@mmmbuto/nexuscrew 0.9.28 → 0.9.30

package/lib/notify/ask-receipts.js

@@ -0,0 +1,197 @@
+'use strict';
+// lib/notify/ask-receipts.js — durable receipts for FEDERATED answer attempts.
+//
+// The receipt is the answer's paper trail: a federated attempt gets a UUID
+// (requestId), a digest of the text and a state that is WRITTEN BEFORE the
+// paste happens (a failed receipt write means no paste — the owner never fires
+// blind). Terminal states are final: replaying the same requestId with the
+// same digest returns the stored state without pasting again; the same id with
+// a different digest is a conflict. A process crash leaves `pending` behind:
+// at recovery it becomes `delivery-unknown` and BLOCKS every new paste for
+// that ask — local ones too — until the operator reconciles explicitly (
+// no silent retries, no TTL).
+//
+// Cap 1000 attempts; terminal receipts age out after 24 h; at cap, NEW
+// attempts are refused rather than evicting pending/unknown ones.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { atomicWriteJson } = require('./persist.js');
+
+const SCHEMA = 'nexuscrew-ask-receipts-v1';
+const CAP_ATTEMPTS = 1000;
+const TERMINAL_RETENTION_MS = 24 * 60 * 60 * 1000;
+
+function keyOf(peerId, askId, requestId) { return `${peerId}|${askId}|${requestId}`; }
+function digestOf(text) { return crypto.createHash('sha256').update(String(text), 'utf8').digest('hex'); }
+
+function createAskReceipts({ filePath, now = Date.now } = {}) {
+  if (!filePath) throw new Error('createAskReceipts: filePath richiesta');
+
+  function loadRaw() {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+      if (parsed && parsed.schema === SCHEMA && parsed.attempts && typeof parsed.attempts === 'object') return parsed;
+    } catch (_) { /* fresh */ }
+    return { schema: SCHEMA, attempts: {}, blockedAsks: {} };
+  }
+
+  function persist(state) {
+    const dir = path.dirname(filePath);
+    fs.mkdirSync(dir, { recursive: true });
+    const tmp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(state), { mode: 0o600 });
+    fs.renameSync(tmp, filePath);
+  }
+
+  // Recovery at construction: a `pending` attempt did not observe its own
+  // paste, so its outcome is unknown and the ask is locked.
+  const state = loadRaw();
+  for (const entry of Object.values(state.attempts)) {
+    if (entry.state === 'pending') {
+      entry.state = 'delivery-unknown';
+      entry.updatedAt = now();
+      state.blockedAsks[entry.askId] = true;
+    }
+  }
+  // Terminal retention: old terminal receipts age out (pending/unknown NEVER).
+  const cutoff = now() - TERMINAL_RETENTION_MS;
+  for (const [key, entry] of Object.entries(state.attempts)) {
+    const terminal = entry.state === 'committed' || entry.state === 'failed';
+    if (terminal && (entry.updatedAt || 0) < cutoff) delete state.attempts[key];
+  }
+  if (Object.keys(state.attempts).length > 0) persist(state);
+
+  function isBlocked(askId) { return state.blockedAsks[askId] === true; }
+
+  function get(peerId, askId, requestId) {
+    return state.attempts[keyOf(peerId, askId, requestId)] || null;
+  }
+
+  // Create the pending receipt. Refuses when the ask is blocked, or at cap —
+  // NEVER evicts a pending/unknown attempt to make room.
+  function attempt({ peerId, askId, requestId, text }) {
+    if (isBlocked(askId)) return { ok: false, reason: 'blocked' };
+    const key = keyOf(peerId, askId, requestId);
+    const existing = state.attempts[key];
+    if (existing) {
+      if (existing.digest !== digestOf(text)) return { ok: false, reason: 'digest-conflict', entry: existing };
+      return { ok: true, replay: true, entry: existing };
+    }
+    const terminalCount = Object.values(state.attempts)
+      .filter((e) => e.state !== 'pending' && e.state !== 'delivery-unknown').length;
+    if (Object.keys(state.attempts).length >= CAP_ATTEMPTS && terminalCount === 0) {
+      return { ok: false, reason: 'cap' };
+    }
+    const entry = {
+      peerId, askId, requestId,
+      digest: digestOf(text),
+      state: 'pending',
+      createdAt: now(), updatedAt: now(),
+    };
+    state.attempts[key] = entry;
+    persist(state);
+    return { ok: true, replay: false, entry };
+  }
+
+  function finalize(peerId, askId, requestId, finalState, receipt) {
+    const entry = state.attempts[keyOf(peerId, askId, requestId)];
+    if (!entry) return false;
+    if (entry.state !== 'pending') { entry.replayedAt = now(); return true; }
+    entry.state = finalState;
+    entry.receipt = receipt === undefined ? null : receipt;
+    entry.updatedAt = now();
+    persist(state);
+    return true;
+  }
+
+  // Explicit operator reconciliation (local, authenticated, never federated):
+  // every delivery-unknown attempt of the ask gets the decided outcome and the
+  // ask is unlocked for new pastes.
+  function reconcile(askId, decision, expect = null) {
+    const finalState = decision === 'mark-delivered' ? 'committed'
+      : decision === 'allow-new-attempt' ? 'failed' : null;
+    if (!finalState) return { ok: false, reason: 'bad-decision' };
+    // The decision is bound to the GENERATION it was taken on: the exact set of
+    // unresolved outcomes that was visible when the operator decided. If that
+    // set moved (or is empty), this reconciliation is refused instead of
+    // unlocking a generation nobody decided about.
+    const current = reconcilableFor(askId);
+    if (current.count === 0) return { ok: false, reason: 'nothing-to-reconcile' };
+    if (expect && (expect.count !== current.count || expect.generation !== current.generation)) {
+      return { ok: false, reason: 'generation-changed' };
+    }
+    // The unlock is exposed ONLY after the durable write succeeded: the fields
+    // this decision touches are snapshotted first, so a failed write leaves the
+    // ask exactly as blocked as it was (no half-reconciled state in memory).
+    const touched = [];
+    let changed = 0;
+    for (const [key, entry] of Object.entries(state.attempts)) {
+      if (entry.askId === askId && entry.state === 'delivery-unknown') {
+        touched.push([key, { ...entry }]);
+        entry.state = finalState;
+        entry.receipt = 'reconciled';
+        entry.updatedAt = now();
+        changed += 1;
+      }
+    }
+    const wasBlocked = state.blockedAsks[askId] === true;
+    delete state.blockedAsks[askId];
+    try {
+      persist(state);
+    } catch (_) {
+      for (const [key, prev] of touched) state.attempts[key] = prev;
+      if (wasBlocked) state.blockedAsks[askId] = true;
+      return { ok: false, reason: 'persist-failed' };
+    }
+    return { ok: true, changed };
+  }
+
+  // The authoritative answer state of an ask, as the durable receipts know it:
+  // a terminal write (`committed` after a paste, `delivered` after an operator
+  // reconciliation) means the ask already produced its answer — whatever store
+  // the caller went through. `unknown` marks an outcome that is still unresolved.
+  function answerStateFor(askId) {
+    let unfinished = false;
+    for (const entry of Object.values(state.attempts)) {
+      if (entry.askId !== askId) continue;
+      if (entry.state === 'committed' || entry.state === 'delivered') return entry.state;
+      if (entry.state === 'pending' || entry.state === 'delivery-unknown') unfinished = true;
+    }
+    return unfinished ? 'unknown' : null;
+  }
+
+  // The outcomes an operator can reconcile right now: the delivery-unknown
+  // attempts of this ask, with a short digest of their identity set. `pending`
+  // attempts are a paste still in flight — they are NOT reconcilable and are
+  // reported separately, so nobody can decide on an outcome that is still open.
+  function reconcilableFor(askId) {
+    const ids = [];
+    let live = 0;
+    for (const entry of Object.values(state.attempts)) {
+      if (entry.askId !== askId) continue;
+      if (entry.state === 'delivery-unknown') ids.push(String(entry.requestId));
+      else if (entry.state === 'pending') live += 1;
+    }
+    ids.sort();
+    return {
+      count: ids.length,
+      live,
+      generation: crypto.createHash('sha256').update(ids.join('|'), 'utf8').digest('hex').slice(0, 16),
+    };
+  }
+
+  function statusFor(askId) {
+    const attempts = Object.values(state.attempts).filter((e) => e.askId === askId);
+    return {
+      blocked: isBlocked(askId),
+      attempts: attempts.length,
+      unknown: attempts.filter((e) => e.state === 'delivery-unknown').length,
+    };
+  }
+
+  return { attempt, get, finalize, isBlocked, reconcile, reconcilableFor, statusFor, answerStateFor, digestOf };
+}
+
+module.exports = { createAskReceipts, digestOf, keyOf, CAP_ATTEMPTS };

package/lib/notify/ask-relay.js

@@ -0,0 +1,152 @@
+'use strict';
+// lib/notify/ask-relay.js — the client-side relay for federated ask answers.
+//
+// The local endpoint receives {ownerId, askId, text, requestId} from the PWA.
+// The route to the owner is resolved from the AUTHORIZED node store (the
+// outbound peer whose nodeId is the owner) — never from anything an event
+// said. The forward uses the peer's own pair token and the visited header;
+// the hop proof is minted by the owner on the last hop.
+//
+// Outcome contract: a committed/failed answer is final. An uncertain
+// outcome (timeout, network error after the request left) is NOT retried: the
+// attempt is parked as "uncertain" and the only allowed action is "verify
+// status" (GET .../requests/:requestId). A new paste for the same ask is
+// refused locally until verification resolves the attempt.
+
+const crypto = require('node:crypto');
+const IDLE_MS = 15000;
+
+function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = () => {} } = {}) {
+  // (ownerId|askId|requestId) -> {state: 'sent'|'committed'|'failed'|'uncertain', requestId}
+  const attempts = new Map();
+
+  function requestId() { return crypto.randomUUID(); }
+
+  function resolveOwner(ownerId) {
+    const store = loadStore();
+    if (!store) return null;
+    return (store.nodes || []).find((n) => n && n.direction === 'outbound'
+      && n.nodeId === ownerId && n.token && n.localPort) || null;
+  }
+
+  function ownerUrl(peer, path) {
+    return `http://127.0.0.1:${peer.localPort}/federation/route/_/${path.replace(/^\//, '')}`;
+  }
+
+  function attemptKey(ownerId, askId, rid) { return `${ownerId}|${askId}|${rid}`; }
+
+  function statusFor(ownerId, askId) {
+    const out = [];
+    for (const [key, a] of attempts) {
+      if (key.startsWith(`${ownerId}|${askId}|`)) out.push(a);
+    }
+    return out;
+  }
+
+  function isUncertain(ownerId, askId) {
+    return statusFor(ownerId, askId).some((a) => a.state === 'uncertain');
+  }
+
+  async function relayAnswer({ ownerId, askId, text, rid: providedRid } = {}) {
+    if (!ownerId || !askId || typeof text !== 'string' || !text.trim()) {
+      return { ok: false, code: 400, error: 'ownerId, askId e text richiesti' };
+    }
+    const peer = resolveOwner(ownerId);
+    if (!peer) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati', reason: 'owner-unknown' };
+    // Local reconciliation FIRST: an uncertain attempt on this ask must be
+    // verified before any new paste leaves this node.
+    if (isUncertain(ownerId, askId)) {
+      return { ok: false, code: 409, error: 'esito incerto: verifica lo stato prima di rispondere', reason: 'uncertain', uncertain: true };
+    }
+    const rid = providedRid || requestId();
+    const key = attemptKey(ownerId, askId, rid);
+    const store = loadStore();
+    attempts.set(key, { requestId: rid, state: 'sent', askId, ownerId });
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), IDLE_MS);
+    try {
+      const r = await fetchImpl(ownerUrl(peer, `/event-feed/asks/${askId}/answer`), {
+        method: 'POST',
+        headers: {
+          authorization: `Bearer ${peer.token}`,
+          'content-type': 'application/json',
+          'x-nexuscrew-visited': store.nodeId,
+        },
+        body: JSON.stringify({ text, requestId: rid }),
+        signal: ctrl.signal,
+      });
+      const body = await r.json().catch(() => ({}));
+      if (r.status === 200) {
+        const state = body.status === 'answered' ? 'committed' : body.status || 'committed';
+        attempts.get(key).state = body.replay ? (body.state || state) : state;
+        return { ok: true, status: attempts.get(key).state, requestId: rid };
+      }
+      const entry = attempts.get(key);
+      // 409 request-conflict / answering are definitive; anything else that
+      // could have pasted (timeout-ish) parks as uncertain, never retried.
+      if (r.status === 409) {
+        if (entry) entry.state = body.reason === 'delivery-unknown-block' ? 'uncertain' : 'failed';
+        return { ok: false, code: 409, error: body.error || 'conflict', reason: body.reason };
+      }
+      if (r.status === 502) {
+        if (entry) entry.state = 'uncertain';
+        return { ok: false, code: 200, uncertain: true, reason: 'delivery-unknown', requestId: rid,
+          error: 'esito incerto: verifica lo stato prima di rispondere' };
+      }
+      if (entry) entry.state = 'failed';
+      return { ok: false, code: r.status, error: body.error || `HTTP ${r.status}`, reason: body.reason };
+    } catch (_) {
+      // The request may or may not have pasted: uncertain, never retried.
+      const entry = attempts.get(key);
+      if (entry) entry.state = 'uncertain';
+      return { ok: false, code: 200, uncertain: true, reason: 'delivery-unknown', requestId: rid,
+        error: 'esito incerto: verifica lo stato prima di rispondere' };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  // Remote dismiss: same resolution rules as the answer (DELETE on the owner).
+  async function relayDismiss({ ownerId, askId } = {}) {
+    const peer = resolveOwner(ownerId);
+    if (!peer) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati' };
+    const store = loadStore();
+    try {
+      const r = await fetchImpl(ownerUrl(peer, `/event-feed/asks/${askId}`), {
+        method: 'DELETE',
+        headers: { authorization: `Bearer ${peer.token}`, 'x-nexuscrew-visited': store ? store.nodeId : '' },
+      });
+      const body = await r.json().catch(() => ({}));
+      if (!r.ok) return { ok: false, code: r.status, error: body.error || `HTTP ${r.status}` };
+      return { ok: true };
+    } catch (e) { return { ok: false, error: String((e && e.message) || e) }; }
+  }
+
+  async function verifyStatus({ ownerId, askId, requestId: rid }) {
+    const peer = resolveOwner(ownerId);
+    if (!peer) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati' };
+    const store = loadStore();
+    try {
+      const r = await fetchImpl(ownerUrl(peer, `/event-feed/asks/${askId}/requests/${rid}`), {
+        headers: { authorization: `Bearer ${peer.token}`, 'x-nexuscrew-visited': store ? store.nodeId : '' },
+      });
+      if (!r.ok) return { ok: false, code: r.status };
+      const body = await r.json();
+      const key = attemptKey(ownerId, askId, rid);
+      if (attempts.has(key) && (body.state === 'committed' || body.state === 'failed')) {
+        attempts.get(key).state = body.state;
+      }
+      return { ok: true, state: body.state || 'unknown' };
+    } catch (e) {
+      return { ok: false, error: String((e && e.message) || e) };
+    }
+  }
+
+  function state() {
+    return [...attempts.entries()].map(([key, a]) => ({ key, ...a }));
+  }
+
+  return { relayAnswer, relayDismiss, verifyStatus, state, isUncertain, requestId };
+}
+
+module.exports = { createAskRelay };

package/lib/notify/asks.js

@@ -1,5 +1,5 @@
 'use strict';
-// Store degli "ask" (domande cella→operatore) — MCP bridge, design §2c.
+// Store of "asks" (cell->operator questions) — MCP bridge.
 // Stato in-memory + persistenza <dir>/asks.json 0600 (sopravvive al restart:
 // un ask aperto resta risponibile). Lo store e' PURO stato: il paste tmux e la
 // notify li orchestra la route (lib/notify/routes.js), che qui fa il ciclo
@@ -86,6 +86,7 @@ function createAsksStore(opts = {}) {
       ...(v.value.options ? { options: v.value.options } : {}),
       session: String(session),
       ts: now(),
+      revision: 0,
       answered: false,
       dismissed: false,
     };
@@ -117,7 +118,7 @@ function createAsksStore(opts = {}) {
     if (!ask) return { ok: false, reason: 'unknown' };
     // Un ask dismissato non e' piu' risponibile: senza questa guardia la
     // sequenza dismiss -> claim -> commit lascia lo stato ibrido
-    // `dismissed && answered` (F-02).
+    // `dismissed && answered` state.
     if (ask.dismissed) return { ok: false, reason: 'dismissed' };
     if (ask.answered) return { ok: false, reason: 'answered' };
     if (answering.has(id)) return { ok: false, reason: 'answering' };
@@ -125,6 +126,10 @@ function createAsksStore(opts = {}) {
     return { ok: true, ask: { ...ask } };
   }
 
+  // Read-only: a claim is being held right now. Reconciliation uses this to
+  // refuse WITHOUT touching the claim of a paste that is still in flight.
+  function isAnswering(id) { return answering.has(id); }
+
   // Rollback: il paste e' fallito, l'ask torna contendibile.
   function release(id) {
     answering.delete(id);
@@ -138,6 +143,7 @@ function createAsksStore(opts = {}) {
     ask.answered = true;
     ask.answer = String(text);
     ask.answeredTs = now();
+    ask.revision = (ask.revision || 0) + 1;
     save();
     return true;
   }
@@ -154,6 +160,25 @@ function createAsksStore(opts = {}) {
     if (ask.dismissed) return { ok: true, ask: { ...ask }, idempotent: true };
     ask.dismissed = true;
     ask.dismissedTs = now();
+    ask.revision = (ask.revision || 0) + 1;
+    save();
+    return { ok: true, ask: { ...ask } };
+  }
+
+  // Operator reconciliation of a federated attempt: `mark-delivered` closes the
+  // ask (the paste happened on the peer's side, there is no local answer text),
+  // `allow-new-attempt` leaves it open. Both advance the revision, so the token
+  // the operator reconciled with can never be reused on the same generation.
+  function markReconciled(id, decision) {
+    const ask = get(id);
+    if (!ask) return { ok: false, reason: 'unknown' };
+    answering.delete(id);
+    if (decision === 'mark-delivered' && !ask.answered) {
+      ask.answered = true;
+      ask.answeredTs = now();
+      ask.answeredReconciled = true;
+    }
+    ask.revision = (ask.revision || 0) + 1;
     save();
     return { ok: true, ask: { ...ask } };
   }
@@ -165,7 +190,7 @@ function createAsksStore(opts = {}) {
     return commit(id, text);
   }
 
-  return { create, get, list, openCount, claim, release, commit, markAnswered, dismiss, validate, filePath, MAX_OPEN };
+  return { create, get, list, openCount, claim, release, commit, markAnswered, markReconciled, isAnswering, dismiss, validate, filePath, MAX_OPEN };
 }
 
 module.exports = { createAsksStore };

package/lib/notify/event-feed-acl.js

@@ -0,0 +1,95 @@
+'use strict';
+// lib/notify/event-feed-acl.js — per-peer projection of the event feed.
+//
+// The grants live in the node store and are the ONLY source of truth, read
+// fresh before every batch (a cached grant is a stale grant). Scope rules:
+//   - scope 'cell': eventsAccess AND the cell must be visible under
+//     cellVisibility. A hidden cell stays hidden through events.
+//   - scope 'node': eventsAccess AND nodeEventsAccess. nodeEventsAccess NEVER
+//     bypasses cellVisibility: cell lists inside node frames are projected by
+//     the same visibility rule, and hidden cells contribute neither names nor
+//     counts.
+
+const nodesStore = require('../nodes/store.js');
+const accessPresets = require('../nodes/access-presets.js');
+
+const CELL_ID_RE = /^[A-Za-z0-9._-]{1,32}$/;
+
+function visibilityAllows(grants, cellId) {
+  const mode = grants.cellVisibility;
+  if (mode === 'all') return true;
+  if (mode === 'none') return false;
+  if (mode === 'selected') {
+    return Array.isArray(grants.cells) && typeof cellId === 'string' && grants.cells.includes(cellId);
+  }
+  return false; // malformed: denied, never guessed
+}
+
+// Effective grants of ONE peer, read fresh from the store. Unconfigured or
+// malformed records are denied everywhere (a paired peer is not, by itself,
+// allowed to read events). `revision` is the store-root access revision: the
+// signature lets the publisher detect grant changes cheaply.
+function peerGrants(store, peerNodeId) {
+  const node = (store && Array.isArray(store.nodes) ? store.nodes : [])
+    .find((n) => n && n.nodeId === peerNodeId && n.direction === 'inbound');
+  if (!node) return null;
+  const view = accessPresets.grantsOf(node);
+  const grants = {
+    eventsAccess: view.configured === true && node.eventsAccess === true,
+    nodeEventsAccess: view.configured === true && node.nodeEventsAccess === true,
+    askReplyAccess: view.configured === true && node.askReplyAccess === true,
+    cellVisibility: view.configured === true ? node.cellVisibility : 'none',
+    cells: Array.isArray(node.cells) ? [...node.cells] : [],
+    configured: view.configured === true,
+    label: view.label,
+  };
+  grants.signature = JSON.stringify({
+    e: grants.eventsAccess, n: grants.nodeEventsAccess, a: grants.askReplyAccess,
+    v: grants.cellVisibility, c: grants.cells, r: nodesStore.accessRevisionOf(store),
+  });
+  return grants;
+}
+
+// May this peer receive this envelope at all? The envelope's cellId is trusted
+// here because it was resolved by the OWNER (binding/roster), never taken from
+// a request body.
+function allowsEnvelope(grants, envelope) {
+  if (!grants || grants.configured !== true) return false;
+  if (grants.eventsAccess !== true) return false;
+  if (!envelope || typeof envelope !== 'object') return false;
+  if (envelope.scope === 'cell') {
+    if (!(typeof envelope.cellId === 'string' && CELL_ID_RE.test(envelope.cellId))) return false;
+    return visibilityAllows(grants, envelope.cellId);
+  }
+  if (envelope.scope === 'node') return grants.nodeEventsAccess === true;
+  return false;
+}
+
+// Project a list of cells (fleet frames, snapshot state) to what the peer may
+// see. Hidden cells contribute NOTHING: no names, no counts, no "there were N
+// more" hints.
+function projectCells(grants, cells) {
+  if (!Array.isArray(cells)) return [];
+  if (!grants || grants.eventsAccess !== true) return [];
+  if (grants.cellVisibility === 'all') return cells.slice(0, 1000);
+  if (grants.cellVisibility === 'selected') {
+    const allowed = new Set(Array.isArray(grants.cells) ? grants.cells : []);
+    return cells.filter((c) => c && allowed.has(c.cell));
+  }
+  return [];
+}
+
+// Full per-request decision + projection context. Returns null when the peer
+// record does not exist (unknown origin): the caller refuses.
+function resolvePeer(store, peerNodeId) {
+  const grants = peerGrants(store, peerNodeId);
+  if (!grants) return null;
+  return {
+    nodeId: peerNodeId,
+    grants,
+    allows: (envelope) => allowsEnvelope(grants, envelope),
+    projectCells: (cells) => projectCells(grants, cells),
+  };
+}
+
+module.exports = { peerGrants, allowsEnvelope, projectCells, visibilityAllows, resolvePeer, CELL_ID_RE };

package/lib/notify/event-feed-asks-routes.js

@@ -0,0 +1,144 @@
+'use strict';
+// lib/notify/event-feed-asks-routes.js — federated ask ANSWER surface.
+//
+//   POST   /event-feed/asks/:id/answer          {text, requestId}  (closed body)
+//   DELETE /event-feed/asks/:id                                    (dismiss)
+//   GET    /event-feed/asks/:id/requests/:requestId               (attempt status)
+//
+// The gate is the SAME as the stream/snapshot gate (kill-switch -> proven
+// federated origin -> exact [clientId, ownerId] -> known peer -> eventsAccess)
+// PLUS askReplyAccess plus the ask's own cell scope read from the ask store.
+// Unknown and out-of-scope ids get the SAME opaque 404: an id that does not
+// exist and an id the peer may not see must be indistinguishable. Answer and
+// dismiss run on a DEDICATED budget (6/min/peer, 30/min global) that shares
+// nothing with notify/audio/local ask creation.
+
+const express = require('express');
+const { createFeedGate } = require('./event-feed-routes.js');
+
+const ANSWER_RATE_PER_MIN = 6;
+const ANSWER_GLOBAL_PER_MIN = 30;
+
+function createAskRateLimiter({ now = Date.now } = {}) {
+  const perPeer = new Map();
+  const global = [];
+  function prune(list, t) {
+    const cutoff = t - 60000;
+    while (list.length > 0 && list[0] <= cutoff) list.shift();
+  }
+  function check(peerId) {
+    const t = now();
+    const list = perPeer.get(peerId) || [];
+    prune(list, t); prune(global, t);
+    if (list.length >= ANSWER_RATE_PER_MIN || global.length >= ANSWER_GLOBAL_PER_MIN) {
+      return { allowed: false, reason: 'answer-rate' };
+    }
+    list.push(t); perPeer.set(peerId, list); global.push(t);
+    return { allowed: true };
+  }
+  return { check };
+}
+
+function createEventFeedAsksRoutes(deps) {
+  const r = express.Router();
+  const json = express.json({ limit: '16kb' });
+  // deps: { nodesPath, localNodeId, originResolver, eventsEnabled, asks,
+  //         answerService, cellForSession, log }
+  const gate = createFeedGate(deps);
+  const rate = createAskRateLimiter({ now: deps.now });
+  const log = typeof deps.log === 'function' ? deps.log : () => {};
+
+  // Resolve the ask for THIS peer: the cell comes from the ask store (never
+  // from the request), then the peer's cell scope decides. Unknown and
+  // out-of-scope are the same opaque 404.
+  function resolveAskForPeer(peer, askId) {
+    const ask = deps.asks.get(askId);
+    if (!ask) return null;
+    const cellId = deps.cellForSession(ask.session);
+    if (!cellId || !peer.allows({ scope: 'cell', cellId })) return null;
+    return { ask, cellId };
+  }
+
+  r.post('/:id/answer', json, async (req, res) => {
+    const g = await gate(req, res);
+    if (!g) return;
+    const verdict = rate.check(g.peer.nodeId);
+    if (!verdict.allowed) return res.status(429).json({ error: 'answer rate', reason: verdict.reason });
+    if (deps.readonly && deps.readonly()) {
+      return res.status(403).json({ error: 'READONLY: mutazione bloccata' });
+    }
+    // askReplyAccess on top of the feed gate: seeing the card does not
+    // grant the action. It is re-read with the same fresh store the gate used.
+    if (g.peer.grants.askReplyAccess !== true) {
+      return res.status(403).json({ error: 'risorsa non concessa a questo nodo', reason: 'grant-required:ask-action' });
+    }
+    const askId = String(req.params.id || '');
+    const body = req.body && typeof req.body === 'object' ? req.body : {};
+    // CLOSED body: {text, requestId}. Anything that tries to choose a session,
+    // a target or an origin is a 400 before any other consideration.
+    for (const key of Object.keys(body)) {
+      if (!['text', 'requestId'].includes(key)) {
+        return res.status(400).json({ error: `campo non ammesso: "${key}"` });
+      }
+    }
+    if (typeof body.text !== 'string') return res.status(400).json({ error: 'text deve essere una stringa' });
+    const resolved = resolveAskForPeer(g.peer, askId);
+    if (!resolved) return res.status(404).json({ error: 'ask inesistente' });
+    const out = await deps.answerService.answerFederated({
+      askId, text: body.text, peerId: g.peer.nodeId, requestId: body.requestId,
+    });
+    if (out.ok) {
+      return res.json({ status: out.replay ? out.state : 'committed', requestId: body.requestId });
+    }
+    return res.status(out.code || 500).json({ error: out.error, reason: out.reason });
+  });
+
+  r.delete('/:id', async (req, res) => {
+    const g = await gate(req, res);
+    if (!g) return;
+    const verdict = rate.check(g.peer.nodeId);
+    if (!verdict.allowed) return res.status(429).json({ error: 'answer rate', reason: verdict.reason });
+    if (deps.readonly && deps.readonly()) {
+      return res.status(403).json({ error: 'READONLY: mutazione bloccata' });
+    }
+    if (g.peer.grants.askReplyAccess !== true) {
+      return res.status(403).json({ error: 'risorsa non concessa a questo nodo', reason: 'grant-required:ask-action' });
+    }
+    const askId = String(req.params.id || '');
+    const resolved = resolveAskForPeer(g.peer, askId);
+    if (!resolved) return res.status(404).json({ error: 'ask inesistente' });
+    // Local answer in flight wins: 409, and a dismissed ask is not answerable.
+    const out = deps.answerService.dismiss(askId);
+    if (!out.ok) {
+      if (out.reason === 'unknown') return res.status(404).json({ error: 'ask inesistente' });
+      if (out.reason === 'answering') return res.status(409).json({ error: 'risposta in corso: non si scarta un ask in answering' });
+      return res.status(500).json({ error: 'dismiss non riuscito' });
+    }
+    return res.json({ dismissed: true, id: askId, idempotent: out.idempotent === true });
+  });
+
+  r.get('/:id/requests/:requestId', async (req, res) => {
+    const g = await gate(req, res);
+    if (!g) return;
+    if (g.peer.grants.askReplyAccess !== true) {
+      return res.status(403).json({ error: 'risorsa non concessa a questo nodo', reason: 'grant-required:ask-action' });
+    }
+    const askId = String(req.params.id || '');
+    const requestId = String(req.params.requestId || '');
+    const resolved = resolveAskForPeer(g.peer, askId);
+    if (!resolved) return res.status(404).json({ error: 'ask inesistente' });
+    // Scoped: a peer sees ONLY its own attempts, and never the answer text of
+    // anyone — the receipt carries a digest, not a payload.
+    const entry = deps.receipts.get(g.peer.nodeId, askId, requestId);
+    if (!entry) return res.status(404).json({ error: 'ask inesistente' });
+    return res.json({
+      requestId, askId, state: entry.state,
+      ...(entry.receipt ? { receipt: entry.receipt } : {}),
+      ...(entry.updatedAt ? { updatedAt: entry.updatedAt } : {}),
+    });
+  });
+
+  return r;
+}
+
+module.exports = { createEventFeedAsksRoutes, createAskRateLimiter };