@mmmbuto/nexuscrew 0.9.29 → 0.9.31

package/lib/notify/routes.js

@@ -1,5 +1,5 @@
 'use strict';
-// Route del MCP bridge (design §2): notify, web-push, asks. Montate dentro il
+// Routes of the MCP bridge: notify, web-push, asks. Mounted inside the
 // router /api gia' dietro requireToken (server.js) — qui restano solo:
 //   - READONLY come FLOOR (da revisione): sono gated 403 TUTTI i mutanti — answer
 //     (scrittura PTY via paste), push subscribe/unsubscribe (push.json) e la
@@ -18,6 +18,7 @@
 // Il paste della risposta riusa ESATTAMENTE pasteToSession (bracketed literal,
 // niente Invio, control char rifiutati): qui si sanifica il testo PRIMA.
 const express = require('express');
+const { createAskAnswerService } = require('./ask-answer-service.js');
 const { isValidSession } = require('../files/store.js');
 const { normalizeNotificationLang } = require('./language.js');
 const { HOP_HEADER } = require('../proxy/hop-proof.js');
@@ -110,7 +111,16 @@ function notifyRoutes({
   // apre per omissione.
   localNodeId = () => null, originResolver = null, acl = null, dispatcher = null,
   federatedRate = null,
+  answerService = null, receipts = null,
 }) {
+  // The shared answer cycle is built from the local deps when the caller does
+  // not inject one: the local route and the federated surface must never drift
+  // into two different implementations.
+  const askService = answerService || createAskAnswerService({
+    asks, paste,
+    labelPrefix: replyLabel(cfg),
+    onClosure: (kind, info) => { try { notifier.emitRaw({ type: kind, id: info.askId }); } catch (_) {} },
+  });
   const r = express.Router();
   const json = express.json({ limit: '16kb' });
   const bindingGuard = createIdentityBindingGuard({
@@ -196,7 +206,9 @@ function notifyRoutes({
             return res.status(429).json({ status: 'refused', reason: `rate-${quota.bucket}` });
           }
         }
-        const delivered = await notifier.emit({
+        // Delivery ONLY: a federated notify is delivered to this node's UI
+        // and never re-enters the event publisher (no loop, no re-export).
+        const delivered = await notifier.deliverOnly({
           title: b.title.trim(), body: b.body, urgency: b.urgency, lang,
           // Il mittente NON e' `b.session`: quel campo lo dichiara il chiamante.
           // Qui vale solo cio' che la catena ha provato, piu' la cella che il
@@ -204,7 +216,7 @@ function notifyRoutes({
           originNode: resolved.origin.node,
           originCell: resolved.origin.cell,
         });
-        // R31-A3: lo status e' DERIVATO dai conteggi, non dichiarato a parte.
+        // : lo status e' DERIVATO dai conteggi, non dichiarato a parte.
         // `emit` e' best-effort — push fallito → 0, `ui` conta i write SSE
         // riusciti — e il dispatcher propaga SOLO l'etichetta (i conteggi
         // muoiono in forward(), rilievo da revisione): per la cella mittente e'
@@ -304,6 +316,7 @@ function notifyRoutes({
         urgency: 'high',
         session: ask.session,
         lang: 'it',
+        askId: ask.id,
         url: `/#ask=${ask.id}`,
       });
       res.status(201).json({ id: ask.id });
@@ -326,9 +339,12 @@ function notifyRoutes({
       const ask = asks.get(id);
       const binding = await guardBinding(req, ask && ask.session);
       if (binding instanceof Error) return bindingRejected(res, binding);
-      const out = asks.dismiss(id);
+      // Same service as the federated path: one authoritative state, so the
+      // pending/unknown constraint cannot be bypassed from here.
+      const out = askService.dismiss(id);
       if (!out.ok) {
         if (out.reason === 'unknown') return res.status(404).json({ error: 'ask inesistente' });
+        if (out.reason === 'delivery-unknown-block') return res.status(409).json({ error: out.error, reason: out.reason });
         if (out.reason === 'answering') return res.status(409).json({ error: 'risposta in corso: non si scarta un ask in answering' });
         return res.status(500).json({ error: 'dismiss non riuscito' });
       }
@@ -348,7 +364,7 @@ function notifyRoutes({
       // Validazione del testo PRIMA del claim: nessun claim da rilasciare su 400.
       const raw = req.body && req.body.text;
       if (typeof raw !== 'string') return res.status(400).json({ error: 'text deve essere una stringa' });
-      // R27: oltre il tetto si RIFIUTA, non si tronca. I due tetti vicini in casa
+      // Oltre il tetto si RIFIUTA, non si tronca. I due tetti vicini in casa
       // (title/body della notifica, nc_send_cell) rifiutano da sempre; qui invece
       // la textarea non ha limite, la route troncava a MAX_ANSWER e rispondeva
       // {answered:true}: l'operatore incollava una config e la cella riceveva la
@@ -358,7 +374,7 @@ function notifyRoutes({
       // La lunghezza misurata ENTRA nel messaggio: la route la conosce, e senza
       // di essa chi ha incollato 12000 caratteri sa che c'e' un tetto ma non di
       // quanto deve tagliare. Dirti che hai sbagliato senza dirti di quanto e'
-      // la stessa meta' di difetto che R27 corregge altrove.
+      // La stessa meta' di difetto che corregge altrove.
       if (sanitized.length > MAX_ANSWER) {
         return res.status(400).json({ error: `text troppo lungo: ${sanitized.length} caratteri, il massimo e' ${MAX_ANSWER}` });
       }
@@ -367,25 +383,48 @@ function notifyRoutes({
       const ask = asks.get(id);
       const binding = await guardBinding(req, ask && ask.session);
       if (binding instanceof Error) return bindingRejected(res, binding);
-      const claim = asks.claim(id);
-      if (!claim.ok) {
-        if (claim.reason === 'unknown') return res.status(404).json({ error: 'ask inesistente' });
-        if (claim.reason === 'dismissed') return res.status(409).json({ error: 'ask gia\' scartato (dismissed)' });
-        if (claim.reason === 'answering') return res.status(409).json({ error: 'risposta gia\' in corso da un\'altra richiesta' });
-        return res.status(409).json({ error: 'ask gia\' risposto' });
+      // ONE answer cycle for local and federated: the service owns the
+      // claim -> paste -> commit flow AND the delivery-unknown lock. The
+      // closure event is emitted by the service, not here.
+      const out = await askService.answerLocal({ askId: id, text });
+      if (!out.ok) return res.status(out.code || 500).json({ error: out.error });
+      res.json({ answered: true, id });
+    } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
+  });
+
+  // Explicit reconciliation: local and authenticated only, NEVER
+  // federata (la route non e' in allowlist). Decide l'esito dei tentativi
+  // delivery-unknown e sblocca l'ask; CAS facoltativa sulla revisione.
+  r.post('/asks/:id/reconcile', mutGate, json, (req, res) => {
+    try {
+      const id = String(req.params.id || '');
+      const ask = asks.get(id);
+      if (!ask) return res.status(404).json({ error: 'ask inesistente' });
+      const body = req.body || {};
+      const decision = body.decision;
+      if (decision !== 'mark-delivered' && decision !== 'allow-new-attempt') {
+        return res.status(400).json({ error: 'decision deve essere mark-delivered|allow-new-attempt' });
       }
-      let pasted = false;
-      try {
-        pasted = await paste(claim.ask.session, `[${replyLabel(cfg)} reply · ask#${id}] ${text}`);
-      } catch (_) { pasted = false; }
-      if (!pasted) {
-        asks.release(id); // rollback: l'ask resta open e contendibile
-        return res.status(502).json({ error: `paste fallito: sessione "${claim.ask.session}" non raggiungibile` });
+      const out = askService.reconcile({ askId: id, decision, expectedRevision: body.expectedRevision });
+      if (!out.ok) {
+        if (out.reason === 'revision-required' || out.reason === 'bad-decision') {
+          return res.status(400).json({ error: out.error, reason: out.reason });
+        }
+        if (out.reason === 'revision-conflict') return res.status(409).json({ error: out.error, reason: out.reason });
+        if (out.reason === 'unknown') return res.status(404).json({ error: out.error, reason: out.reason });
+        if (out.reason === 'persist-failed') {
+          return res.status(500).json({ error: 'reconcile non persistito: ask ancora bloccato', reason: out.reason });
+        }
+        // Il servizio dichiara il proprio codice: il rifiuto di una
+        // riconciliazione su un paste VIVO (answering) o senza alcun esito
+        // incerto da riconciliare (nothing-to-reconcile, generation-changed)
+        // e' una decisione dell'operatore rifiutata, non un errore interno.
+        if (out.code === 409) {
+          return res.status(409).json({ error: out.error, reason: out.reason });
+        }
+        return res.status(500).json({ error: out.error || 'reconcile non riuscito', reason: out.reason });
       }
-      asks.commit(id, text);
-      // Le altre UI aperte tolgono la card/badge senza aspettare il poll.
-      notifier.emitRaw({ type: 'ask-answered', id });
-      res.json({ answered: true, id });
+      res.json({ reconciled: true, askId: id, decision, attempts: out.changed, revision: out.revision });
     } catch (e) { res.status(500).json({ error: String(e.message || e) }); }
   });
 

package/lib/proxy/federation.js

@@ -5,6 +5,7 @@ const net = require('node:net');
 const express = require('express');
 const store = require('../nodes/store.js');
 const topologyCache = require('../nodes/topology-cache.js');
+const { allowedByClass, classifyResource } = require('./resource-acl.js');
 const reverseRotation = require('../nodes/reverse-rotation.js');
 const { bearerFrom } = require('../auth/middleware.js');
 const { safeEqual } = require('../nodes/peering.js');
@@ -176,8 +177,8 @@ function knownResource(resource) {
     || resource === '/ws'
     // Un avviso all'operatore attraversa la federazione con la stessa spina
     // dorsale dell'audio: origine provata dalla catena `visited`, ACL del
-    // target, budget dedicato. NON e' la coda di NC-NEXT-07 (§5 del modello di
-    // autorita'): quella differisce un'esecuzione, questo mostra del testo e
+    // target, dedicated budget. It is NOT the authority-model queue: that one
+    // defers an execution, this one shows text and executes nothing.
     // non esegue nulla. `/audio/speak` esce da un altoparlante in una stanza
     // fisica ed e' gia' federato: una notifica e' meno invasiva di cosi'.
     || resource === '/notify'
@@ -192,6 +193,15 @@ function knownResource(resource) {
     // significava poter creare a distanza un engine che non si puo' rendere
     // avviabile a distanza — un'asimmetria che rompeva la modifica remota a
     // meta' strada, senza proteggere nulla.
+    // Event feed: a closed GET surface inside the authenticated API.
+    // The handler demands a proven last hop on top of the class gate — the
+    // allowlist only admits the resources exist at all.
+    || resource === '/event-feed'
+    || resource === '/event-feed/snapshot'
+    // Federated ask write-back: answer, dismiss, attempt status.
+    || /^\/event-feed\/asks\/[a-f0-9]{8}(?:\/answer|\/requests\/[0-9a-f-]{16,64})?$/.test(resource)
+    || /^\/event-feed\/[A-Za-z0-9._-]{1,32}$/.test(resource)
+    || /^\/event-feed\/node\/[a-f0-9]{32}$/.test(resource)
     || isPanelResource(resource)
     || /^\/fleet\/(status|schema|definitions|credentials\/status|credentials\/(?:set|remove)|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-model|remove-model|model-test|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource);
 }
@@ -229,6 +239,16 @@ function liveHostAllowedFor(ingress) {
   return ingress.liveHostAccess === true;
 }
 
+// One decision, used by BOTH federated entry points: the HTTP relay and the
+// WebSocket upgrade. A resource whose class is unknown, or whose grants the
+// owner has not conceded, is refused before anything is dispatched.
+function classGateCheck(resource, method, ingress) {
+  const cls = classifyResource(resource, method);
+  if (!cls) return { ok: false, status: 404, reason: 'resource-not-classified' };
+  if (!allowedByClass(cls, ingress)) return { ok: false, status: 403, reason: `grant-required:${cls}` };
+  return { ok: true, className: cls };
+}
+
 function allowedResource(resource, method = 'GET') {
   if (isPanelResource(resource)) return method === 'GET' || method === 'POST';
   if (resource === '/live-host') return method === 'GET';
@@ -273,6 +293,13 @@ function allowedResource(resource, method = 'GET') {
   // Notify: solo POST. `/events`, `/asks` e `/push/*` restano NON federati —
   // SSE non puo' autenticarsi col Bearer e un ask ha un canale di ritorno che
   // e' un paste nel tmux locale, quindi non attraverserebbe comunque.
+  // Event feed: GET only, no mutation, no upgrade.
+  if (resource === '/event-feed' || resource === '/event-feed/snapshot') return method === 'GET';
+  if (/^\/event-feed\/[A-Za-z0-9._-]{1,32}$/.test(resource)) return method === 'GET';
+  if (/^\/event-feed\/node\/[a-f0-9]{32}$/.test(resource)) return method === 'GET';
+  if (/^\/event-feed\/asks\/[a-f0-9]{8}\/answer$/.test(resource)) return method === 'POST';
+  if (/^\/event-feed\/asks\/[a-f0-9]{8}$/.test(resource)) return method === 'DELETE';
+  if (/^\/event-feed\/asks\/[a-f0-9]{8}\/requests\/[0-9a-f-]{16,64}$/.test(resource)) return method === 'GET';
   if (resource === '/notify') return method === 'POST';
   // Audio: only capability read, speak and stop are exposed through Hydra.
   // audio.consent is a LOCAL mutation and MUST stay unreachable federated.
@@ -293,7 +320,27 @@ function readonlyBlocksFederated(resource, method) {
   return resource !== '/audio/speak/status' && resource !== '/audio/stop';
 }
 
+const EVENT_FEED_CURSOR_RE = /^[0-9]{1,12}:[0-9]{1,12}$/;
+
 function allowedQuery(resource, method, rawUrl) {
+  // The event feed has a CLOSED query surface: only `after=<epoch>:<seq>` on
+  // the SSE stream, nothing at all on the snapshot. A token in a query is
+  // refused on these paths whatever it looks like.
+  if (resource === '/event-feed' || resource === '/event-feed/snapshot'
+    || /^\/event-feed\/[A-Za-z0-9._-]{1,32}$/.test(resource)
+    || /^\/event-feed\/node\/[a-f0-9]{32}$/.test(resource)) {
+    const index = String(rawUrl || '').indexOf('?');
+    if (index < 0) return true;
+    const params = new URLSearchParams(String(rawUrl).slice(index + 1));
+    const keys = [...params.keys()];
+    if (keys.some((k) => !/^[A-Za-z0-9_]+$/.test(k))) return false;
+    if (params.has('token') || params.has('access_token')) return false;
+    if (resource !== '/event-feed') return keys.length === 0;
+    if (params.getAll('after').length > 1) return false;
+    if (keys.length === 0) return true;
+    if (keys.length !== 1 || !params.has('after')) return false;
+    return EVENT_FEED_CURSOR_RE.test(params.get('after') || '');
+  }
   if (!resource.startsWith('/diagnostics/')) return true;
   const index = String(rawUrl || '').indexOf('?');
   if (index < 0) return true;
@@ -428,6 +475,20 @@ function routeHandler({ nodesPath, localPort, localCredential, ingress = null, r
     if (parsed && isLiveHostResource(parsed.resource) && !liveHostAllowedFor(ingress)) {
       return res.status(403).json({ error: 'cella ospite live non concessa da questo nodo', reason: 'live-host-not-granted' });
     }
+    // Class gate, before the dispatch: every federated resource belongs to a
+    // class, and the class decides which grants the owner must have conceded.
+    // A resource that is allowlisted but not classified is DENIED — a new route
+    // must not reach a limited peer by accident — and the coverage test fails
+    // when the allowlist grows without the classification.
+    if (parsed && allowedResource(parsed.resource, req.method)) {
+      const gate = classGateCheck(parsed.resource, req.method, ingress);
+      if (!gate.ok) {
+        return res.status(gate.status).json({
+          error: gate.status === 404 ? 'not found' : 'risorsa non concessa a questo nodo',
+          reason: gate.reason,
+        });
+      }
+    }
     if (!parsed || !allowedResource(parsed.resource, req.method)
       || !allowedQuery(parsed.resource, req.method, req.url)) return res.status(404).json({ error: 'not found' });
     if (readonly() && readonlyBlocksFederated(parsed.resource, req.method)) return res.status(403).json({ error: 'READONLY: federated mutation blocked' });
@@ -797,7 +858,7 @@ async function reconcilePeerShare(opts = {}) {
   throw lastError || new Error('riconciliazione Share fallita');
 }
 
-// Runner di riconciliazione Share OFF al boot (design piano §3.2.8). Per-peer,
+// Share-off reconciliation runner at boot.
 // no-overlap (un solo runner attivo per nome), al massimo tre round per processo,
 // backoff nominato 0/1000/5000 ms (iniettabile). Re-read dello stato desiderato
 // (nodes.json) prima di ogni round: abort se non e' piu' shared:false (es. il peer
@@ -1044,7 +1105,11 @@ function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly
   r.get('/health', (_req, res) => {
     const st = store.loadStore(nodesPath);
     const advertisedRoles = typeof roles === 'function' ? roles() : null;
+    // eventFeedV1: the peer checks this capability BEFORE subscribing to the
+    // event feed. An older node reports no capability and the client marks the
+    // feed unsupported instead of retrying forever.
     res.json({ ok: true, instanceId: (st && st.nodeId) || null, version, readonly: !!readonly(),
+      eventFeedV1: true,
       ...(advertisedRoles ? { roles: advertisedRoles } : {}) });
   });
   // Il client puo' verificare SOLO la reverse port che il pairing gli ha
@@ -1321,6 +1386,12 @@ function forwardUpgrade({ req, socket, head, nodesPath, localPort, localCredenti
   // frame arrivano da qui.
   if (!parsed || (parsed.resource !== '/ws' && !isPanelResource(parsed.resource))) return reject(socket, 404);
   if (isPanelResource(parsed.resource) && !panelAllowedFor(ingress)) return reject(socket, 403);
+  // The same class decision as the HTTP relay: an upgrade is an entry point too,
+  // and a limited peer must not reach an operator-class channel through it.
+  {
+    const gate = classGateCheck(parsed.resource, 'GET', ingress);
+    if (!gate.ok) return reject(socket, gate.status === 404 ? 404 : 403);
+  }
   const st = store.loadStore(nodesPath);
   if (!st) return reject(socket, 503);
   const visited = controlledVisited(req, ingress, st.nodeId);

package/lib/proxy/node-proxy.js

@@ -1,13 +1,13 @@
 'use strict';
-// lib/proxy/node-proxy.js — reverse-proxy single-origin /node/<name> (design §4, §4b(2)).
+// lib/proxy/node-proxy.js — single-origin reverse proxy for /node/<name>.
 //
-// La superficie PIU' security-critical del progetto. Contratti duri (§4b(2)):
+// The MOST security-critical surface of the project. Hard contracts:
 //   1. Il token LOCALE (Bearer) si verifica PRIMA di risolvere <name>. Il router
 //      HTTP e' montato DIETRO requireToken; l'upgrade WS verifica il token in testa
 //      a handleNodeUpgrade, prima di qualunque parsing/resolve.
 //   2. <name> = chiave strict di nodes.json (^[a-z0-9-]{1,32}$), MAI usata per
 //      costruire path/URL filesystem; nome non in config -> 404 secco.
-//   3. Il token del nodo remoto lo inietta SOLO il proxy (da nodes.json via B0); il
+// 3. Il token del nodo remoto lo inietta SOLO il proxy (da nodes.json via); il
 //      browser non lo vede MAI. Header hop-by-hop e Authorization/cookie/host/
 //      x-forwarded/proxy-* client-supplied STRIPPATI, mai inoltrati upstream.
 //   4. Upstream consentito: ESCLUSIVAMENTE 127.0.0.1:<localPort> del tunnel da
@@ -25,7 +25,7 @@ const net = require('node:net');
 const { NODE_NAME_RE } = require('../nodes/store.js');
 const { bearerFrom } = require('../auth/middleware.js');
 
-// Timeout upstream: irraggiungibile/lento -> 502, mai spinner infinito (§8).
+// Upstream timeouts: unreachable/slow -> 502, never an endless spinner.
 const PROXY_TIMEOUT_MS = 30000;
 const CONNECT_TIMEOUT_MS = 10000;
 
@@ -52,7 +52,7 @@ const MUTATING = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 // forma di difetto che continuiamo a trovare.
 const LOCAL_ONLY_PREFIXES = ['/api/live-host', '/api/panel', '/api/route', '/federation/route'];
 
-// Hop-by-hop (RFC 7230 §6.1) + Proxy-*: mai inoltrati end-to-end.
+// Hop-by-hop (RFC 7230 section 6.1) + Proxy-*: never forwarded end-to-end.
 const HOP_BY_HOP = new Set([
   'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
   'te', 'trailer', 'transfer-encoding', 'upgrade',
@@ -153,9 +153,9 @@ function createNodeProxy(deps) {
   const { resolveNode, readonly = () => false, httpRequest = http.request } = deps;
   return function nodeProxy(req, res) {
     const parsed = splitNodePath(req.url);
-    if (!parsed) return notFound(res);                       // §4b(2)#2 no name
-    if (!NODE_NAME_RE.test(parsed.name)) return notFound(res); // §4b(2)#2 strict/traversal
-    if (isTransitiveRest(parsed.rest)) return notFound(res);   // §4b(2)#7 no transitive
+    if (!parsed) return notFound(res);                       // no name
+    if (!NODE_NAME_RE.test(parsed.name)) return notFound(res); // strict/traversal
+    if (isTransitiveRest(parsed.rest)) return notFound(res);   // no transitive rest
     if (isLocalOnly(parsed.rest)) {
       return res.status(403).json({ error: 'local-only: azione non instradabile via federazione' });
     }
@@ -170,7 +170,7 @@ function createNodeProxy(deps) {
 
 function proxyHttp(req, res, node, rest, search, httpRequest) {
   const options = {
-    host: '127.0.0.1',                 // §4b(2)#4 upstream SOLO loopback da config
+    host: '127.0.0.1',                 // upstream loopback ONLY, from config
     port: node.localPort,
     method: req.method,
     // parita' col path WS: il token LOCALE eventualmente in query (?token=) non
@@ -278,10 +278,10 @@ function handleNodeUpgrade(ctx) {
   const node = resolveNode(parsed.name);
   if (!node) return abortUpgrade(socket, 404);
 
-  // §9d: in READONLY locale il WS proxy si nega in toto — il piping raw non puo'
-  // applicare un readonly frame-level e un attach WS e' un canale di scrittura
-  // (PTY remoto). Il nodo remoto applica il PROPRIO READONLY ai suoi client;
-  // qui vale quello locale, come per i metodi HTTP mutanti.
+  // In local READONLY the WS proxy refuses wholesale — raw piping cannot
+  // apply a frame-level readonly and a WS attach is a write channel (remote
+  // PTY). The remote node applies ITS OWN READONLY to its clients;
+  // here the local one rules, as for mutating HTTP methods.
   if (readonly()) return abortUpgrade(socket, 403);
 
   // (3)(4) inject token remoto, upstream SOLO loopback da config

package/lib/proxy/panel-auth.js

@@ -17,7 +17,7 @@
 //    browser, nei log del proxy o in un Referer.
 // 2. IL TICKET SI CONSUMA ALLA PRIMA RICHIESTA e la risposta imposta un cookie
 //    HttpOnly SameSite Strict con Path=ESATTAMENTE il mount da cui la
-//    richiesta e' entrata + la cella (R22, 2026-08-17): `/api/panel/<cella>`
+// Richiesta e' entrata + la cella (2026-08-17): `/api/panel/<cella>`
 //    sul control plane, `/panel/<cella>` sulla porta pannello dedicata — MAI
 //    una costante unica, perche' i due mount servono path diversi e un cookie
 //    scritto per l'uno non verrebbe mai mandato dal browser sotto l'altro
@@ -159,7 +159,7 @@ function createPanelAuth({
     return !!rec && rec.exp > now() && rec.cell === cellId;
   }
 
-  // R22: il Path deve valere per il mount da cui la richiesta e' ENTRATA, non
+  // Il Path deve valere per il mount da cui la richiesta e' ENTRATA, non
   // per una costante. Whitelist stretta invece di un default permissivo — un
   // prefisso non riconosciuto rifiuta (vedi mountPrefixOf) invece di produrre
   // un cookie con uno scope che nessuno ha verificato.
@@ -237,7 +237,7 @@ function createPanelAuth({
     const qi = url.indexOf('?');
     if (qi !== -1) qTicket = new URLSearchParams(url.slice(qi + 1)).get('ticket');
     if (qTicket) {
-      // R22: il mount si verifica PRIMA di toccare il ticket — un mount non
+      // Il mount si verifica PRIMA di toccare il ticket — un mount non
       // riconosciuto non deve bruciare un ticket monouso per un errore che
       // non dipende da chi lo presenta.
       const mountPrefix = mountPrefixOf(req);
@@ -318,7 +318,7 @@ function createPanelAuth({
     consumeCore(req, res, next, cellId, provenienza);
   }
 
-  // —— SOLO consumo: per la porta pannello (P0 sicurezza 2026-08-16). Nessuna
+  // — SOLO consumo: per la porta pannello (sicurezza 2026-08-16). Nessuna
   // emissione qui — quella resta dietro requireToken sul control plane, mai
   // su una porta che non verifica un token. Un POST .../ticket arrivato qui
   // (non dovrebbe mai: frameUrl non lo costruisce) cade nel consumo e viene

package/lib/proxy/panel-proxy.js

@@ -43,7 +43,7 @@ const { CELL_ID_RE } = require('../live-host/store.js');
 
 const PANEL_TIMEOUT_MS = 30000;
 
-// Hop-by-hop (RFC 7230 §6.1) + Proxy-*: mai inoltrati end-to-end.
+// Hop-by-hop (RFC 7230 section 6.1) + Proxy-*: never forwarded end-to-end.
 const HOP_BY_HOP = new Set([
   'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
   'te', 'trailer', 'transfer-encoding', 'upgrade',
@@ -295,7 +295,7 @@ function handlePanelUpgrade({ req, socket, head, resolveCellPanel, verifyToken,
     return kill(401, 'Unauthorized');
   }
   // Il prefisso varia con la porta: /api/panel sul control plane (compat),
-  // /panel nudo sulla porta pannello dedicata (P0 sicurezza 2026-08-16).
+  // /panel nudo sulla porta pannello dedicata (sicurezza 2026-08-16).
   const parsed = splitPanelPath(req.url.replace(/^\/(?:api\/)?panel/, ''));
   if (!parsed) return kill(404, 'Not Found');
   Promise.resolve(resolveTarget(resolveCellPanel, parsed.cellId)).then((target) => {

package/lib/proxy/resource-acl.js

@@ -0,0 +1,145 @@
+'use strict';
+
+// Classification of the resources reachable through the federation proxy.
+//
+// Every federated resource belongs to exactly one class, and each class demands
+// explicit grants from the node that OWNS the resource. The class is decided on
+// the resource and the method, BEFORE the request is dispatched: a route that is
+// not classified is denied, so a new endpoint cannot become reachable by a
+// limited peer just because nobody classified it. The gate reads grants — never
+// a role string — and an owner-side request (no peer ingress) is unaffected.
+
+const CLASSES = Object.freeze({
+  // Events of cells and of the node itself.
+  'event-feed': Object.freeze({ grants: ['eventsAccess'] }),
+  'node-event-feed': Object.freeze({ grants: ['eventsAccess', 'nodeEventsAccess'] }),
+  // Answering, dismissing or polling a single ask. Seeing the card does not
+  // grant the action.
+  'ask-action': Object.freeze({ grants: ['eventsAccess', 'askReplyAccess'] }),
+  // Inventories: which cells, which sessions, the status of the fleet. Only the
+  // authorized inventory is projected, and a peer with no visible cell sees none
+  // of it.
+  inventory: Object.freeze({ grants: [], needsVisibility: true }),
+  // Reading shared files: list and download, filtered by the owning cell.
+  'files-read': Object.freeze({ grants: ['filesReadAccess'] }),
+  // Choosing which cell of this node hosts the Live session.
+  'live-host': Object.freeze({ grants: ['liveHostAccess'] }),
+  // Opening a panel: a browser with already-authenticated sessions behind it.
+  panel: Object.freeze({ grants: ['panelAccess', 'peerOperatorAccess'], needsVisibility: true }),
+  // Everything else that mutates: configuration, filesystem browsing,
+  // diagnostics, credentials, fleet topology, decks, terminals, uploads and
+  // deletions. Operator-level by definition.
+  operator: Object.freeze({ grants: ['peerOperatorAccess'] }),
+});
+
+const CLASS_NAMES = Object.freeze(Object.keys(CLASSES));
+
+const CELL_ID = '[A-Za-z0-9._-]{1,32}';
+const NODE_ID = '[a-f0-9]{32}';
+
+// Resource -> class. Keep this table aligned with the federation allowlist: the
+// coverage test reads both and fails when one has a resource the other ignores.
+function classifyResource(resource, method = 'GET') {
+  if (typeof resource !== 'string' || resource === '') return null;
+  const m = String(method || 'GET').toUpperCase();
+
+  if (resource === '/event-feed' || resource === '/event-feed/snapshot') {
+    return m === 'GET' ? 'event-feed' : null;
+  }
+  if (new RegExp(`^/event-feed/${CELL_ID}$`).test(resource)) return m === 'GET' ? 'event-feed' : null;
+  if (new RegExp(`^/event-feed/node/${NODE_ID}$`).test(resource)) return m === 'GET' ? 'node-event-feed' : null;
+  if (new RegExp(`^/asks/${CELL_ID}/(answer|dismiss|status)$`).test(resource)) {
+    return m === 'POST' || m === 'GET' ? 'ask-action' : null;
+  }
+  // Federated ask surface: the ask id is the 8-hex local id, the
+  // attempt id a UUID. The routes live UNDER /event-feed because they are the
+  // feed's own write-back path; the class is the same ask-action.
+  if (/^\/event-feed\/asks\/[a-f0-9]{8}\/answer$/.test(resource)) return m === 'POST' ? 'ask-action' : null;
+  if (/^\/event-feed\/asks\/[a-f0-9]{8}$/.test(resource)) return m === 'DELETE' ? 'ask-action' : null;
+  if (/^\/event-feed\/asks\/[a-f0-9]{8}\/requests\/[0-9a-f-]{16,64}$/.test(resource)) return m === 'GET' ? 'ask-action' : null;
+
+  if (resource === '/cells') return m === 'GET' ? 'inventory' : null;
+  if (resource === '/sessions') return m === 'GET' ? 'inventory' : (m === 'POST' ? 'operator' : null);
+  if (/^\/sessions\/[\w.@%:+-]{1,128}$/.test(resource)) return m === 'DELETE' ? 'operator' : null;
+  if (/^\/sessions\/[\w.@%:+-]{1,128}\/visibility$/.test(resource)) return m === 'PATCH' ? 'operator' : null;
+  if (resource === '/vl-nodes') return m === 'GET' ? 'inventory' : null;
+  if (new RegExp(`^/vl-nodes/${NODE_ID}/events$`).test(resource)) return m === 'GET' ? 'inventory' : null;
+
+  if (resource === '/files') return m === 'GET' ? 'files-read' : (m === 'DELETE' ? 'operator' : null);
+  if (resource === '/files/download') return m === 'GET' ? 'files-read' : null;
+  if (resource === '/files/upload') return m === 'POST' ? 'operator' : null;
+
+  if (resource === '/live-host') return m === 'GET' ? 'live-host' : null;
+  if (resource === '/live-host/designate' || resource === '/live-host/clear' || resource === '/live-host/bridge') {
+    return m === 'POST' ? 'live-host' : null;
+  }
+  if (new RegExp(`^/panel/${CELL_ID}(?:/.*)?$`).test(resource)) {
+    return m === 'GET' || m === 'POST' ? 'panel' : null;
+  }
+
+  // Operator-level mutations and diagnostics, one by one.
+  if (resource === '/config') return m === 'GET' ? 'operator' : null;
+  if (resource === '/fs/dirs') return m === 'GET' ? 'operator' : null;
+  if (resource === '/cells/send') return m === 'POST' ? 'operator' : null;
+  if (resource === '/vl-nodes/invite') return m === 'POST' ? 'operator' : null;
+  if (new RegExp(`^/vl-nodes/${NODE_ID}/commands$`).test(resource)) return m === 'POST' ? 'operator' : null;
+  if (new RegExp(`^/vl-nodes/${NODE_ID}$`).test(resource)) return m === 'DELETE' ? 'operator' : null;
+  // Fleet: the allowlist splits the family in two — the read alternatives are
+  // GET, the rest are POST. A peer that is not an operator is refused by the
+  // class gate; an operator no longer gets "resource-not-classified".
+  if (/^\/fleet\/(status|schema|definitions|credentials\/status)$/.test(resource)) {
+    return m === 'GET' ? 'operator' : null;
+  }
+  if (/^\/fleet\/(credentials\/(?:set|remove)|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-model|remove-model|model-test|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource)) {
+    return m === 'POST' ? 'operator' : null;
+  }
+  if (resource === '/decks') return m === 'GET' || m === 'POST' ? 'operator' : null;
+  if (/^\/decks\/[a-z0-9-]{1,32}$/.test(resource)) {
+    return ['PUT', 'PATCH', 'DELETE'].includes(m) ? 'operator' : null;
+  }
+
+  // Topology, diagnostics, terminals and the notify/audio surface of this node:
+  // all of them act ON the owner's node, so they belong to the operator class.
+  if (resource === '/topology') return m === 'GET' ? 'operator' : null;
+  // Diagnostics: the allowlist accepts GET on status and logs, DELETE on logs
+  // and PATCH on verbose — the class follows those methods, not a wider one.
+  if (resource === '/diagnostics/status') return m === 'GET' ? 'operator' : null;
+  if (resource === '/diagnostics/logs') return m === 'GET' || m === 'DELETE' ? 'operator' : null;
+  if (resource === '/diagnostics/verbose') return m === 'PATCH' ? 'operator' : null;
+  if (resource === '/ws') return m === 'GET' ? 'operator' : null;
+  if (resource === '/notify') return m === 'POST' ? 'operator' : null;
+  if (resource === '/audio/capability') return m === 'GET' ? 'operator' : null;
+  if (resource === '/audio/speak') return m === 'POST' ? 'operator' : null;
+  if (resource === '/audio/speak/status') return m === 'POST' ? 'operator' : null;
+  if (resource === '/audio/stop') return m === 'POST' ? 'operator' : null;
+
+  // Not classified: denied until it is classified on purpose.
+  return null;
+}
+
+// True when the grants of the peer satisfy the class. `ingress` null is the
+// owner of this node, who is not limited by these grants.
+function allowedByClass(className, ingress) {
+  if (!ingress) return true;
+  const cls = CLASSES[className];
+  if (!cls) return false; // unknown class: never a reason to allow
+  for (const grant of cls.grants) {
+    if (ingress[grant] !== true) return false;
+  }
+  if (cls.needsVisibility === true && ingress.cellVisibility === 'none') return false;
+  return true;
+}
+
+// The grants a class demands, for diagnostics and for the coverage test.
+function grantsForClass(className) {
+  const cls = CLASSES[className];
+  return cls ? [...cls.grants] : null;
+}
+
+module.exports = {
+  CLASSES,
+  CLASS_NAMES,
+  allowedByClass,
+  classifyResource,
+  grantsForClass,
+};