct MemberToken {
+    pub id: String,
+    pub token_hash: String,
+    pub created: u64,
+    #[serde(default)]
+    pub revoked: bool,
+}
+
+pub fn tokens_path(dir: &Path) -> PathBuf {
+    dir.join("tokens.json")
+}
+
+pub fn load_tokens(path: &Path) -> Result<Vec<MemberToken>> {
+    if !path.exists() {
+        return Ok(Vec::new());
+    }
+    let raw = fs::read_to_string(path).context("reading tokens")?;
+    serde_json::from_str(&raw).context("parsing tokens")
+}
+
+pub fn save_tokens(path: &Path, tokens: &[MemberToken]) -> Result<()> {
+    fs::write(path, serde_json::to_string_pretty(tokens)?)?;
+    crate::config::set_private_permissions(path)?;
+    Ok(())
+}
+
+fn hash_token(token: &str) -> String {
+    hex::encode(sha2::Sha256::digest(token.as_bytes()))
+}
+
+/// Mints a fresh member token and returns it (only the hash is stored).
+pub fn create_token(dir: &Path, id: &str) -> Result<String> {
+    let raw = crate::crypto::random_nonce();
+    let path = tokens_path(dir);
+    let mut tokens = load_tokens(&path)?;
+    tokens.push(MemberToken {
+        id: id.to_string(),
+        token_hash: hash_token(&raw),
+        created: now_ts(),
+        revoked: false,
+    });
+    save_tokens(&path, &tokens)?;
+    Ok(raw)
+}
+
+pub fn validate_token(dir: &Path, id: &str, token: &str) -> Result<bool> {
+    let hash = hash_token(token);
+    Ok(load_tokens(&tokens_path(dir))?
+        .iter()
+        .any(|entry| entry.id == id && !entry.revoked && entry.token_hash == hash))
+}
+
+/// Revokes all tokens for a member; returns how many were active.
+pub fn revoke_tokens(dir: &Path, id: &str) -> Result<usize> {
+    let path = tokens_path(dir);
+    let mut tokens = load_tokens(&path)?;
+    let mut revoked = 0;
+    for entry in tokens.iter_mut().filter(|entry| entry.id == id && !entry.revoked) {
+        entry.revoked = true;
+        revoked += 1;
+    }
+    save_tokens(&path, &tokens)?;
+    Ok(revoked)
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct SignedRegistry {
     #[serde(flatten)]

tests/onboarding.rs

@@ -90,40 +90,50 @@ async fn application_pending_then_approve_then_enroll_binds_key() {
         .unwrap();
     assert_eq!(dup.status(), reqwest::StatusCode::CONFLICT);
 
-    // MA approves: member stub + invite; enrollment binds the key
+    // MA approves: member stub; a member token then authorizes key enrollment
     commands::registry_approve(&dir, id, None).unwrap();
     let signed = registry::load_registry(&dir.join("registry.json")).unwrap();
     assert!(signed.doc.members.iter().any(|member| member.id == id));
     let apps = registry::load_applications(&dir.join("applications.json")).unwrap();
     assert_eq!(apps[0].status, "approved");
 
-    let key = Keypair::generate();
-    let enrolled = http
-        .post(format!("{base}/v1/enroll"))
-        .json(&serde_json::json!({
-            "id": id,
-            "token": invite_token(&dir, id),
-            "pubkey": key.public_hex(),
-        }))
-        .send()
-        .await
-        .unwrap();
-    assert!(enrolled.status().is_success());
-    let signed = registry::load_registry(&dir.join("registry.json")).unwrap();
-    assert!(registry::authorized_keys(&signed, now_ts()).contains_key(&key.public_hex()));
+    let enroll = |token: &str, pubkey: String| {
+        let http = http.clone();
+        let base = base.clone();
+        let id = id.to_string();
+        let token = token.to_string();
+        async move {
+            http.post(format!("{base}/v1/enroll"))
+                .json(&serde_json::json!({
+                    "id": id, "token": token, "pubkey": pubkey,
+                }))
+                .send()
+                .await
+                .unwrap()
+                .status()
+        }
+    };
 
-    // the token is single-use
-    let replayed = http
-        .post(format!("{base}/v1/enroll"))
-        .json(&serde_json::json!({
-            "id": id,
-            "token": invite_token(&dir, id),
-            "pubkey": Keypair::generate().public_hex(),
-        }))
-        .send()
-        .await
-        .unwrap();
-    assert_eq!(replayed.status(), reqwest::StatusCode::FORBIDDEN);
+    // the account credential is reusable: two nodes, two keys, one token
+    let token = commands::registry_token(&dir, id, None).unwrap();
+    let key1 = Keypair::generate();
+    let key2 = Keypair::generate();
+    assert!(enroll(&token, key1.public_hex()).await.is_success());
+    assert!(enroll(&token, key2.public_hex()).await.is_success());
+    let signed = registry::load_registry(&dir.join("registry.json")).unwrap();
+    let authorized = registry::authorized_keys(&signed, now_ts());
+    assert!(authorized.contains_key(&key1.public_hex()));
+    assert!(authorized.contains_key(&key2.public_hex()));
+
+    // after revocation the token no longer enrolls; a fresh one does
+    commands::registry_revoke_token(&dir, id).unwrap();
+    let key3 = Keypair::generate();
+    assert_eq!(
+        enroll(&token, key3.public_hex()).await,
+        reqwest::StatusCode::FORBIDDEN
+    );
+    let fresh = commands::registry_token(&dir, id, None).unwrap();
+    assert!(enroll(&fresh, key3.public_hex()).await.is_success());
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
@@ -231,16 +241,22 @@ async fn invite_reissues_token_per_node() {
         }
     };
 
-    // node 1: the invite from approval
+    // node 1: a single-use handoff invite
+    commands::registry_invite(&dir, id, None).unwrap();
     let key1 = Keypair::generate();
     let token1 = invite_token(&dir, id);
     assert!(enroll(token1.clone(), key1.public_hex()).await.is_success());
 
+    // the invite is single-use: replay is rejected
+    assert_eq!(
+        enroll(token1, Keypair::generate().public_hex()).await,
+        reqwest::StatusCode::FORBIDDEN
+    );
+
     // node 2: a fresh token from `registry invite`
     commands::registry_invite(&dir, id, None).unwrap();
     let key2 = Keypair::generate();
     let token2 = invite_token(&dir, id);
-    assert_ne!(token1, token2);
     assert!(enroll(token2, key2.public_hex()).await.is_success());
 
     let signed = registry::load_registry(&dir.join("registry.json")).unwrap();
@@ -261,10 +277,10 @@ async fn wizard_enrolls_and_writes_config() {
     submit_application(&http, &base, "Wizard Test").await;
     let id = "wizard-test.frx.invalid";
     commands::registry_approve(&dir, id, None).unwrap();
+    let token = commands::registry_token(&dir, id, None).unwrap();
     let signed = registry::load_registry(&dir.join("registry.json")).unwrap();
     let credentials = format!(
-        "id={id} token={} registry={base}/registry.json ma_key={}",
-        invite_token(&dir, id),
+        "id={id} token={token} registry={base}/registry.json ma_key={}",
         signed.doc.ma_key
     );