@mmmbuto/nexuscrew 0.9.57 → 0.9.58

package/lib/notify/ask-relay.js

@@ -14,12 +14,61 @@
 // refused locally until verification resolves the attempt.
 
 const crypto = require('node:crypto');
+const { NODE_NAME_RE } = require('../nodes/store.js');
 const { probeReverseSlot } = require('../nodes/reverse-slot-proof.js');
-const IDLE_MS = 15000;
+const { askSlotVerifier, binding } = require('../nodes/ask-slot-verifier.js');
+const RELAY_DEADLINE_MS = 8000;
+const OWNER_REASONS = new Set([
+  'reverse-slot-unverified', 'peer-unknown', 'events-disabled', 'grant-required:ask-action',
+  'peer-visibility', 'origin-visibility', 'federated-origin-required', 'hop-chain',
+  'store-unavailable', 'unknown-peer', 'unknown-trust', 'no-delivering-peer',
+  'no-node-identity', 'bad-visited', 'bad-hop', 'self-hop', 'bad-attested-cell',
+  'origin-mismatch', 'fleet-unavailable', 'cell-not-active', 'answer-rate',
+  'unknown', 'dismissed', 'answering', 'answered', 'store-unreadable',
+  'delivery-unknown-block', 'already-delivered', 'paste-failed', 'bad-request-id',
+  'no-receipts', 'request-conflict', 'receipt-cap', 'federation-peer-unreachable',
+  'federation-peer-timeout', 'federation-body-consumed',
+]);
+function safeReason(reason) { return OWNER_REASONS.has(reason) ? reason : undefined; }
 
-function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = () => {}, probeReverseSlotImpl = probeReverseSlot } = {}) {
+function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = () => {}, probeReverseSlotImpl = probeReverseSlot, peers = null, localPort = () => 0, localToken = () => '', nodesPath = null, slotVerifier = askSlotVerifier } = {}) {
   // (ownerId|askId|requestId) -> {state: 'sent'|'committed'|'failed'|'uncertain', requestId}
   const attempts = new Map();
+  const answerFlights = new Map();
+
+  const proofScope = nodesPath || loadStore;
+  function deadlineResult(op, args, capability) {
+    if (capability) return { ownerId: args.ownerId, askId: args.askId, canReply: false, status: 'unreachable', reason: 'relay-deadline' };
+    if (op.answer && op.delivered && args.rid) {
+      return { ok: false, code: 200, uncertain: true, requestId: args.rid, reason: 'delivery-unknown', error: 'esito incerto: verifica lo stato prima di rispondere' };
+    }
+    return { ok: false, code: 504, reason: 'relay-deadline', error: 'relay deadline' };
+  }
+  async function operation(args, work, capability = false, answer = false) {
+    const controller = new AbortController();
+    const op = { controller, answer, delivered: false, expired: false, proofKey: null, proofBinding: null };
+    let rejectAbort;
+    const aborted = new Promise((_resolve, reject) => { rejectAbort = () => reject(new Error('relay deadline')); });
+    controller.signal.addEventListener('abort', rejectAbort, { once: true });
+    op.active = () => !controller.signal.aborted;
+    op.check = () => { if (!op.active()) throw new Error('relay deadline'); };
+    op.wait = promise => Promise.race([promise, aborted]);
+    const timer = setTimeout(() => { op.expired = true; controller.abort(); }, RELAY_DEADLINE_MS);
+    try { return await Promise.race([Promise.resolve().then(() => work(op)), aborted]); }
+    catch (_) {
+      slotVerifier.invalidate(op.proofKey);
+      if (op.answer && op.delivered && args.rid) {
+        const entry = attempts.get(attemptKey(args.ownerId, args.askId, args.rid));
+        if (entry) entry.state = 'uncertain';
+      }
+      if (op.expired) return deadlineResult(op, args, capability);
+      return capability
+        ? { ownerId: args.ownerId, askId: args.askId, canReply: false, status: 'unreachable' }
+        : { ok: false, code: 502, error: 'owner unreachable' };
+    } finally {
+      clearTimeout(timer); controller.signal.removeEventListener('abort', rejectAbort); controller.abort();
+    }
+  }
 
   function requestId() { return crypto.randomUUID(); }
 
@@ -28,52 +77,102 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
   // attivo. Per gli inbound la porta dello slot DEVE essere verificata con la
   // stessa sonda dei terminali (secret del peer + instanceId atteso): nessun
   // fallback sulla localPort senza proof.
-  function candidateOwner(ownerId) {
-    const store = loadStore();
+  async function candidateOwner(ownerId, op) {
+    let store = loadStore();
+    if (!store) return null;
+    let routed = null;
+    if (typeof peers === 'function') {
+      let inventory;
+      try { inventory = await op.wait(peers()); } catch (_) { op.check(); return null; }
+      op.check();
+      const matches = (Array.isArray(inventory) ? inventory : [])
+        .filter((p) => p && (p.nodeId === ownerId || p.instanceId === ownerId));
+      if (matches.length !== 1 || matches[0].stale === true) return null;
+      const route = matches[0].route;
+      if (!Array.isArray(route) || !route.length || route.length > 4
+        || route.some((name) => typeof name !== 'string' || !NODE_NAME_RE.test(name))
+        || new Set(route).size !== route.length) return null;
+      routed = [...route];
+    }
+    op.check();
+    store = loadStore();
     if (!store) return null;
+    slotVerifier.sync(store, proofScope);
     const nodes = store.nodes || [];
-    const out = nodes.find((n) => n && n.direction === 'outbound'
-      && n.nodeId === ownerId && n.token && n.localPort);
-    if (out) return { node: out, forwardPort: out.localPort, forwardToken: out.token, kind: 'outbound' };
+    const direct = nodes.filter((n) => n && n.nodeId === ownerId);
+    if (direct.length > 1) return null;
+    const out = direct.find((n) => n.direction === 'outbound' && n.token && n.localPort);
+    if (out) return { node: out, forwardPort: out.localPort, forwardToken: out.token, kind: 'outbound', route: routed };
+    if (!direct.length && routed) return { node: null, kind: 'routed', route: routed };
     const inbound = nodes.find((n) => n && n.direction === 'inbound'
       && n.shared === true && n.nodeId === ownerId
-      && (n.token || n.acceptToken)
+      && n.token
       && n.askReplyAccess === true && n.eventsAccess === true
       && n.cellVisibility !== 'none');
     if (!inbound) return null;
-    const forwardToken = inbound.token || inbound.acceptToken;
+    const forwardToken = inbound.token;
     const pool = inbound.reversePool;
     const slot = pool && Array.isArray(pool.slots) ? pool.slots[pool.activeSlot] : null;
     if (!slot || !Number.isInteger(slot.port)) {
-      return { node: inbound, forwardPort: null, forwardToken, kind: 'inbound-unverified' };
+      return { node: inbound, forwardPort: null, forwardToken, kind: 'inbound-unverified', route: routed };
     }
-    return { node: inbound, forwardPort: slot.port, forwardToken, kind: 'inbound' };
+    return { node: inbound, forwardPort: slot.port, forwardToken, kind: 'inbound', route: routed };
   }
 
   function ownerUrl(port, path) {
     return `http://127.0.0.1:${port}/federation/route/_/${path.replace(/^\//, '')}`;
   }
 
+  async function forward(candidate, path, { method = 'GET', body, op } = {}) {
+    op.check();
+    const st = loadStore();
+    slotVerifier.sync(st, proofScope);
+    if (candidate.kind === 'inbound' && !candidate.route) {
+      const current = st && (st.nodes || []).find(node => node.name === candidate.node.name);
+      const selected = binding(st, current);
+      if (!selected || selected.fingerprint !== op.proofBinding) {
+        slotVerifier.invalidate(op.proofKey);
+        const error = new Error('reverse slot changed'); error.reason = 'reverse-slot-unverified'; throw error;
+      }
+    }
+    const routed = candidate.route;
+    const url = routed
+      ? `http://127.0.0.1:${localPort()}/api/route/${routed.map(encodeURIComponent).join('/')}/_${path}`
+      : ownerUrl(candidate.forwardPort, path);
+    const headers = routed ? { authorization: `Bearer ${localToken()}` }
+      : { authorization: `Bearer ${candidate.forwardToken}`, 'x-nexuscrew-visited': st && st.nodeId || '' };
+    try {
+      op.check(); op.delivered = true;
+      const r = await op.wait(fetchImpl(url, { method, headers: { ...headers, 'content-type': 'application/json' },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }), signal: op.controller.signal }));
+      op.check();
+      const payload = await op.wait(r.json().catch(error => {
+        if ([403, 404, 501].includes(r.status)) return {};
+        throw error;
+      }));
+      op.check();
+      if (!r.ok) slotVerifier.invalidate(op.proofKey);
+      return { r, body: { ...payload, reason: safeReason(payload && payload.reason) } };
+    } catch (error) { slotVerifier.invalidate(op.proofKey); throw error; }
+  }
+
   // Preflight del canale reverse per un peer inbound: rifiuto NETTO se lo slot
   // non e' verificato (non e' un esito incerto: il forward non e' mai partito).
-  async function verifyInboundChannel(candidate) {
-    const { node, forwardPort } = candidate;
-    const pool = node.reversePool;
-    const slot = pool && Array.isArray(pool.slots) ? pool.slots[pool.activeSlot] : null;
-    const proof = await probeReverseSlotImpl({
-      port: forwardPort, secret: node.token,
-      expected: {
-        remotePort: forwardPort,
-        generation: pool && Number.isInteger(pool.activeGeneration) ? pool.activeGeneration : undefined,
-        instanceId: node.nodeId,
-      },
-    });
-    if (proof && proof.owned === true) return { ok: true };
-    return {
-      ok: false, code: 404,
-      error: 'canale reverse non verificato: risposta non inoltrata',
-      reason: 'reverse-slot-unverified',
-    };
+  async function verifyInboundChannel(candidate, op) {
+    // REST routes prove the slot at their inbound proxy hop, never twice.
+    if (candidate.route) return { ok: true };
+    op.check();
+    const st = loadStore();
+    const proof = await op.wait(slotVerifier.verify({ store: st, peer: candidate.node, loadStore,
+      scope: proofScope, signal: op.controller.signal, probeImpl: probeReverseSlotImpl }));
+    op.check();
+    if (proof && proof.owned === true) {
+      op.proofKey = proof.key;
+      const selected = binding(st, candidate.node);
+      op.proofBinding = selected && selected.fingerprint;
+      return { ok: true };
+    }
+    return { ok: false, code: 404, error: 'canale reverse non verificato: risposta non inoltrata', reason: 'reverse-slot-unverified' };
   }
 
   function attemptKey(ownerId, askId, rid) { return `${ownerId}|${askId}|${rid}`; }
@@ -99,17 +198,17 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     return sent.length ? sent[sent.length - 1].requestId : null;
   }
 
-  async function relayAnswer({ ownerId, askId, text, rid: providedRid } = {}) {
+  async function relayAnswerOnce({ ownerId, askId, text, rid: providedRid } = {}, op) {
     if (!ownerId || !askId || typeof text !== 'string' || !text.trim()) {
       return { ok: false, code: 400, error: 'ownerId, askId e text richiesti' };
     }
-    const candidate = candidateOwner(ownerId);
+    const candidate = await candidateOwner(ownerId, op);
     if (!candidate) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati', reason: 'owner-unknown' };
     if (candidate.kind === 'inbound-unverified') {
       return { ok: false, code: 404, error: 'canale reverse non verificato: risposta non inoltrata', reason: 'reverse-slot-unverified' };
     }
     if (candidate.kind === 'inbound') {
-      const gate = await verifyInboundChannel(candidate);
+      const gate = await verifyInboundChannel(candidate, op);
       if (!gate.ok) return { ok: false, code: gate.code, error: gate.error, reason: gate.reason };
     }
     const peer = candidate.node;
@@ -123,25 +222,22 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
     const rid = providedRid || requestId();
     const key = attemptKey(ownerId, askId, rid);
     const store = loadStore();
-    attempts.set(key, { requestId: rid, state: 'sent', askId, ownerId });
-    const ctrl = new AbortController();
-    const timer = setTimeout(() => ctrl.abort(), IDLE_MS);
+    attempts.set(key, { requestId: rid, state: 'sent', askId, ownerId, digest: crypto.createHash('sha256').update(text).digest('hex') });
     try {
-      const r = await fetchImpl(ownerUrl(candidate.forwardPort, `/event-feed/asks/${askId}/answer`), {
-        method: 'POST',
-        headers: {
-          authorization: `Bearer ${candidate.forwardToken}`,
-          'content-type': 'application/json',
-          'x-nexuscrew-visited': store.nodeId,
-        },
-        body: JSON.stringify({ text, requestId: rid }),
-        signal: ctrl.signal,
+      const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/answer`, {
+        method: 'POST', body: { text, requestId: rid }, op,
       });
-      const body = await r.json().catch(() => ({}));
+      op.check();
       if (r.status === 200) {
-        const state = body.status === 'answered' ? 'committed' : body.status || 'committed';
+        const state = body.status === 'answered' ? 'committed' : body.status;
+        if (!['committed', 'failed'].includes(state)) {
+          attempts.get(key).state = 'uncertain';
+          return { ok: false, code: 200, uncertain: true, requestId: rid, reason: 'delivery-unknown' };
+        }
         attempts.get(key).state = body.replay ? (body.state || state) : state;
-        return { ok: true, status: attempts.get(key).state, requestId: rid };
+        return { ok: true, status: attempts.get(key).state, requestId: rid,
+          ...(body.ownerId ? { ownerId: body.ownerId } : {}), ...(body.askId ? { askId: body.askId } : {}),
+          ...(body.actor ? { actor: body.actor } : {}), ...(body.receipt ? { receipt: body.receipt } : {}) };
       }
       const entry = attempts.get(key);
       // 409 request-conflict / answering are definitive; anything else that
@@ -155,7 +251,7 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
             originalRequestId: originalSentRequestId(ownerId, askId, rid), requestId: rid,
             error: 'esito incerto: bloccato da un invio precedente' };
         }
-        return { ok: false, code: 409, error: body.error || 'conflict', reason: body.reason };
+        return { ok: false, code: 409, error: 'conflict', reason: body.reason };
       }
       if (r.status === 502) {
         if (entry) entry.state = 'uncertain';
@@ -163,75 +259,116 @@ function createAskRelay({ loadStore, now = Date.now, fetchImpl = fetch, log = ()
           error: 'esito incerto: verifica lo stato prima di rispondere' };
       }
       if (entry) entry.state = 'failed';
-      return { ok: false, code: r.status, error: body.error || `HTTP ${r.status}`, reason: body.reason };
-    } catch (_) {
+      return { ok: false, code: r.status, error: `HTTP ${r.status}`, reason: body.reason };
+    } catch (error) {
+      if (!op.active()) return deadlineResult(op, { ownerId, askId, rid }, false);
+      if (!op.delivered) {
+        const entry = attempts.get(key); if (entry) entry.state = 'failed';
+        return { ok: false, code: 404, reason: error.reason || 'reverse-slot-unverified', error: 'risposta non inoltrata' };
+      }
       // The request may or may not have pasted: uncertain, never retried.
       const entry = attempts.get(key);
       if (entry) entry.state = 'uncertain';
       return { ok: false, code: 200, uncertain: true, reason: 'delivery-unknown', requestId: rid,
         error: 'esito incerto: verifica lo stato prima di rispondere' };
-    } finally {
-      clearTimeout(timer);
     }
   }
 
+  async function relayAnswer(args = {}) {
+    const rid = args.rid || requestId();
+    const key = attemptKey(args.ownerId, args.askId, rid);
+    const old = attempts.get(key);
+    const digest = crypto.createHash('sha256').update(String(args.text || '')).digest('hex');
+    if (old && old.digest !== digest) return { ok: false, code: 409, reason: 'request-conflict', error: 'stesso requestId con testo diverso' };
+    const pending = answerFlights.get(key);
+    if (pending && pending.digest !== digest) return { ok: false, code: 409, reason: 'request-conflict', error: 'stesso requestId con testo diverso' };
+    if (pending) return pending.promise;
+    const flight = operation({ ...args, rid }, op => relayAnswerOnce({ ...args, rid }, op), false, true);
+    const slot = { promise: flight, digest };
+    answerFlights.set(key, slot);
+    try { return await flight; } finally { if (answerFlights.get(key) === slot) answerFlights.delete(key); }
+  }
+
   // Remote dismiss: same resolution rules as the answer (DELETE on the owner).
-  async function relayDismiss({ ownerId, askId } = {}) {
-    const candidate = candidateOwner(ownerId);
+  async function relayDismissOnce({ ownerId, askId } = {}, op) {
+    const candidate = await candidateOwner(ownerId, op);
     if (!candidate) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati', reason: 'owner-unknown' };
     if (candidate.kind === 'inbound-unverified') {
       return { ok: false, code: 404, error: 'canale reverse non verificato: risposta non inoltrata', reason: 'reverse-slot-unverified' };
     }
     if (candidate.kind === 'inbound') {
-      const gate = await verifyInboundChannel(candidate);
+      const gate = await verifyInboundChannel(candidate, op);
       if (!gate.ok) return { ok: false, code: gate.code, error: gate.error, reason: gate.reason };
     }
     const peer = candidate.node;
     const store = loadStore();
     try {
-      const r = await fetchImpl(ownerUrl(candidate.forwardPort, `/event-feed/asks/${askId}`), {
-        method: 'DELETE',
-        headers: { authorization: `Bearer ${candidate.forwardToken}`, 'x-nexuscrew-visited': store ? store.nodeId : '' },
-      });
-      const body = await r.json().catch(() => ({}));
-      if (!r.ok) return { ok: false, code: r.status, error: body.error || `HTTP ${r.status}` };
+      const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}`, { method: 'DELETE', op });
+      if (!r.ok) return { ok: false, code: r.status, error: 'owner refused', reason: body.reason };
       return { ok: true };
-    } catch (e) { return { ok: false, error: String((e && e.message) || e) }; }
+    } catch (e) { if (!op.active()) return deadlineResult(op, { ownerId, askId }, false); return { ok: false, code: 502, reason: safeReason(e.reason), error: 'owner unreachable' }; }
   }
 
-  async function verifyStatus({ ownerId, askId, requestId: rid }) {
-    const candidate = candidateOwner(ownerId);
+  async function verifyStatusOnce({ ownerId, askId, requestId: rid }, op) {
+    const candidate = await candidateOwner(ownerId, op);
     if (!candidate) return { ok: false, code: 404, error: 'owner non tra i peer autorizzati', reason: 'owner-unknown' };
     if (candidate.kind === 'inbound-unverified') {
       return { ok: false, code: 404, error: 'canale reverse non verificato: risposta non inoltrata', reason: 'reverse-slot-unverified' };
     }
     if (candidate.kind === 'inbound') {
-      const gate = await verifyInboundChannel(candidate);
+      const gate = await verifyInboundChannel(candidate, op);
       if (!gate.ok) return { ok: false, code: gate.code, error: gate.error, reason: gate.reason };
     }
     const peer = candidate.node;
     const store = loadStore();
     try {
-      const r = await fetchImpl(ownerUrl(candidate.forwardPort, `/event-feed/asks/${askId}/requests/${rid}`), {
-        headers: { authorization: `Bearer ${candidate.forwardToken}`, 'x-nexuscrew-visited': store ? store.nodeId : '' },
-      });
-      if (!r.ok) return { ok: false, code: r.status };
-      const body = await r.json();
+      const { r, body } = await forward(candidate,
+        `/event-feed/asks/${encodeURIComponent(askId)}/requests/${encodeURIComponent(rid)}`, { op });
+      if (!r.ok) return { ok: false, code: r.status, reason: body.reason, error: 'owner refused' };
+      op.check();
       const key = attemptKey(ownerId, askId, rid);
       if (attempts.has(key) && (body.state === 'committed' || body.state === 'failed')) {
         attempts.get(key).state = body.state;
       }
-      return { ok: true, state: body.state || 'unknown' };
+      return { ok: true, state: body.state || 'unknown',
+        ...(body.ownerId ? { ownerId: body.ownerId } : {}), ...(body.askId ? { askId: body.askId } : {}),
+        ...(body.actor ? { actor: body.actor } : {}), ...(body.receipt ? { receipt: body.receipt } : {}) };
     } catch (e) {
-      return { ok: false, error: String((e && e.message) || e) };
+      if (!op.active()) return deadlineResult(op, { ownerId, askId }, false);
+      return { ok: false, code: 502, reason: safeReason(e.reason), error: 'owner unreachable' };
+    }
+  }
+
+  async function replyCapabilityOnce({ ownerId, askId } = {}, op) {
+    const denied = (status, reason) => ({ ownerId, askId, canReply: false, status, ...(reason ? { reason } : {}) });
+    const candidate = await candidateOwner(ownerId, op);
+    if (!candidate) return denied('unreachable', 'owner-unknown');
+    if (candidate.kind === 'inbound-unverified') return denied('unreachable', 'reverse-slot-unverified');
+    if (candidate.kind === 'inbound') {
+      const gate = await verifyInboundChannel(candidate, op);
+      if (!gate.ok) return denied('unreachable', gate.reason);
     }
+    try {
+      const { r, body } = await forward(candidate, `/event-feed/asks/${encodeURIComponent(askId)}/capability`, { op });
+      if (body.reason === 'reverse-slot-unverified') return denied('unreachable', body.reason);
+      if (r.status === 404 || r.status === 501) return denied('unsupported', body.reason);
+      if (r.status === 403) return denied('denied', body.reason);
+      if (!r.ok || body.ownerId !== ownerId || body.askId !== askId || typeof body.canReply !== 'boolean'
+        || !['open', 'denied', 'answered', 'dismissed'].includes(body.status)
+        || (body.canReply && body.status !== 'open')) return denied('unreachable');
+      return { ownerId, askId, canReply: body.canReply, status: body.status };
+    } catch (_) { return denied('unreachable', op.active() ? undefined : 'relay-deadline'); }
   }
 
+  function relayDismiss(args = {}) { return operation(args, op => relayDismissOnce(args, op)); }
+  function verifyStatus(args = {}) { return operation(args, op => verifyStatusOnce(args, op)); }
+  function replyCapability(args = {}) { return operation(args, op => replyCapabilityOnce(args, op), true); }
+
   function state() {
     return [...attempts.entries()].map(([key, a]) => ({ key, ...a }));
   }
 
-  return { relayAnswer, relayDismiss, verifyStatus, state, isUncertain, requestId };
+  return { relayAnswer, relayDismiss, verifyStatus, replyCapability, state, isUncertain, requestId };
 }
 
 module.exports = { createAskRelay };

package/lib/notify/event-feed-asks-routes.js

@@ -5,46 +5,81 @@
 //   DELETE /event-feed/asks/:id                                    (dismiss)
 //   GET    /event-feed/asks/:id/requests/:requestId               (attempt status)
 //
-// The gate is the SAME as the stream/snapshot gate (kill-switch -> proven
-// federated origin -> exact [clientId, ownerId] -> known peer -> eventsAccess)
-// PLUS askReplyAccess plus the ask's own cell scope read from the ask store.
+// The action gate verifies the bounded origin chain and the delivering peer,
+// then intersects fresh ASK grants and the authoritative ask cell scope.
+// It is independent of the stream/snapshot gate and local feed reception.
 // Unknown and out-of-scope ids get the SAME opaque 404: an id that does not
 // exist and an id the peer may not see must be indistinguishable. Answer and
 // dismiss run on a DEDICATED budget (6/min/peer, 30/min global) that shares
 // nothing with notify/audio/local ask creation.
 
 const express = require('express');
-const { createFeedGate } = require('./event-feed-routes.js');
+const nodesStore = require('../nodes/store.js');
+const accessPresets = require('../nodes/access-presets.js');
+const { createAudioAcl } = require('../audio/acl.js');
+const { visibilityAllows } = require('./event-feed-acl.js');
 
 const ANSWER_RATE_PER_MIN = 6;
 const ANSWER_GLOBAL_PER_MIN = 30;
 
 function createAskRateLimiter({ now = Date.now } = {}) {
   const perPeer = new Map();
+  const perOrigin = new Map();
   const global = [];
   function prune(list, t) {
     const cutoff = t - 60000;
     while (list.length > 0 && list[0] <= cutoff) list.shift();
   }
-  function check(peerId) {
+  function check(peerId, actorId = peerId) {
     const t = now();
     const list = perPeer.get(peerId) || [];
-    prune(list, t); prune(global, t);
-    if (list.length >= ANSWER_RATE_PER_MIN || global.length >= ANSWER_GLOBAL_PER_MIN) {
+    const origin = perOrigin.get(actorId) || [];
+    prune(list, t); prune(origin, t); prune(global, t);
+    if (list.length >= ANSWER_RATE_PER_MIN || origin.length >= ANSWER_RATE_PER_MIN || global.length >= ANSWER_GLOBAL_PER_MIN) {
       return { allowed: false, reason: 'answer-rate' };
     }
-    list.push(t); perPeer.set(peerId, list); global.push(t);
+    list.push(t); perPeer.set(peerId, list); origin.push(t); perOrigin.set(actorId, origin); global.push(t);
     return { allowed: true };
   }
   return { check };
 }
 
+function createAskActionGate(deps) {
+  return async (req, res) => {
+    const refuse = (code, reason) => { res.status(code).json({ error: 'forbidden', reason }); return null; };
+    if (deps.eventsEnabled() !== true) return refuse(403, 'events-disabled');
+    const resolved = await deps.originResolver.resolve(req, { requireCell: false });
+    if (!resolved.ok) return refuse(403, resolved.reason);
+    if (resolved.trust !== 'federated') return refuse(403, 'federated-origin-required');
+    const visited = resolved.visited || [];
+    const self = deps.localNodeId();
+    if (visited.length < 2 || visited.at(-1) !== self) return refuse(403, 'hop-chain');
+    const st = nodesStore.loadStore(deps.nodesPath);
+    if (!st) return refuse(503, 'store-unavailable');
+    const deliveringId = visited.at(-2);
+    const delivering = (st.nodes || []).filter((n) => n && n.nodeId === deliveringId);
+    if (delivering.length !== 1) return refuse(403, 'peer-unknown');
+    const acl = createAudioAcl({ nodesPath: deps.nodesPath, loadStoreImpl: () => st });
+    const visibility = acl.allows(resolved);
+    if (!visibility.allowed) return refuse(403, visibility.reason);
+    const actor = resolved.origin.node;
+    const origins = actor === deliveringId ? [] : (st.nodes || []).filter((n) => n && n.nodeId === actor);
+    if (origins.length > 1) return refuse(403, 'peer-unknown');
+    const grants = [delivering[0], ...origins].map((node) => accessPresets.grantsOf(node));
+    if (grants.some((view) => !view.configured || view.grants.eventsAccess !== true || view.grants.askReplyAccess !== true)) {
+      return refuse(403, 'grant-required:ask-action');
+    }
+    return { self, actor, peer: { nodeId: deliveringId, grants: grants[0].grants,
+      allows: ({ cellId }) => grants.every((view) => visibilityAllows(view.grants, cellId)) } };
+  };
+}
+
 function createEventFeedAsksRoutes(deps) {
   const r = express.Router();
   const json = express.json({ limit: '16kb' });
   // deps: { nodesPath, localNodeId, originResolver, eventsEnabled, asks,
   //         answerService, cellForSession, log }
-  const gate = createFeedGate(deps);
+  const gate = createAskActionGate(deps);
   const rate = createAskRateLimiter({ now: deps.now });
   const log = typeof deps.log === 'function' ? deps.log : () => {};
 
@@ -59,10 +94,21 @@ function createEventFeedAsksRoutes(deps) {
     return { ask, cellId };
   }
 
+  r.get('/:id/capability', async (req, res) => {
+    const g = await gate(req, res);
+    if (!g) return;
+    const askId = String(req.params.id || '');
+    const resolved = resolveAskForPeer(g.peer, askId);
+    const readonly = deps.readonly && deps.readonly();
+    const status = !resolved || readonly ? 'denied'
+      : resolved.ask.dismissed ? 'dismissed' : resolved.ask.answered ? 'answered' : 'open';
+    return res.json({ ownerId: g.self, askId, canReply: status === 'open', status });
+  });
+
   r.post('/:id/answer', json, async (req, res) => {
     const g = await gate(req, res);
     if (!g) return;
-    const verdict = rate.check(g.peer.nodeId);
+    const verdict = rate.check(g.peer.nodeId, g.actor);
     if (!verdict.allowed) return res.status(429).json({ error: 'answer rate', reason: verdict.reason });
     if (deps.readonly && deps.readonly()) {
       return res.status(403).json({ error: 'READONLY: mutazione bloccata' });
@@ -85,13 +131,14 @@ function createEventFeedAsksRoutes(deps) {
     const resolved = resolveAskForPeer(g.peer, askId);
     if (!resolved) return res.status(404).json({ error: 'ask inesistente' });
     const out = await deps.answerService.answerFederated({
-      askId, text: body.text, peerId: g.peer.nodeId, requestId: body.requestId,
+      askId, text: body.text, peerId: g.actor, requestId: body.requestId,
     });
     if (out.ok) {
       // La chiusura nasce dal servizio; qui si aspetta il recapito, cosi' chi ha
       // risposto non vede una risposta che precede la chiusura dei peer.
       if (out.closure) { try { await out.closure; } catch (_) {} }
-      return res.json({ status: out.replay ? out.state : 'committed', requestId: body.requestId });
+      return res.json({ status: out.replay ? out.state : 'committed', requestId: body.requestId,
+        ownerId: g.self, askId, actor: g.actor });
     }
     return res.status(out.code || 500).json({ error: out.error, reason: out.reason });
   });
@@ -99,7 +146,7 @@ function createEventFeedAsksRoutes(deps) {
   r.delete('/:id', async (req, res) => {
     const g = await gate(req, res);
     if (!g) return;
-    const verdict = rate.check(g.peer.nodeId);
+    const verdict = rate.check(g.peer.nodeId, g.actor);
     if (!verdict.allowed) return res.status(429).json({ error: 'answer rate', reason: verdict.reason });
     if (deps.readonly && deps.readonly()) {
       return res.status(403).json({ error: 'READONLY: mutazione bloccata' });
@@ -133,10 +180,10 @@ function createEventFeedAsksRoutes(deps) {
     if (!resolved) return res.status(404).json({ error: 'ask inesistente' });
     // Scoped: a peer sees ONLY its own attempts, and never the answer text of
     // anyone — the receipt carries a digest, not a payload.
-    const entry = deps.receipts.get(g.peer.nodeId, askId, requestId);
+    const entry = deps.receipts.get(g.actor, askId, requestId);
     if (!entry) return res.status(404).json({ error: 'ask inesistente' });
     return res.json({
-      requestId, askId, state: entry.state,
+      requestId, askId, ownerId: g.self, actor: g.actor, state: entry.state,
       ...(entry.receipt ? { receipt: entry.receipt } : {}),
       ...(entry.updatedAt ? { updatedAt: entry.updatedAt } : {}),
     });