@mmmbuto/nexuscrew 0.9.64 → 0.9.66

package/lib/notify/notice-dismissals.js

@@ -0,0 +1,178 @@
+'use strict';
+// lib/notify/notice-dismissals.js — durable set of the notices THIS node cleared.
+//
+// The owner is the source of truth for its own notices, so the dismissal lives
+// here too: the snapshot it serves stops carrying the entry, and every device
+// that reads that snapshot stops seeing it. The file holds ids and timestamps
+// and nothing else — never a title, never a body — and it expires exactly with
+// the history it filters (MAX_MS == event-feed-history.js MAX_MS): dismissing an
+// entry that is no longer anywhere means nothing.
+//
+// Bounds and failure policy mirror the history: schema/size validation on load,
+// prune of expired entries on load and on every write, caps on count AND bytes,
+// atomic tmp+rename 0600. A disk failure degrades the store and is DECLARED in
+// status(); it never throws into the caller, because a local dismissal is an
+// operator intent and losing it silently would resurrect the card.
+//
+// The flush is SYNCHRONOUS on purpose. event-feed-history.js serializes its
+// writes on a promise chain because its flush is async; here the write is
+// writeFileSync+renameSync inside the mutation, so there is no interleaving to
+// serialize and no window in which a 200 has answered before the entry is
+// durable — which is the whole point of answering 200 to the peer.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const MAX_ENTRIES = 200;
+const MAX_BYTES = 64 * 1024;
+const MAX_MS = 15 * 60 * 1000;
+const SCHEMA = 'nexuscrew-notice-dismissals-v1';
+
+function createNoticeDismissals({ filePath, now = Date.now, limits = {} }) {
+  const maxEntries = limits.maxEntries || MAX_ENTRIES;
+  const maxBytes = limits.maxBytes || MAX_BYTES;
+  const maxMs = limits.maxMs || MAX_MS;
+
+  let cache = null;       // validated entries, oldest first
+  let degraded = null;    // null | reason string
+
+  function validateList(raw) {
+    if (!Array.isArray(raw)) return null;
+    const out = [];
+    for (const entry of raw) {
+      if (!entry || typeof entry !== 'object') return null;
+      if (typeof entry.eventId !== 'string' || entry.eventId.length === 0) return null;
+      if (typeof entry.at !== 'number' || !Number.isFinite(entry.at)) return null;
+      out.push({ eventId: entry.eventId, at: entry.at });
+    }
+    return out;
+  }
+
+  function prune(entries, t) {
+    const cutoff = t - maxMs;
+    let out = entries.filter((e) => e.at >= cutoff);
+    if (out.length > maxEntries) out = out.slice(out.length - maxEntries);
+    return out;
+  }
+
+  function load() {
+    if (cache) return cache;
+    let raw;
+    try {
+      raw = fs.readFileSync(filePath, 'utf8');
+    } catch (e) {
+      // A missing file is a fresh install, not a degradation; any other read
+      // failure is declared, because an unreadable store must not look empty.
+      degraded = e && e.code === 'ENOENT' ? degraded : 'dismissals-read-failed';
+      cache = [];
+      return cache;
+    }
+    // A file wildly larger than the cap is not parsed at all: it cannot be
+    // trusted and reading it is the only cost that grows without bound.
+    if (Buffer.byteLength(raw, 'utf8') > maxBytes * 4) {
+      degraded = 'dismissals-oversize';
+      cache = [];
+      return cache;
+    }
+    let parsed = null;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (_) {
+      degraded = 'dismissals-schema';
+      cache = [];
+      return cache;
+    }
+    const entries = parsed && parsed.schema === SCHEMA ? validateList(parsed.entries) : null;
+    if (!entries) { degraded = 'dismissals-schema'; cache = []; return cache; }
+    cache = prune(entries, now());
+    return cache;
+  }
+
+  function serialize(entries) {
+    return JSON.stringify({ schema: SCHEMA, savedAt: now(), entries });
+  }
+
+  // Returns { ok: true } when the candidate list reached the disk, or
+  // { ok: false, reason } when it could not — in which case the previous state
+  // stays authoritative in memory and on disk.
+  function persist(entries) {
+    let body;
+    try {
+      body = serialize(entries);
+    } catch (_) {
+      degraded = 'dismissals-write-failed';
+      return { ok: false, reason: 'write-failed' };
+    }
+    if (Buffer.byteLength(body, 'utf8') > maxBytes) {
+      degraded = 'dismissals-oversize';
+      return { ok: false, reason: 'oversize' };
+    }
+    try {
+      const dir = path.dirname(filePath);
+      fs.mkdirSync(dir, { recursive: true });
+      const tmp = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+      fs.writeFileSync(tmp, body, { mode: 0o600 });
+      fs.renameSync(tmp, filePath);
+    } catch (_) {
+      degraded = 'dismissals-write-failed';
+      return { ok: false, reason: 'write-failed' };
+    }
+    return { ok: true };
+  }
+
+  function isDismissed(eventId) {
+    if (typeof eventId !== 'string' || eventId.length === 0) return false;
+    const entries = load();
+    pruneInPlace(entries);
+    return entries.some((e) => e.eventId === eventId);
+  }
+
+  // Expiry is applied on every read too: a long-lived process must not answer
+  // from a snapshot of the file taken before the entries expired.
+  function pruneInPlace(entries) {
+    const live = prune(entries, now());
+    if (live.length === entries.length && live.every((e, i) => e === entries[i])) return entries;
+    cache = live;
+    return cache;
+  }
+
+  function dismiss(eventId) {
+    const entries = load();
+    const current = pruneInPlace(entries);
+    if (current.some((e) => e.eventId === eventId)) {
+      return { ok: true, idempotent: true };
+    }
+    const candidate = prune([...current, { eventId, at: now() }], now());
+    // Byte cap: drop the oldest until it fits, so a full store keeps accepting
+    // new dismissals instead of refusing them for a stale tail.
+    let fitted = candidate;
+    while (fitted.length > 1 && Buffer.byteLength(serialize(fitted), 'utf8') > maxBytes) {
+      fitted = fitted.slice(1);
+    }
+    const written = persist(fitted);
+    if (!written.ok && written.reason === 'oversize') {
+      // The list cannot be represented at all: no partial truth, the caller is
+      // told and the previous state stays authoritative on both sides.
+      return written;
+    }
+    // A failed WRITE is different from an unrepresentable list: the operator
+    // asked for this notice to be cleared, so the owner honours it in every view
+    // it serves from now on (memory is authoritative in-process, exactly like
+    // the history) and declares the lost durability in status(). The window is
+    // bounded by the retention TTL: the entry and the notice it filters expire
+    // together.
+    cache = fitted;
+    return { ok: true, idempotent: false };
+  }
+
+  function list() { return pruneInPlace(load()).map((e) => ({ ...e })); }
+
+  function status() {
+    const entries = pruneInPlace(load());
+    return { degraded: degraded || null, count: entries.length };
+  }
+
+  return { isDismissed, dismiss, list, status };
+}
+
+module.exports = { createNoticeDismissals, MAX_ENTRIES, MAX_BYTES, MAX_MS, SCHEMA };

package/lib/notify/notice-relay.js

@@ -0,0 +1,128 @@
+'use strict';
+// lib/notify/notice-relay.js — the client-side relay that carries a notice
+// dismissal to the node that OWNS the notice.
+//
+// The channel (resolution from the authorized store, deadline, hop proof) is the
+// shared one the ask answers use (./owner-channel.js): this module adds only what
+// is specific to notices — the two routes it calls and the outcome contract:
+//
+//   DELETE /event-feed/notices/<eventId>     one notice
+//   POST   /event-feed/notices/dismiss-all   the whole visible set
+//
+//   2xx            → cleared (idempotent when the owner says so)
+//   404 (no route) → the owner does not have this surface at all: `unsupported`,
+//                    declared, never retried in a loop
+//   404 otherwise  → the notice is already gone (expired): the GOAL is reached,
+//                    so it counts as confirmed — never as a failure to retry
+
+const { createOwnerChannel } = require('./owner-channel.js');
+
+const OWNER_ID_RE = /^[a-f0-9]{32}$/;
+const EVENT_ID_RE = /^[0-9a-f-]{36}$/;
+const RELAY_DEADLINE_MS = 8000;
+
+const OWNER_REASONS = new Set([
+  'reverse-slot-unverified', 'peer-unknown', 'events-disabled', 'grant-required:ask-action',
+  'peer-visibility', 'origin-visibility', 'federated-origin-required', 'hop-chain',
+  'store-unavailable', 'unknown-peer', 'unknown-trust', 'no-delivering-peer',
+  'no-node-identity', 'bad-visited', 'bad-hop', 'self-hop', 'origin-mismatch',
+  'notify-unknown', 'dismissals-unavailable', 'unsupported', 'dismiss-rate',
+  'resource-not-classified', 'owner-unknown', 'federation-peer-unreachable',
+  'federation-peer-timeout', 'federation-body-consumed', 'owner-unreachable',
+]);
+function safeReason(reason) { return OWNER_REASONS.has(reason) ? reason : undefined; }
+
+// Reasons that mean "the owner is not reachable NOW": the caller queues the
+// intent and its drainer retries. Everything else is a decision.
+const TRANSIENT_REASONS = new Set([
+  'relay-deadline', 'owner-unreachable', 'unknown', 'reverse-slot-unverified',
+  'federation-peer-unreachable', 'federation-peer-timeout', 'federation-body-consumed',
+]);
+
+function createNoticeRelay({
+  loadStore, now = Date.now, fetchImpl = fetch, log = () => {},
+  probeReverseSlotImpl = null, peers = null, localPort = () => 0, localToken = () => '',
+  nodesPath = null, slotVerifier = undefined, deadlineMs = RELAY_DEADLINE_MS,
+} = {}) {
+  const channel = createOwnerChannel({
+    loadStore, now, fetchImpl, peers, localPort, localToken, nodesPath, deadlineMs,
+    sanitizeReason: safeReason,
+    ...(probeReverseSlotImpl ? { probeReverseSlotImpl } : {}),
+    ...(slotVerifier ? { slotVerifier } : {}),
+  });
+
+  // Same resolution as an ask answer: an outbound peer, a shared inbound peer
+  // with a proven reverse slot, or a route of the authorized inventory.
+  async function resolve(ownerId, op) {
+    const candidate = await channel.candidateOwner(ownerId, op);
+    if (!candidate) return { error: { ok: false, code: 404, reason: 'owner-unknown', error: 'owner non tra i peer autorizzati' } };
+    if (candidate.kind === 'inbound-unverified') {
+      return { error: { ok: false, code: 404, reason: 'reverse-slot-unverified', error: 'canale reverse non verificato: scarto non inoltrato' } };
+    }
+    if (candidate.kind === 'inbound') {
+      const gate = await channel.verifyInboundChannel(candidate, op);
+      if (!gate.ok) return { error: { ok: false, code: gate.code, reason: gate.reason, error: gate.error } };
+    }
+    return { candidate };
+  }
+
+  function transient(reason, code) {
+    return TRANSIENT_REASONS.has(reason) || code === 408 || code === 429 || (typeof code === 'number' && code >= 500);
+  }
+
+  async function dismissOnce({ ownerId, eventId }, op) {
+    if (!OWNER_ID_RE.test(String(ownerId || ''))) return { ok: false, code: 400, error: 'ownerId non valido' };
+    if (!EVENT_ID_RE.test(String(eventId || ''))) return { ok: false, code: 400, error: 'eventId non valido' };
+    const resolved = await resolve(ownerId, op);
+    if (resolved.error) return resolved.error;
+    const { r, body } = await channel.forward(resolved.candidate, `/event-feed/notices/${encodeURIComponent(eventId)}`, { method: 'DELETE', op });
+    if (r.status === 200) return { ok: true, code: 200, ownerId, idempotent: body.idempotent === true };
+    if (r.status === 404 && body.reason === 'resource-not-classified') return { ok: false, code: 404, reason: 'unsupported', error: 'owner senza la superficie di scarto' };
+    // The entry expired on the owner: the dismissal is ALREADY true there.
+    if (r.status === 404) return { ok: true, code: 404, ownerId, gone: true };
+    const reason = body.reason || (r.status === 403 ? 'grant-required:ask-action' : 'unknown');
+    return { ok: false, code: r.status, ownerId, reason: safeReason(reason) || 'unknown', error: body.error || `HTTP ${r.status}`,
+      retryAfterMs: retryAfterMs(r, now), transient: transient(reason, r.status) };
+  }
+
+  async function dismissAllOnce({ ownerId }, op) {
+    if (!OWNER_ID_RE.test(String(ownerId || ''))) return { ok: false, code: 400, error: 'ownerId non valido' };
+    const resolved = await resolve(ownerId, op);
+    if (resolved.error) return resolved.error;
+    const { r, body } = await channel.forward(resolved.candidate, '/event-feed/notices/dismiss-all', { method: 'POST', body: {}, op });
+    if (r.status === 200) {
+      return { ok: true, code: 200, ownerId, dismissed: Number.isSafeInteger(body.dismissed) ? body.dismissed : 0 };
+    }
+    if (r.status === 404 && body.reason === 'resource-not-classified') return { ok: false, code: 404, reason: 'unsupported', error: 'owner senza la superficie di scarto' };
+    if (r.status === 404) return { ok: true, code: 404, ownerId, gone: true, dismissed: 0 };
+    const reason = body.reason || (r.status === 403 ? 'grant-required:ask-action' : 'unknown');
+    return { ok: false, code: r.status, ownerId, reason: safeReason(reason) || 'unknown', error: body.error || `HTTP ${r.status}`,
+      retryAfterMs: retryAfterMs(r, now), transient: transient(reason, r.status) };
+  }
+
+  function retryAfterMs(response, clock) {
+    const value = response.headers?.get?.('retry-after');
+    if (typeof value !== 'string') return 0;
+    const seconds = /^\d+(?:\.\d+)?$/.test(value.trim()) ? Number(value) : null;
+    const delay = seconds === null ? Date.parse(value) - clock() : seconds * 1000;
+    return Number.isFinite(delay) && delay > 0 ? delay : 0;
+  }
+
+  // Every failure carries the classification ONCE, here: `transient` is what the
+  // queue reads to decide between "retry later" and "declare it and stop"
+  // (a refusal or an owner without the surface is a decision, not an outage).
+  function classified(out) {
+    if (!out || out.ok === true || out.transient !== undefined) return out;
+    return { ...out, transient: transient(out.reason, out.code) };
+  }
+
+  async function relayNoticeDismiss(args = {}) {
+    return classified(await channel.operation(args, (op) => dismissOnce(args, op)));
+  }
+  async function relayNoticeDismissAll(args = {}) {
+    return classified(await channel.operation(args, (op) => dismissAllOnce(args, op)));
+  }
+  return { relayNoticeDismiss, relayNoticeDismissAll };
+}
+
+module.exports = { createNoticeRelay, TRANSIENT_REASONS, OWNER_ID_RE, EVENT_ID_RE };

package/lib/notify/owner-channel.js

@@ -0,0 +1,172 @@
+'use strict';
+// lib/notify/owner-channel.js — the channel to an OWNER node, resolved from the
+// authorized store and never from anything an event said.
+//
+// Extracted from ask-relay.js so the ask answers and the notice dismissals share
+// ONE implementation of the same three things: which peer carries the request
+// (direct outbound, shared inbound with a proven reverse slot, or a route from
+// the authorized inventory), the forwarding with its deadline and typed
+// outcomes, and the hop proof. Two copies of this would drift, and a drifted
+// chain rule is a security bug, not a duplication smell.
+
+const { NODE_NAME_RE } = require('../nodes/store.js');
+const { probeReverseSlot } = require('../nodes/reverse-slot-proof.js');
+const { askSlotVerifier, binding } = require('../nodes/ask-slot-verifier.js');
+
+const RELAY_DEADLINE_MS = 8000;
+
+function createOwnerChannel({
+  loadStore, now = Date.now, fetchImpl = fetch,
+  probeReverseSlotImpl = probeReverseSlot, peers = null,
+  localPort = () => 0, localToken = () => '', nodesPath = null,
+  slotVerifier = askSlotVerifier, deadlineMs = RELAY_DEADLINE_MS,
+  // Caller-owned hook: what to do when a request that may have travelled dies
+  // with the deadline (the ask relay parks the attempt as uncertain).
+  onUncertain = null,
+  // Callers surface `body.reason` to their own API: each one keeps its own
+  // allowlist, so an arbitrary string from the owner never travels upward.
+  sanitizeReason = (reason) => reason,
+} = {}) {
+  const proofScope = nodesPath || loadStore;
+
+  function deadlineResult(op, args, capability) {
+    if (capability) return { ownerId: args.ownerId, askId: args.askId, canReply: false, status: 'unreachable', reason: 'relay-deadline' };
+    if (op.answer && op.delivered && args.rid) {
+      return { ok: false, code: 200, uncertain: true, requestId: args.rid, reason: 'delivery-unknown', error: 'esito incerto: verifica lo stato prima di rispondere' };
+    }
+    return { ok: false, code: 504, reason: 'relay-deadline', error: 'relay deadline' };
+  }
+
+  // One request, one deadline. The work function receives `op` and must call
+  // op.check()/op.wait() so an expired deadline aborts the travel instead of
+  // leaving a request in flight with nobody to collect it.
+  async function operation(args, work, capability = false, answer = false) {
+    const controller = new AbortController();
+    const op = { controller, answer, delivered: false, expired: false, proofKey: null, proofBinding: null };
+    let rejectAbort;
+    const aborted = new Promise((_resolve, reject) => { rejectAbort = () => reject(new Error('relay deadline')); });
+    controller.signal.addEventListener('abort', rejectAbort, { once: true });
+    op.active = () => !controller.signal.aborted;
+    op.check = () => { if (!op.active()) throw new Error('relay deadline'); };
+    op.wait = promise => Promise.race([promise, aborted]);
+    const timer = setTimeout(() => { op.expired = true; controller.abort(); }, deadlineMs);
+    try { return await Promise.race([Promise.resolve().then(() => work(op)), aborted]); }
+    catch (_) {
+      slotVerifier.invalidate(op.proofKey);
+      if (op.answer && op.delivered && args.rid && typeof onUncertain === 'function') onUncertain(args);
+      if (op.expired) return deadlineResult(op, args, capability);
+      return capability
+        ? { ownerId: args.ownerId, askId: args.askId, canReply: false, status: 'unreachable' }
+        : { ok: false, code: 502, error: 'owner unreachable' };
+    } finally {
+      clearTimeout(timer); controller.signal.removeEventListener('abort', rejectAbort); controller.abort();
+    }
+  }
+
+  // Owner resolution: an OUTBOUND peer (its own channel, as always) or a shared
+  // INBOUND peer with the events+reply grants and an active reverse slot. For
+  // inbound peers the slot port MUST be proven with the same probe the terminals
+  // use: no fallback on localPort without proof.
+  async function candidateOwner(ownerId, op) {
+    let store = loadStore();
+    if (!store) return null;
+    let routed = null;
+    if (typeof peers === 'function') {
+      let inventory;
+      try { inventory = await op.wait(peers()); } catch (_) { op.check(); return null; }
+      op.check();
+      const matches = (Array.isArray(inventory) ? inventory : [])
+        .filter((p) => p && (p.nodeId === ownerId || p.instanceId === ownerId));
+      if (matches.length !== 1 || matches[0].stale === true) return null;
+      const route = matches[0].route;
+      if (!Array.isArray(route) || !route.length || route.length > 4
+        || route.some((name) => typeof name !== 'string' || !NODE_NAME_RE.test(name))
+        || new Set(route).size !== route.length) return null;
+      routed = [...route];
+    }
+    op.check();
+    store = loadStore();
+    if (!store) return null;
+    slotVerifier.sync(store, proofScope);
+    const nodes = store.nodes || [];
+    const direct = nodes.filter((n) => n && n.nodeId === ownerId);
+    if (direct.length > 1) return null;
+    const out = direct.find((n) => n.direction === 'outbound' && n.token && n.localPort);
+    if (out) return { node: out, forwardPort: out.localPort, forwardToken: out.token, kind: 'outbound', route: routed };
+    if (!direct.length && routed) return { node: null, kind: 'routed', route: routed };
+    const inbound = nodes.find((n) => n && n.direction === 'inbound'
+      && n.shared === true && n.nodeId === ownerId
+      && n.token
+      && n.askReplyAccess === true && n.eventsAccess === true
+      && n.cellVisibility !== 'none');
+    if (!inbound) return null;
+    const forwardToken = inbound.token;
+    const pool = inbound.reversePool;
+    const slot = pool && Array.isArray(pool.slots) ? pool.slots[pool.activeSlot] : null;
+    if (!slot || !Number.isInteger(slot.port)) {
+      return { node: inbound, forwardPort: null, forwardToken, kind: 'inbound-unverified', route: routed };
+    }
+    return { node: inbound, forwardPort: slot.port, forwardToken, kind: 'inbound', route: routed };
+  }
+
+  function ownerUrl(port, path) {
+    return `http://127.0.0.1:${port}/federation/route/_/${path.replace(/^\//, '')}`;
+  }
+
+  async function forward(candidate, path, { method = 'GET', body, expectedTs, op } = {}) {
+    op.check();
+    const st = loadStore();
+    slotVerifier.sync(st, proofScope);
+    if (candidate.kind === 'inbound' && !candidate.route) {
+      const current = st && (st.nodes || []).find(node => node.name === candidate.node.name);
+      const selected = binding(st, current);
+      if (!selected || selected.fingerprint !== op.proofBinding) {
+        slotVerifier.invalidate(op.proofKey);
+        const error = new Error('reverse slot changed'); error.reason = 'reverse-slot-unverified'; throw error;
+      }
+    }
+    const routed = candidate.route;
+    const url = routed
+      ? `http://127.0.0.1:${localPort()}/api/route/${routed.map(encodeURIComponent).join('/')}/_${path}`
+      : ownerUrl(candidate.forwardPort, path);
+    const headers = routed ? { authorization: `Bearer ${localToken()}` }
+      : { authorization: `Bearer ${candidate.forwardToken}`, 'x-nexuscrew-visited': st && st.nodeId || '' };
+    try {
+      op.check(); op.delivered = true;
+      const r = await op.wait(fetchImpl(url, { method, headers: { ...headers, 'content-type': 'application/json',
+        ...(expectedTs === undefined ? {} : { 'x-nexuscrew-ask-ts': String(expectedTs) }) },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }), signal: op.controller.signal }));
+      op.check();
+      const payload = await op.wait(r.json().catch(error => {
+        if ([403, 404, 501].includes(r.status)) return {};
+        throw error;
+      }));
+      op.check();
+      if (!r.ok) slotVerifier.invalidate(op.proofKey);
+      return { r, body: { ...payload, reason: sanitizeReason(payload && payload.reason) } };
+    } catch (error) { slotVerifier.invalidate(op.proofKey); throw error; }
+  }
+
+  // Preflight of the reverse channel for an inbound peer: a NET refusal when the
+  // slot is not proven (not an uncertain outcome: the forward never left).
+  async function verifyInboundChannel(candidate, op) {
+    // REST routes prove the slot at their inbound proxy hop, never twice.
+    if (candidate.route) return { ok: true };
+    op.check();
+    const st = loadStore();
+    const proof = await op.wait(slotVerifier.verify({ store: st, peer: candidate.node, loadStore,
+      scope: proofScope, signal: op.controller.signal, probeImpl: probeReverseSlotImpl }));
+    op.check();
+    if (proof && proof.owned === true) {
+      op.proofKey = proof.key;
+      const selected = binding(st, candidate.node);
+      op.proofBinding = selected && selected.fingerprint;
+      return { ok: true };
+    }
+    return { ok: false, code: 404, error: 'canale reverse non verificato: risposta non inoltrata', reason: 'reverse-slot-unverified' };
+  }
+
+  return { operation, candidateOwner, ownerUrl, forward, verifyInboundChannel, deadlineResult, RELAY_DEADLINE_MS: deadlineMs };
+}
+
+module.exports = { createOwnerChannel, RELAY_DEADLINE_MS };

package/lib/proxy/federation.js

@@ -113,8 +113,31 @@ function peerAllows(peer, otherId) {
   return Array.isArray(peer.selected) && peer.selected.includes(otherId);
 }
 
+// A host-only peer (publishRemote, schema 4) is a REMOTE node this installation
+// publishes to an explicit audience of its own admin nodes. The boundary is
+// one-way and does not depend on the peer's own claims or grants:
+//   audience -> peer : yes, while the reader is in the audience AND still holds
+//                      the operator grant (re-read on every call);
+//   peer -> anyone   : never (not another peer, not a topology, not a route);
+//   everyone else    : no, whatever `visibility` or `shared` say.
+function isHostOnlyPeer(peer) {
+  return !!peer && peer.publishRemote === true;
+}
+
+function audienceAllows(reader, hostOnly) {
+  return Array.isArray(hostOnly.publishRemoteAudience)
+    && typeof reader.nodeId === 'string'
+    && hostOnly.publishRemoteAudience.includes(reader.nodeId)
+    && !isHostOnlyPeer(reader)
+    && allowedByClass('operator', reader);
+}
+
 function canTransit(ingress, egress) {
   if (!ingress || !egress || ingress.name === egress.name) return !ingress;
+  // The ingress is the AUTHENTICATED peer record (looked up by its token), never
+  // something read from the query, a header or the visited chain.
+  if (isHostOnlyPeer(ingress)) return false;
+  if (isHostOnlyPeer(egress)) return audienceAllows(ingress, egress);
   // `shared` is the explicit publication gate. Visibility remains the hub ACL,
   // but it cannot make a private peer routable on its own.
   return egress.shared === true
@@ -228,6 +251,11 @@ function knownResource(resource) {
     || /^\/event-feed\/asks\/[a-f0-9]{8}(?:\/answer|\/capability|\/requests\/[0-9a-f-]{16,64})?$/.test(resource)
     || /^\/event-feed\/[A-Za-z0-9._-]{1,32}$/.test(resource)
     || /^\/event-feed\/node\/[a-f0-9]{32}$/.test(resource)
+    // Owner-side notice dismissals: the write-back path of the feed for the
+    // notices the owner cleared. It travels like the ask write-back — a peer
+    // that may see the notice (and holds the ask-action grants) may clear it.
+    || /^\/event-feed\/notices\/[0-9a-f-]{36}$/.test(resource)
+    || resource === '/event-feed/notices/dismiss-all'
     || isPanelResource(resource)
     || /^\/fleet\/(status|schema|definitions|credentials\/status|credentials\/(?:set|remove)|up|down|restart|engine|boot|define-engine|edit-engine|remove-engine|define-model|edit-model|remove-model|model-test|define-cell|edit-cell|remove-cell|restore-cells|restore-engines)$/.test(resource);
 }
@@ -269,6 +297,9 @@ function liveHostAllowedFor(ingress) {
 // WebSocket upgrade. A resource whose class is unknown, or whose grants the
 // owner has not conceded, is refused before anything is dispatched.
 function classGateCheck(resource, method, ingress) {
+  // A host-only peer reaches nothing of ours, whatever grants its record carries
+  // or gains: the zeroed vector is the first lock, this is the second.
+  if (isHostOnlyPeer(ingress)) return { ok: false, status: 403, reason: 'host-only-peer' };
   const cls = classifyResource(resource, method);
   if (!cls) return { ok: false, status: 404, reason: 'resource-not-classified' };
   if (!allowedByClass(cls, ingress)) return { ok: false, status: 403, reason: `grant-required:${cls}` };
@@ -335,6 +366,10 @@ function allowedResource(resource, method = 'GET') {
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/capability$/.test(resource)) return method === 'GET';
   if (/^\/event-feed\/asks\/[a-f0-9]{8}$/.test(resource)) return method === 'DELETE';
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/requests\/[0-9a-f-]{16,64}$/.test(resource)) return method === 'GET';
+  // Notice dismissals: a single DELETE per notice, or one POST that clears the
+  // whole visible set (N DELETEs through two hops would die in the 6/min budget).
+  if (/^\/event-feed\/notices\/[0-9a-f-]{36}$/.test(resource)) return method === 'DELETE';
+  if (resource === '/event-feed/notices/dismiss-all') return method === 'POST';
   if (resource === '/asks') return method === 'POST';
   if (resource === '/notify') return method === 'POST';
   // Audio: only capability read, speak and stop are exposed through Hydra.
@@ -1200,7 +1235,9 @@ async function collectTopologyDetailed({
       instanceId: n.nodeId, name: n.name, route: [n.name], direct: true,
       label: store.validLabel(n.label) ? n.label.trim() : '',
     });
-    if (ttl <= 1 || !n.token) continue;
+    // A host-only peer is published as a LEAF: whatever it says about its own
+    // children is never asked for, so it cannot announce nodes to our readers.
+    if (ttl <= 1 || !n.token || isHostOnlyPeer(n)) continue;
     probes.push({ n, pending: fetchPeerTopology({ node: n, ttl, seen, fetchImpl, timeoutMs: childBudget }) });
   }
   const results = await Promise.all(probes.map(async ({ n, pending }) => {
@@ -1277,7 +1314,9 @@ async function collectLocalTopology({
   const live = await collectTopologyDetailed({ nodesPath, fetchImpl, timeoutMs, childSnapshots: false });
   const st = store.loadStore(nodesPath);
   const directNames = new Set(((st && st.nodes) || [])
-    .filter((n) => n.direction !== 'inbound' || n.shared === true)
+    // A host-only peer is a leaf: nothing cached "behind" it survives (entries
+    // written before the mode was turned on included).
+    .filter((n) => (n.direction !== 'inbound' || n.shared === true) && !isHostOnlyPeer(n))
     .map((n) => n.name));
   const authoritative = new Set(live.authoritative);
   const liveIds = new Set(live.nodes.map((n) => n.instanceId));
@@ -1353,6 +1392,15 @@ function peerRouter({ nodesPath, localPort, localCredential, fetchImpl, readonly
     if (!peer) return res.status(401).json({ error: 'unauthorized peer' });
     req.peer = peer; next();
   });
+  // A host-only peer (publish-remote) reaches NOTHING of ours over the protocol:
+  // the only thing it may do is the authenticated health probe. Share, topology,
+  // reverse-pool and routes are all refused here, before their handlers run.
+  r.use((req, res, next) => {
+    if (isHostOnlyPeer(req.peer) && !(req.method === 'GET' && req.path === '/health')) {
+      return res.status(403).json({ error: 'non concesso a questo nodo', reason: 'host-only-peer' });
+    }
+    return next();
+  });
   // Health federato: il peer autenticato (acceptToken matchato sopra) ottiene un
   // 200 esplicito con instanceId/version. Serve da target di probeHealth() lato
   // Initiator: distingue transport (porta aperta) da auth (200 vs 401) da
@@ -2063,9 +2111,9 @@ function acceptWsThenClose(socket, req, code, reason) {
 
 
 module.exports = {
-  isPanelResource, panelAllowedFor, isLiveHostResource, liveHostAllowedFor, routeHandler,
+  isPanelResource, panelAllowedFor, isLiveHostResource, liveHostAllowedFor, classGateCheck, routeHandler,
   MAX_HOPS, ROUTE_DELIMITER, TOPOLOGY_PEER_TIMEOUT_MS, SHARE_NOT_READY_CODE, classifyShareFailure, activeReversePort,
-  peerFromToken, peerAllows, canTransit, parseRoute, knownResource, allowedResource, allowedQuery, readonlyBlocksFederated,
+  peerFromToken, peerAllows, canTransit, isHostOnlyPeer, parseRoute, knownResource, allowedResource, allowedQuery, readonlyBlocksFederated,
   collectTopology, collectTopologyDetailed, collectLocalTopology, peerRouter, localRouter, forwardUpgrade, createHubAttachStore,
   probeHealth, waitForHealthyPeer, canListenLoopback, preflightHubReverse, notifyHubShare, reconcilePeerShare, runShareRevokeBoot, probeReverseOwner,
   hubPoolRequest, verifyHubPoolSlot, reserveHubPoolSlot, commitHubPoolSlot, settleHubPoolSlot, abortHubPoolSlot, getHubPoolStatus,

package/lib/proxy/resource-acl.js

@@ -58,6 +58,12 @@ function classifyResource(resource, method = 'GET') {
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/capability$/.test(resource)) return m === 'GET' ? 'ask-action' : null;
   if (/^\/event-feed\/asks\/[a-f0-9]{8}$/.test(resource)) return m === 'DELETE' ? 'ask-action' : null;
   if (/^\/event-feed\/asks\/[a-f0-9]{8}\/requests\/[0-9a-f-]{16,64}$/.test(resource)) return m === 'GET' ? 'ask-action' : null;
+  // Notice dismissals: the same class as the ask write-back — an ACTION on the
+  // feed, not a read of it. The full preset carries it, the viewer does not,
+  // and seeing the notice is not what grants clearing it. No new grant name is
+  // invented: `askReplyAccess` is already "may act on what the feed shows".
+  if (/^\/event-feed\/notices\/[0-9a-f-]{36}$/.test(resource)) return m === 'DELETE' ? 'ask-action' : null;
+  if (resource === '/event-feed/notices/dismiss-all') return m === 'POST' ? 'ask-action' : null;
 
   if (resource === '/cells') return m === 'GET' ? 'inventory' : null;
   if (resource === '/sessions') return m === 'GET' ? 'inventory' : (m === 'POST' ? 'operator' : null);