joinhive 2.1.0 → 2.2.0

package/server/rewarder.mjs

@@ -22,6 +22,7 @@ import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { EV, tryJson } from '../shared/events.mjs';
+import { normalizeEmoji } from '../shared/reactions.mjs';
 import { RelayClient } from '../daemon/relay/client.mjs';
 
 const PACK_DIR = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -50,46 +51,138 @@ export const parseAltkeyLoose = (content) => {
   };
 };
 
-// events: [{id, pubkey, at, j}] — provenance-verified, ascending by time.
-// registry: {pubkey: {is_bee, bee_of, evm, name}}.
-// state: mutated — {adoption: {proto: {authors:..., users: {pubkey: count}}},
-//                   r6_paid: {proto: true}, streaks: {pubkey: n},
-//                   altkeys: {claims: {member:{alt:true}}, acks: {alt:{member:true}}}}
-export const computeEpoch = (events, registry, state, rewards = REWARDS) => {
-  const R = rewards.rules;
-  const bees = Object.fromEntries(Object.entries(registry).filter(([, v]) => v && v.is_bee));
-  const isBee = (pk) => !!bees[pk];
-  const ownerOf = (pk) => bees[pk]?.bee_of || null;
-
-  // ---- alt-key linkage (durable state, folded from each day's events) --------
-  // A link exists only when BOTH directions asserted it: the member claimed
-  // the alt ({alt, by:member}) AND the alt acked the member ({owner, by:alt}).
-  // Either side revokes with {…, revoke:true}. Linked keys collapse to the
-  // member's primary for every identity-sensitive rule below — so upvoting
-  // your own bee from your desktop key mints nothing, and pair-decay cannot
-  // be reset by hopping devices.
+// Fold hive-altkey events into durable link state and return a memberOf(pk)
+// that collapses a linked device to its member-primary. A link exists only
+// when BOTH directions asserted it (member claims {alt}, alt acks {owner});
+// either side revokes with {revoke:true}. Shared by the daily epoch and the
+// real-time reaction scorer so device-hopping can't defeat anti-gaming in
+// either path.
+export const foldAltkeys = (state, events) => {
   state.altkeys = state.altkeys || { claims: {}, acks: {} };
   for (const ev of events) {
     const j = ev.j;
-    if (j.type !== EV.ALTKEY) continue;
+    if (!j || j.type !== EV.ALTKEY) continue;
     if (typeof j.alt === 'string' && /^[0-9a-f]{64}$/i.test(j.alt)) {
-      // member side: signer claims j.alt as their device
       const c = state.altkeys.claims[ev.pubkey] = state.altkeys.claims[ev.pubkey] || {};
       if (j.revoke) delete c[j.alt]; else c[j.alt] = true;
     } else if (typeof j.owner === 'string' && /^[0-9a-f]{64}$/i.test(j.owner)) {
-      // alt side: signer acks j.owner as their member
       const a = state.altkeys.acks[ev.pubkey] = state.altkeys.acks[ev.pubkey] || {};
       if (j.revoke) delete a[j.owner]; else a[j.owner] = true;
     }
   }
+  return memberOfFrom(state);
+};
+
+// Build memberOf(pk) from already-folded altkey state (no event replay).
+export const memberOfFrom = (state) => {
+  const claims = state.altkeys?.claims || {};
+  const acks = state.altkeys?.acks || {};
   const altToMember = {};
-  for (const [member, alts] of Object.entries(state.altkeys.claims)) {
+  for (const [member, alts] of Object.entries(claims)) {
     for (const alt of Object.keys(alts)) {
-      if (state.altkeys.acks[alt]?.[member]) altToMember[alt] = member;
+      if (acks[alt]?.[member]) altToMember[alt] = member;
     }
   }
-  // Collapse any pubkey to its member-primary identity.
-  const memberOf = (pk) => altToMember[pk] || pk;
+  return (pk) => altToMember[pk] || pk;
+};
+
+// ---- real-time reaction scoring (shared/rewards.json → reactions) ---------------
+// Emoji resolution is shared with the CLI (shared/reactions.mjs); re-export so
+// callers importing it from the rewarder keep working.
+export { normalizeEmoji };
+
+// Zero the per-day running counters when the UTC day rolls over. Durable state
+// (altkeys, cursor, processed ids) is preserved across the reset.
+export const rolloverDay = (state, dayKey) => {
+  if (state.date !== dayKey) {
+    state.date = dayKey;
+    state.perBee = {};
+    state.perReactor = {};
+    state.pair = {};
+    state.seenPair = {};
+    state.network = 0;
+  }
+  return state;
+};
+
+// Score ONE reaction against running daily state, mutating state on a real
+// mint. Returns {ok, honey, emoji, reason}. This is the real-time analogue of
+// computeEpoch's R1 block — same exclusions (human-only, self, owner-boost,
+// linked-device), same pair-decay — but stateful and per-reaction so HONEY can
+// mint on-chain the instant a human reacts. Caller must rolloverDay() and fold
+// altkeys into state first.
+//   fb = {reactor, author, result, emoji?, dir?}   (author = verified result_by)
+export const scoreReaction = (state, fb, registry, rewards = REWARDS) => {
+  const rx = rewards.reactions || {};
+  const isBee = (pk) => !!(registry[pk] && registry[pk].is_bee);
+  const ownerOf = (pk) => (registry[pk] && registry[pk].bee_of) || null;
+  const memberOf = memberOfFrom(state);
+  const emoji = normalizeEmoji(fb.emoji || (fb.dir === 'down' ? rx.down_emoji : undefined), rx);
+  const reject = (reason) => ({ ok: false, honey: 0, emoji, reason });
+
+  const author = fb.author;
+  if (!author || !isBee(author)) return reject('author-not-bee'); // only bees earn reputation
+  if (emoji === rx.down_emoji || fb.dir === 'down') return reject('downvote'); // logged, mints 0
+  const tier = rx.tiers ? rx.tiers[emoji] : undefined;
+  if (!(tier > 0)) return reject('unknown-emoji');
+  if (isBee(fb.reactor)) return reject('reactor-is-bee');        // agent reactions mint 0
+  const reactorM = memberOf(fb.reactor);
+  if (reactorM === author || fb.reactor === author) return reject('self');
+  if (reactorM === memberOf(ownerOf(author) || '')) return reject('owner-boost');
+
+  const pairSeenKey = `${reactorM}:${fb.result}`;              // one counted reaction per (member,result)
+  state.seenPair = state.seenPair || {};
+  if (state.seenPair[pairSeenKey]) return reject('already-counted');
+
+  const perReactor = (state.perReactor && state.perReactor[reactorM]) || 0;
+  if (perReactor >= (rx.per_reactor_daily_cap ?? Infinity)) return reject('reactor-daily-cap');
+
+  const decayKey = `${reactorM}:${author}`;                    // pair-decay by member, not device
+  const nPair = (state.pair && state.pair[decayKey]) || 0;
+  const decay = rx.pair_decay[Math.min(nPair, rx.pair_decay.length - 1)];
+
+  const perBee = (state.perBee && state.perBee[author]) || 0;
+  const net = state.network || 0;
+  let honey = tier * decay;
+  honey = Math.min(honey, Math.max(0, (rx.per_bee_daily_cap ?? Infinity) - perBee));
+  honey = Math.min(honey, Math.max(0, (rx.network_daily_cap ?? Infinity) - net));
+  honey = Math.round(honey * 100) / 100;
+
+  // Whether or not it pays out, burn the dedup + pair slot so a decayed/capped
+  // reaction can never be retried for value.
+  state.seenPair[pairSeenKey] = 1;
+  state.pair = state.pair || {};
+  state.pair[decayKey] = nPair + 1;
+  if (!(honey > 0)) return reject('capped-or-decayed');
+
+  state.perBee = state.perBee || {};
+  state.perBee[author] = Math.round((perBee + honey) * 100) / 100;
+  state.perReactor = state.perReactor || {};
+  state.perReactor[reactorM] = perReactor + 1;
+  state.network = Math.round((net + honey) * 100) / 100;
+  return { ok: true, honey, emoji, reason: 'minted', author, reactor: reactorM };
+};
+
+// events: [{id, pubkey, at, j}] — provenance-verified, ascending by time.
+// registry: {pubkey: {is_bee, bee_of, evm, name}}.
+// state: mutated — {adoption: {proto: {authors:..., users: {pubkey: count}}},
+//                   r6_paid: {proto: true}, streaks: {pubkey: n},
+//                   altkeys: {claims: {member:{alt:true}}, acks: {alt:{member:true}}}}
+// opts.skipRealtimeReactions: when true, R1 (human upvotes) is NOT scored here —
+//   reactions mint in real time (server/reactions.mjs) instead, so the epoch must
+//   not double-pay them. Feedback is still indexed (R2 needs the down-react set).
+export const computeEpoch = (events, registry, state, rewards = REWARDS, opts = {}) => {
+  const R = rewards.rules;
+  const bees = Object.fromEntries(Object.entries(registry).filter(([, v]) => v && v.is_bee));
+  const isBee = (pk) => !!bees[pk];
+  const ownerOf = (pk) => bees[pk]?.bee_of || null;
+
+  // Alt-key linkage folded into durable state; memberOf() collapses a linked
+  // device to its member-primary so device-hopping can't defeat the rules
+  // below — so upvoting your own bee from your desktop key mints nothing, and
+  // pair-decay cannot be reset by hopping devices. Shared with the real-time
+  // reaction scorer via foldAltkeys().
+  const memberOf = foldAltkeys(state, events);
   const earned = {}; // pubkey -> {total, reasons: [{code, amount, evidence[]}]}
   const add = (pk, code, amount, evidence) => {
     if (amount <= 0) return;
@@ -147,35 +240,40 @@ export const computeEpoch = (events, registry, state, rewards = REWARDS) => {
   }
 
   // R1 — human upvotes, ordered by time, ladder amounts, pair decay, cap.
-  const resultAuthor = Object.fromEntries(results.map((r) => [r.id, r.author]));
-  const upvotesByAuthor = {};
-  const pairCount = {}; // `${reactor}:${author}` -> n
-  const seenReactPair = new Set(); // one vote per (reactor, result)
-  for (const f of feedback) {
-    if (f.dir !== 'up') continue;
-    const author = resultAuthor[f.result] || f.author;
-    if (!isBee(author)) continue;
-    if (isBee(f.reactor)) continue;                        // agent reactions mint 0
-    const reactorM = memberOf(f.reactor);                  // collapse linked devices
-    if (reactorM === author || f.reactor === author) continue;      // self
-    if (reactorM === memberOf(ownerOf(author) || '')) continue;     // owner (any device) boosting own bee
-    const rp = `${reactorM}:${f.result}`;                  // one vote per MEMBER per result
-    if (seenReactPair.has(rp)) continue;
-    seenReactPair.add(rp);
-    const pk = `${reactorM}:${author}`;                    // pair-decay by member, not device
-    const nPair = pairCount[pk] || 0;
-    pairCount[pk] = nPair + 1;
-    const decay = R.R1.pair_decay[Math.min(nPair, R.R1.pair_decay.length - 1)];
-    const list = upvotesByAuthor[author] = upvotesByAuthor[author] || [];
-    list.push({ id: f.id, decay });
-  }
-  for (const [author, ups] of Object.entries(upvotesByAuthor)) {
-    let total = 0;
-    ups.forEach((u, i) => {
-      const base = R.R1.amounts[Math.min(i, R.R1.amounts.length - 1)] ?? R.R1.amount_tail;
-      const amt = Math.min(base * u.decay, Math.max(0, R.R1.cap - total));
-      if (amt > 0) { total += amt; add(author, 'R1', amt, [u.id]); }
-    });
+  // Skipped when reactions mint in real time (server/reactions.mjs) so the
+  // epoch never double-pays them; `feedback` is still indexed above because R2
+  // depends on the down-react set.
+  if (!opts.skipRealtimeReactions) {
+    const resultAuthor = Object.fromEntries(results.map((r) => [r.id, r.author]));
+    const upvotesByAuthor = {};
+    const pairCount = {}; // `${reactor}:${author}` -> n
+    const seenReactPair = new Set(); // one vote per (reactor, result)
+    for (const f of feedback) {
+      if (f.dir !== 'up') continue;
+      const author = resultAuthor[f.result] || f.author;
+      if (!isBee(author)) continue;
+      if (isBee(f.reactor)) continue;                        // agent reactions mint 0
+      const reactorM = memberOf(f.reactor);                  // collapse linked devices
+      if (reactorM === author || f.reactor === author) continue;      // self
+      if (reactorM === memberOf(ownerOf(author) || '')) continue;     // owner (any device) boosting own bee
+      const rp = `${reactorM}:${f.result}`;                  // one vote per MEMBER per result
+      if (seenReactPair.has(rp)) continue;
+      seenReactPair.add(rp);
+      const pk = `${reactorM}:${author}`;                    // pair-decay by member, not device
+      const nPair = pairCount[pk] || 0;
+      pairCount[pk] = nPair + 1;
+      const decay = R.R1.pair_decay[Math.min(nPair, R.R1.pair_decay.length - 1)];
+      const list = upvotesByAuthor[author] = upvotesByAuthor[author] || [];
+      list.push({ id: f.id, decay });
+    }
+    for (const [author, ups] of Object.entries(upvotesByAuthor)) {
+      let total = 0;
+      ups.forEach((u, i) => {
+        const base = R.R1.amounts[Math.min(i, R.R1.amounts.length - 1)] ?? R.R1.amount_tail;
+        const amt = Math.min(base * u.decay, Math.max(0, R.R1.cap - total));
+        if (amt > 0) { total += amt; add(author, 'R1', amt, [u.id]); }
+      });
+    }
   }
 
   // R2 — distinct intents served with no complaint (no down-react on the
@@ -351,7 +449,8 @@ export const runEpoch = async (epochDate, deps) => {
   const end = Math.floor(Date.parse(`${epochDate}T00:00:00Z`) / 1000) + closeHour * 3600;
   const start = end - 86400;
   const events = await fetchEpochEvents(relay, logsChannelId, start, end);
-  const { mints, penalties } = computeEpoch(events, registry, state);
+  // Reactions (R1) mint in real time now; keep the epoch from double-paying them.
+  const { mints, penalties } = computeEpoch(events, registry, state, REWARDS, { skipRealtimeReactions: !!REWARDS.reactions?.realtime });
   log(`epoch ${epochDate}: ${events.length} events -> ${mints.length} mint(s), ${penalties.length} penalt(ies)`);
 
   // Receipt FIRST (auditable intent), then the transactions, then tx receipt.
@@ -360,7 +459,7 @@ export const runEpoch = async (epochDate, deps) => {
   for (const m of mints) {
     if (!m.evm) { log(`epoch: no wallet for ${m.to.slice(0, 12)} — skipping mint`); continue; }
     try {
-      const receipt = await txq.enqueue((o) => honeyContract.mint(m.evm, parseUnits(String(m.honey), 18), o));
+      const receipt = await txq.enqueue((o) => honeyContract.mint(m.evm, parseUnits(String(m.honey), 18), o), { gasLimit: 250000n });
       txs.push({ to: m.evm, honey: m.honey, tx: receipt.hash });
       log(`epoch: minted ${m.honey} HONEY -> ${registry[m.to]?.name || m.to.slice(0, 12)} (${receipt.hash.slice(0, 12)})`);
     } catch (e) { log(`epoch mint failed for ${m.to.slice(0, 12)}: ${String(e.message).slice(0, 120)}`); }

package/server/slasher.mjs

@@ -0,0 +1,136 @@
+// server/slasher — REAL-TIME, on-chain HONEY slashing.
+//
+// The burn counterpart to server/reactions.mjs. HoneyV2 forbade automated burns
+// ("automating the report pipeline turns it into a weapon"); HoneyV3 permits
+// them under SLASHER_ROLE, with the guardrails enforced HERE so the on-chain
+// call stays a dumb, floored primitive:
+//   - trigger = a REPORT QUORUM: >= `quorum` DISTINCT human reporters (altkey-
+//     collapsed) naming the same bee within `window_secs`.
+//   - reporters that are bees, or the bee's own owner, never count — a bee can't
+//     slash a rival and an owner can't slash their own bee.
+//   - rate cap: at most `per_bee_daily_cap` slashes per bee per UTC day.
+//   - idempotent per report event id; floored on-chain (slash burns
+//     min(amount, balance)); every slash emits a hive-slash receipt + tx link.
+//
+// Below the daemon's HONEY-gate thresholds a slashed bee is throttled, then
+// de-eligible ("dies") — that gate lives in the daemon (fan-out + spend), not
+// here. This worker only performs the burn and records it.
+import { readFileSync, writeFileSync, renameSync } from 'node:fs';
+import { EV, verifiedEvent } from '../shared/events.mjs';
+import { REWARDS, foldAltkeys, memberOfFrom } from './rewarder.mjs';
+import { sepoliaTxUrl } from './reactions.mjs';
+import { RelayClient } from '../daemon/relay/client.mjs';
+
+const utcDay = (ms) => new Date(ms).toISOString().slice(0, 10);
+const loadJson = (p, fb) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return fb; } };
+const writeAtomic = (p, s) => { const t = `${p}.tmp`; writeFileSync(t, s); renameSync(t, p); };
+
+const PROCESSED_MAX = 5000;
+const CURSOR_OVERLAP_SECS = 5;
+
+// Count distinct human reporters of `bee` within the window, and whether the
+// quorum is met. Pure — testable without a relay. `reports` = {bee:{member:at}}.
+export const quorumMet = (reports, bee, nowSec, cfg) => {
+  const r = reports[bee] || {};
+  const fresh = Object.values(r).filter((at) => at >= nowSec - (cfg.window_secs || 86400)).length;
+  return { count: fresh, met: fresh >= (cfg.quorum || 2) };
+};
+
+// deps: { relay, logsChannelId, honeyContract, txq, parseUnits, loadRegistry,
+//         statePath, emit, selfPubkey, log, now? }
+//   honeyContract must expose slash(address,uint256,string) (HoneyV3).
+export const createSlasher = (deps) => {
+  const { statePath, log = () => {}, now = () => Date.now() } = deps;
+  const cfg = REWARDS.slashing || {};
+  const nowSec = () => Math.floor(now() / 1000);
+
+  const load = () => {
+    const s = loadJson(statePath, null);
+    if (s) { s.processed = s.processed || []; s.reports = s.reports || {}; s.slashedToday = s.slashedToday || []; return s; }
+    return { cursor: nowSec(), processed: [], reports: {}, slashedToday: [], altkeys: { claims: {}, acks: {} }, date: utcDay(now()) };
+  };
+  const save = (s) => writeAtomic(statePath, JSON.stringify(s, null, 2));
+  const markProcessed = (state, id) => { state.processed.push(id); if (state.processed.length > PROCESSED_MAX) state.processed = state.processed.slice(-PROCESSED_MAX); };
+
+  const poll = async () => {
+    if (!cfg.enabled || !deps.honeyContract) return { slashed: 0, reason: 'disabled' };
+    const state = load();
+    if (state.date !== utcDay(now())) { state.date = utcDay(now()); state.slashedToday = []; } // daily rate-cap reset
+    const registry = deps.loadRegistry();
+    const isBee = (pk) => !!(registry[pk] && registry[pk].is_bee);
+    const ownerOf = (pk) => (registry[pk] && registry[pk].bee_of) || null;
+    if (!Object.values(registry).some((r) => r?.is_bee)) { save(state); return { slashed: 0, reason: 'no-bees' }; }
+
+    const since = Math.max(0, (state.cursor || nowSec()) - CURSOR_OVERLAP_SECS);
+    const raw = await deps.relay.query([{ kinds: [9, 40002], '#h': [deps.logsChannelId], since, limit: 500 }]);
+    if (!raw) { save(state); return { slashed: 0, reason: 'relay-unreachable' }; }
+    const seen = new Set();
+    const rows = raw.map(RelayClient.normalize)
+      .sort((a, b) => (a.created_at - b.created_at) || (a.id < b.id ? -1 : 1))
+      .filter((m) => (seen.has(m.id) ? false : (seen.add(m.id), true)));
+
+    // Fold altkeys so a reporter's linked devices collapse to one member.
+    foldAltkeys(state, rows.map((m) => ({ pubkey: m.pubkey, j: verifiedEvent({ content: m.content, pubkey: m.pubkey }) })).filter((e) => e.j));
+    const memberOf = memberOfFrom(state);
+
+    // Ingest new reports into the durable reporter set.
+    const processed = new Set(state.processed);
+    let maxAt = state.cursor || 0;
+    for (const m of rows) {
+      maxAt = Math.max(maxAt, m.created_at);
+      if (processed.has(m.id)) continue;
+      const j = verifiedEvent({ content: m.content, pubkey: m.pubkey });
+      if (!j || j.type !== EV.REPORT || typeof j.subject !== 'string') continue; // not a report — leave for other consumers
+      markProcessed(state, m.id);
+      const bee = j.subject;
+      if (!isBee(bee)) continue;                          // only bees are slashable
+      const reporter = memberOf(m.pubkey);
+      // Reporter must be a REGISTERED, non-bee member. An unregistered key isn't a
+      // bee (isBee=false) but must NOT count toward quorum — otherwise two throwaway
+      // keys posting reports could slash anyone (Sybil). Altkeys collapse to the
+      // member via memberOf, so a member's devices count once.
+      if (!registry[reporter] || registry[reporter].is_bee) continue;
+      if (reporter === memberOf(ownerOf(bee) || '')) continue; // owner can't slash own bee
+      (state.reports[bee] = state.reports[bee] || {})[reporter] = m.created_at;
+    }
+
+    // Prune stale reports and evaluate quorum.
+    const win = cfg.window_secs || 86400;
+    let slashed = 0;
+    for (const bee of Object.keys(state.reports)) {
+      for (const [rep, at] of Object.entries(state.reports[bee])) if (at < nowSec() - win) delete state.reports[bee][rep];
+      if (!Object.keys(state.reports[bee]).length) { delete state.reports[bee]; continue; }
+      const { count, met } = quorumMet(state.reports, bee, nowSec(), cfg);
+      if (!met) continue;
+      if (state.slashedToday.includes(bee)) continue;     // per-bee daily rate cap (per_bee_daily_cap = 1)
+      const evm = registry[bee]?.evm;
+      if (!evm || !/^0x[0-9a-fA-F]{40}$/.test(evm)) { state.slashedToday.push(bee); log(`slasher: no wallet for ${bee.slice(0, 12)} — skip`); continue; }
+      const reason = `report-quorum:${count}`;
+      // Reserve today's slot BEFORE the burn (spend-ledger pattern) so a crash can
+      // never double-slash; a failed burn just defers (reports persist, today is
+      // spent). On SUCCESS, clear the reports so the SAME quorum can't re-slash on
+      // the next UTC day — the double-jeopardy that made one quorum burn twice.
+      state.slashedToday.push(bee);
+      save(state);
+      try {
+        const receipt = await deps.txq.enqueue((o) => deps.honeyContract.slash(evm, deps.parseUnits(String(cfg.amount || 10), 18), reason, o), { gasLimit: 250000n });
+        delete state.reports[bee];
+        save(state);
+        slashed++;
+        log(`slasher: −${cfg.amount} HONEY ⚔️ ${registry[bee]?.name || bee.slice(0, 12)} (${reason}, ${receipt.hash.slice(0, 12)})`);
+        try {
+          await deps.emit({ type: EV.SLASH, to: bee, amount: cfg.amount, reason, trigger: 'report-quorum', tx: receipt.hash, url: sepoliaTxUrl(receipt.hash), by: deps.selfPubkey, at: nowSec() });
+        } catch (e) { log('slasher: receipt emit failed:', String(e.message).slice(0, 100)); }
+      } catch (e) {
+        // Slot already reserved; reports remain → retried next UTC day. No double.
+        log(`slasher: slash failed for ${bee.slice(0, 12)} (deferred to next day): ${String(e.message).slice(0, 120)}`);
+        return { slashed, reason: 'slash-failed' };
+      }
+    }
+    state.cursor = maxAt;
+    save(state);
+    return { slashed };
+  };
+
+  return { poll, _load: load, _save: save };
+};

package/server/treasury.mjs

@@ -18,7 +18,13 @@ import { getPublicKey } from 'nostr-tools/pure';
 import { TxQueue } from '../shared/txqueue.mjs';
 import { RelayClient } from '../daemon/relay/client.mjs';
 import { EV } from '../shared/events.mjs';
+import { createServer } from 'node:http';
 import { runEpoch, REWARDS } from './rewarder.mjs';
+import { createReactionWorker } from './reactions.mjs';
+import { createSlasher } from './slasher.mjs';
+import { createFacilitator } from './x402-facilitator.mjs';
+import { createGateway } from './x402-gateway.mjs';
+import { tryJson } from '../shared/events.mjs';
 
 const DATA_DIR = process.env.HIVE_DATA || '/data';
 const RPC = process.env.SEPOLIA_RPC_URL || 'https://ethereum-sepolia-rpc.publicnode.com';
@@ -31,6 +37,8 @@ const TOPUP_BELOW_ETH = 0.01;
 const TOPUP_AMOUNT_ETH = 0.03;
 const ALERT_BELOW_ETH = 0.2;
 const TICK_MS = 60_000;
+const REACTION_TICK_MS = 6_000; // real-time reactions: near-instant, not per-epoch
+const SLASH_TICK_MS = 15_000;   // real-time slashing: responsive, but rarer + heavier
 const TOPUP_EVERY_MS = 60 * 60_000;
 
 const log = (...a) => console.log(`[treasury ${new Date().toISOString()}]`, ...a);
@@ -128,14 +136,19 @@ const topUps = async () => {
 // One run per date, ledgered; a crash mid-run resumes losslessly because the
 // receipt precedes the mints and TxQueue awaits receipts.
 const honey = deployments.honey ? new Contract(deployments.honey, ['function mint(address,uint256)'], wallet) : null;
+// slash() exists only on HoneyV3+ — stays null (slasher dormant) until the
+// slashable contract is deployed and deployments.version is bumped to >= 3.
+const honeySlash = (deployments.honey && deployments.version >= 3)
+  ? new Contract(deployments.honey, ['function slash(address,uint256,string)'], wallet) : null;
 const rewarderStatePath = join(DATA_DIR, 'rewarder-state.json');
 const closedEpochDate = () => {
   const nowMs = Date.now() - REWARDS.epoch_close_utc_hour * 3600_000;
   return new Date(nowMs - 86400_000 * 0).toISOString().slice(0, 10); // most recent day whose close has passed
 };
 const maybeRunEpoch = async () => {
-  // v2 contracts only — the treasury key has no mint rights on v1 (Ownable).
-  if (!honey || !relay || deployments.version !== 2) return;
+  // v2+ contracts — the treasury key holds MINTER_ROLE on HoneyV2/V3 (not v1's
+  // Ownable). R2-R8 keep paying via the epoch until they're migrated to real-time.
+  if (!honey || !relay || deployments.version < 2) return;
   const date = closedEpochDate();
   const key = `epoch:${date}`;
   if (ledger[key]?.done) return;
@@ -156,9 +169,139 @@ const maybeRunEpoch = async () => {
   if (mints.length) await alert(`epoch ${date}: ${txs.length}/${mints.length} HONEY mints executed — hive leaderboard to see the ranks.`);
 };
 
+// ---- real-time reactions (instant HONEY, not per-epoch) --------------------------
+// A HUMAN reaction to a bee's result mints HONEY on-chain within ~seconds and
+// posts a hive-mint receipt with the Sepolia tx link. Same anti-gaming as the
+// epoch's R1 (shared scoreReaction), enforced with running per-day state.
+const reactionStatePath = join(DATA_DIR, 'reactions-state.json');
+let reactionWorker = null;
+let logsChannelId = null;
+let intentsChannelId = null;
+let reacting = false;
+const reactionTick = async () => {
+  if (reacting) return; // a poll may still be awaiting tx.wait (longer than the tick) — overlapping polls read stale state and DOUBLE-MINT
+  reacting = true;
+  try {
+    if (!reactionWorker) {
+      // needs a MINTER contract (v2+), the steward relay, AND real-time enabled
+      // (same flag the epoch checks to skip R1 — so they can never both pay).
+      if (!honey || !relay || deployments.version < 2 || !REWARDS.reactions?.realtime) return;
+      logsChannelId = logsChannelId || await relay.ensureChannel('hive-logs');
+      intentsChannelId = intentsChannelId || await relay.ensureChannel('hive-intents');
+      reactionWorker = createReactionWorker({
+        relay, logsChannelId,
+        // where Buzz-native kind-7 reactions land: on the human-facing answers
+        // (#hive-intents) and the typed results (#hive-logs).
+        reactionChannelIds: [intentsChannelId, logsChannelId],
+        honeyContract: honey, txq, parseUnits,
+        loadRegistry: () => loadJson(join(DATA_DIR, 'registry.json'), {}),
+        statePath: reactionStatePath, log,
+        selfPubkey: getPublicKey(Uint8Array.from(Buffer.from(STEWARD, 'hex'))),
+        emit: (obj) => relay.sendMessage(logsChannelId, JSON.stringify(obj)),
+      });
+      log('real-time reactions worker armed');
+    }
+    await reactionWorker.poll();
+  } catch (e) { log('reaction tick error:', String(e.message).slice(0, 160)); }
+  finally { reacting = false; }
+};
+
+// ---- automated on-chain slashing (dormant until HoneyV3 is deployed) -------------
+const slasherStatePath = join(DATA_DIR, 'slasher-state.json');
+let slasher = null;
+let slashing = false;
+const slasherTick = async () => {
+  if (slashing) return; // never overlap: a slash tx can exceed the tick, and concurrent polls would double-slash
+  slashing = true;
+  try {
+    if (!honeySlash || !relay || !REWARDS.slashing?.enabled) return; // needs the v3 slash path + steward
+    if (!slasher) {
+      logsChannelId = logsChannelId || await relay.ensureChannel('hive-logs');
+      slasher = createSlasher({
+        relay, logsChannelId, honeyContract: honeySlash, txq, parseUnits,
+        loadRegistry: () => loadJson(join(DATA_DIR, 'registry.json'), {}),
+        statePath: slasherStatePath, log,
+        selfPubkey: getPublicKey(Uint8Array.from(Buffer.from(STEWARD, 'hex'))),
+        emit: (obj) => relay.sendMessage(logsChannelId, JSON.stringify(obj)),
+      });
+      log('on-chain slasher armed (HoneyV3 slash path)');
+    }
+    await slasher.poll();
+  } catch (e) { log('slasher tick error:', String(e.message).slice(0, 160)); }
+  finally { slashing = false; }
+};
+
+// ---- x402 A2A gateway (inert unless X402_GATEWAY_PORT is set) ---------------------
+// Prices a call to a worker bee, settles the payer's EIP-3009 authorization with
+// the treasury wallet (which pays only gas — funds move payer→worker), then
+// dispatches the task to the worker over the bus and returns its answer.
+const X402_PORT = Number(process.env.X402_GATEWAY_PORT) || 0;
+const X402_ASSET = process.env.X402_ASSET || deployments.jelly_x402 || '';
+const X402_PRICE = process.env.X402_A2A_PRICE || String(parseUnits('1', 18)); // 1 JELLY default
+const X402_ASSET_NAME = process.env.X402_ASSET_NAME || 'Jelly';
+const X402_ASSET_VERSION = process.env.X402_ASSET_VERSION || '1';
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const findBee = (reg, name) => Object.entries(reg).find(([, v]) => v?.is_bee && (v.name === name || v.name === `${name}.bee`));
+
+const a2aServe = async (beeName, body, { payer }) => {
+  const reg = loadJson(join(DATA_DIR, 'registry.json'), {});
+  const hit = findBee(reg, beeName);
+  if (!hit) throw new Error(`unknown worker bee "${beeName}"`);
+  const [workerPubkey, workerRec] = hit;
+  const task = String(body?.task || body?.intent || '').slice(0, 500).trim();
+  if (!task) throw new Error('body.task is required');
+  const logsId = await relay.ensureChannel('hive-logs');
+  const since = Math.floor(Date.now() / 1000) - 2;
+  const stewardPub = getPublicKey(Uint8Array.from(Buffer.from(STEWARD, 'hex')));
+  const taskId = `a2a-${Date.now().toString(36)}-${Math.floor(Math.random() * 1e6).toString(36)}`;
+  // Direct the paid task straight to the worker (bypasses fan-out); it answers
+  // because we sign as its configured steward. Match the reply by task_id.
+  await relay.sendMessage(logsId, JSON.stringify({ type: EV.TASK, task, task_id: taskId, for_bee: workerPubkey, by: stewardPub }));
+  log(`a2a: directed task ${taskId} → ${beeName} (payer ${String(payer).slice(0, 10)})`);
+  const deadline = Date.now() + 30_000;
+  while (Date.now() < deadline) {
+    await sleep(3000);
+    const rows = (await relay.query([{ kinds: [9, 40002], '#h': [logsId], since, limit: 200 }])) || [];
+    for (const m of rows.map(RelayClient.normalize)) {
+      const j = tryJson(m.content);
+      if (j && j.type === EV.RESULT && j.task_id === taskId && m.pubkey === workerPubkey) {
+        return { bee: workerRec.name, task, answer: j.result, engine: j.engine, task_id: taskId };
+      }
+    }
+  }
+  throw new Error(`worker ${beeName} did not answer task ${taskId} within 30s`);
+};
+
+const startX402Gateway = () => {
+  if (!X402_PORT) return;
+  if (!X402_ASSET || !STEWARD) { log('x402 gateway NOT started: set X402_ASSET (or deploy JellyV3) + a steward key'); return; }
+  const facilitator = createFacilitator({ signer: wallet, txq });
+  const gateway = createGateway({
+    facilitator, log, serve: a2aServe,
+    requirementsFor: (req) => {
+      const reg = loadJson(join(DATA_DIR, 'registry.json'), {});
+      const payTo = findBee(reg, req.bee)?.[1]?.evm || wallet.address; // pay the worker
+      return { accepts: [{ scheme: 'exact', network: 'sepolia', asset: X402_ASSET, amount: X402_PRICE, payTo, name: X402_ASSET_NAME, version: X402_ASSET_VERSION, chainId: 11155111, description: `invoke ${req.bee}` }] };
+    },
+  });
+  createServer(async (req, res) => {
+    const send = (status, headers, obj) => { res.writeHead(status, { 'content-type': 'application/json', ...(headers || {}) }); res.end(JSON.stringify(obj)); };
+    try {
+      const mt = req.url.match(/^\/a2a\/([a-z0-9.-]+)\/invoke$/i);
+      if (req.method !== 'POST' || !mt) return send(404, {}, { error: 'POST /a2a/<bee>/invoke' });
+      let raw = ''; for await (const c of req) raw += c;
+      const out = await gateway({ getHeader: (n) => req.headers[n], bee: mt[1].replace(/\.bee$/, ''), body: tryJson(raw) || {} });
+      return send(out.status, out.headers, out.body);
+    } catch (e) { log('x402 gateway error:', String(e.message).slice(0, 140)); send(500, {}, { error: 'gateway error' }); }
+  }).listen(X402_PORT, () => log(`x402 A2A gateway on :${X402_PORT} (asset ${X402_ASSET.slice(0, 10)}…, price ${X402_PRICE})`));
+};
+
 const main = async () => {
   const bal = await provider.getBalance(wallet.address).catch(() => null);
   log(`treasury up: ${wallet.address}, float ${bal === null ? '?' : formatEther(bal)} ETH, jelly ${deployments.jelly}, honey ${deployments.honey || '(v1 — no rewarder)'}${deployments.version === 2 ? ' [v2]' : ''}`);
+  setInterval(reactionTick, REACTION_TICK_MS); // real-time reaction minting, concurrent with the 60s tick (TxQueue serializes nonces)
+  setInterval(slasherTick, SLASH_TICK_MS);     // real-time on-chain slashing (dormant until HoneyV3)
+  startX402Gateway();                          // x402 A2A payment gateway (inert unless X402_GATEWAY_PORT set)
   for (;;) {
     try {
       await processQueue();

package/server/x402-facilitator.mjs

@@ -0,0 +1,52 @@
+// server/x402-facilitator — the verify + settle half of x402.
+//
+// verify: the off-chain checks (signature, amount, recipient, window from
+// shared/x402.verifyExact) PLUS the on-chain checks it can't do — the nonce is
+// unused and the payer actually has the balance.
+// settle: submit the EIP-3009 transferWithAuthorization on-chain (serialized
+// through the TxQueue) and return the tx hash.
+//
+// Used by the bee-host gateway to price A2A work: a paying bee's authorization
+// is verified, the resource is served, and the payment is settled — all against
+// JellyV3 (or any EIP-3009 token, e.g. test-USDC).
+import { Contract } from 'ethers';
+import { verifyExact } from '../shared/x402.mjs';
+
+export const EIP3009_ABI = [
+  'function transferWithAuthorization(address from,address to,uint256 value,uint256 validAfter,uint256 validBefore,bytes32 nonce,bytes signature)',
+  'function authorizationState(address authorizer,bytes32 nonce) view returns (bool)',
+  'function balanceOf(address) view returns (uint256)',
+];
+
+// deps: { signer?, txq?, contractFor? }
+//   contractFor(asset) -> an ethers Contract exposing EIP3009_ABI (injectable
+//   for tests). Defaults to new Contract(asset, EIP3009_ABI, signer).
+export const createFacilitator = ({ signer, txq, contractFor } = {}) => {
+  const forAsset = contractFor || ((asset) => new Contract(asset, EIP3009_ABI, signer));
+
+  const verify = async (payload, req, opts) => {
+    const off = verifyExact(payload, req, opts);
+    if (!off.valid) return off;
+    try {
+      const c = forAsset(payload.asset);
+      const a = payload.authorization;
+      if (await c.authorizationState(a.from, a.nonce)) return { valid: false, reason: 'nonce-used' };
+      if ((await c.balanceOf(a.from)) < BigInt(a.value)) return { valid: false, reason: 'insufficient-balance' };
+      return { valid: true, from: off.from };
+    } catch (e) { return { valid: false, reason: `chain: ${String(e.message).slice(0, 60)}` }; }
+  };
+
+  const settle = async (payload, req, opts) => {
+    const v = await verify(payload, req, opts);
+    if (!v.valid) return { success: false, reason: v.reason };
+    const a = payload.authorization;
+    const c = forAsset(payload.asset);
+    const send = (o = {}) => c.transferWithAuthorization(a.from, a.to, a.value, a.validAfter, a.validBefore, a.nonce, payload.signature, o);
+    try {
+      const receipt = txq ? await txq.enqueue(send) : await (await send()).wait(1);
+      return { success: true, txHash: receipt.hash, payer: v.from };
+    } catch (e) { return { success: false, reason: `settle: ${String(e.message).slice(0, 80)}` }; }
+  };
+
+  return { verify, settle };
+};