Module question 

ask_question (#1660) signed-answer canonical, verification, and the per-question correlation-token contract.

A sibling to the HITL approval flow’s approval_response machinery in crate::approval, not a reuse of it — see issue #1660 and its parent PRD #1659. The trust shape is identical (THIN signing: an edge sends an unsigned answer intent, the control plane resolves and signs server-side, the harness re-verifies before trusting the answer) but the signed canonical is its own, with its own field set and its own key names (question_call_id/question_index, not request_id/tool_name), so an approval signature can never verify as a question answer and vice versa. The ApprovalSigner role intentionally covers this human-decision answer family as well as tool approvals. Session, turn-read, web-session grants, and journal roots use different roles.

Structs

VerifiedQuestionAnswer

A verified, decoded question_response payload.

Constants

ANSWERED_STATE

The signed state value for a question a human explicitly answered by picking an option.

ANSWER_TOKEN_TTL_MS

TTL for a minted answer token (#1660).

AUTO_RESOLVED_STATE

The signed state value for a question nobody answered before its idle window elapsed.

DECLINED_STATE

The signed state value for a question a human explicitly declined to choose (“use your own judgment”) — distinct from ANSWERED_STATE so the agent never mistakes a decline for a real answer.

Functions

answer_payload

JSON payload for a question_response event.

mint_answer_token

Mint a short-lived, signed answer token scoped to one pending question.

verify_answer_capability

Verify a persisted question_response as a SINGLE-USE, conversation-bound capability (invariant I3/I7), gated on a trusted-signer allow-list.

verify_answer_token

Verify an answer token minted by mint_answer_token against the (call_id, index, conversation_id) a Respond call presents it for.

verify_signed_answer

Verify a persisted question_response payload.

verify_signed_answer_pinned

Verify a persisted question_response payload against a trusted-signer allow-list.

verify_wire_answer

Verify a wire-form question_response, binding the answer to its full signed identity.