feat(swarm): GET /.well-known/mycelium-node — self-signed advertisement (#87)

[Dewinator]

Summary

• Closes the Swarm Phase 3c milestone: this node now serves its self-signed NodeAdvertisement at GET /.well-known/mycelium-node per SWARM_SPEC §3.3 + §4.1.
• First end-to-end wire-path. Composes Phase 1b (NodeIdentityService.getSelf), Phase 2 (signWithSelfKey), and Phase 3a (WIRE_SPEC_VERSION + NodeAdvertisement type) without modifying any of them — Phase 3b's wire-validator already accepts the same shape.
• Two new env vars: MYCELIUM_PUBLIC_URL (required for participation) and MYCELIUM_DISPLAY_NAME (optional, ≤ 64 chars).

Research summary

• Existing HTTP entrypoint is scripts/dashboard-server.mjs — already lazy-imports compiled MCP-server modules from mcp-server/dist/. Same pattern here, no new server, no new port (MYCELIUM_PUBLIC_URL set by operator points at this listener).
• NodeIdentityService.getSelf() returns { node_id, pubkey_b64 } from the nodes table where is_self=true (single-row partial unique index from migration 070). Re-encoded to unpadded base64url for the wire (§3.3 mandates that variant).
• signWithSelfKey already attaches signed_at to the canonical bytes before signing, so the resulting record has signed_at inside the signature surface — exactly what rule 5 (signature verify) and rule 7 (clock-skew) need on the receiver.
• Reused the same fixture pattern as wire-validator.test.ts: fresh Ed25519 keypair per test, last 32 bytes of the SPKI DER are the raw pubkey, computeNodeId(pubkeyRaw) is the node_id. Saved a redundant multihash helper that way.

What this does NOT do

• No /swarm/peers, /swarm/lessons, /swarm/hubs — those are later Phase 3 / 4 issues. (Swarm Phase 3d: migration 071 — peer + signed-record storage (file only, do NOT run) #88 already covers the peer-storage migration.)
• No TLS termination — assumed to be at the reverse proxy / dashboard layer; this endpoint serves plain HTTP and trusts the proxy for https://.
• No key bootstrap. If nodes.is_self is missing, the endpoint returns 503 with a clear error — silent key generation here would orphan every signature this node has produced.
• No new HTTP server framework. node:http route added to the existing dashboard server.

Constitution affirmation

Touches:

• Pillar 1 — Decentralized, networked AI. Reinforces it: a peer can curl this endpoint and verify identity (multihash(pubkey) == node_id) plus signature without consulting any registry. No central authority.
• Pillar 6 — Cyber security. Reinforces it: the advertisement is self-signed by the same key it declares; no out-of-band trust root. Failure to find a self-row is a 503, not a silent re-bootstrap — the "generate keys silently" anti-pattern is structurally unreachable.

Pillars 2 (Reproduction), 3 (Swarm intelligence), 4 (Microtransactions), and 5 (Experts) are not touched and remain governed by their respective subsystems. No pillar is weakened.

Test plan

A reviewer can verify with the existing test runner:

cd mcp-server
npm test

The new tests live in mcp-server/src/__tests__/node-advertisement-endpoint.test.ts. They cover:

• Happy path — boots a real node:http server, hits /.well-known/mycelium-node via global fetch, asserts: status 200, Content-Type: application/json; charset=utf-8, Cache-Control: no-store, body parses as JSON, every required NodeAdvertisement field present, signed_at matches the §3 ISO 8601 ms-precision UTC pattern, multihash(pubkey) == node_id (via the same computeNodeId helper Phase 1b introduced), and the signature verifies via Phase 2's verify() against the on-wire pubkey.
• 503 cases — MYCELIUM_PUBLIC_URL missing, no self-row in nodes, MYCELIUM_DISPLAY_NAME over 64 chars.
• Optional-field roundtrip — when display_name is unset, the wire body has no display_name key AND the signature still verifies (i.e. we did not silently include an empty string in the canonical bytes).

End-to-end smoke test for an operator with the dashboard running:

export MYCELIUM_PUBLIC_URL="https://your-node.tailnet.ts.net:8787"
export MYCELIUM_DISPLAY_NAME="my-mycelium"
# (restart dashboard server)
curl -s http://127.0.0.1:8787/.well-known/mycelium-node | jq .
# expect: NodeAdvertisement JSON with node_id, pubkey, endpoint_url,
# spec_version "1.0", signed_at, signature, plus your display_name.

🤖 Generated with Claude Code