diff --git a/solanaceae/ngc_ft1_sha1/sha1_ngcft1.cpp b/solanaceae/ngc_ft1_sha1/sha1_ngcft1.cpp
index 5fb556d..457efa5 100644
--- a/solanaceae/ngc_ft1_sha1/sha1_ngcft1.cpp
+++ b/solanaceae/ngc_ft1_sha1/sha1_ngcft1.cpp
@@ -1165,6 +1165,13 @@ bool SHA1_NGCFT1::onEvent(const Events::NGCFT1_recv_message& e) {
 		return false;
 	}
 
+	// TODO: make perms go though contacts
+	// TODO: consider temporal component? not here, here is now
+	if (!_tcm.groupPeerCanSpeak(e.group_number, e.peer_number)) {
+		// peer has not the permission to speak, discard
+		return false; // return true?
+	}
+
 	uint64_t ts = Message::getTimeMS();
 
 	const auto c = _tcm.getContactGroupPeer(e.group_number, e.peer_number);
diff --git a/solanaceae/ngc_hs2/ngc_hs2_send.cpp b/solanaceae/ngc_hs2/ngc_hs2_send.cpp
index 2e0b399..17a75d7 100644
--- a/solanaceae/ngc_hs2/ngc_hs2_send.cpp
+++ b/solanaceae/ngc_hs2/ngc_hs2_send.cpp
@@ -1,5 +1,6 @@
 #include "./ngc_hs2_send.hpp"
-#include "solanaceae/util/span.hpp"
+
+#include <solanaceae/util/span.hpp>
 
 #include <solanaceae/tox_contacts/tox_contact_model2.hpp>
 
@@ -51,10 +52,23 @@ void NGCHS2Send::handleRange(Contact3Handle c, const Events::NGCFT1_recv_request
 
 void NGCHS2Send::handleSingleMessage(Contact3Handle c, const Events::NGCFT1_recv_request& e) {
 	ByteSpan fid{e.file_id, e.file_id_size};
+	if (fid.size != 32+sizeof(uint32_t)+sizeof(uint64_t)) {
+		// error
+		return;
+	}
+
 	// parse
 	// - ppk
+	// TOX_GROUP_PEER_PUBLIC_KEY_SIZE (32)
+	ByteSpan ppk{fid.ptr, 32};
+
 	// - mid
+	//static_assert(sizeof(Tox_Group_Message_Id) == sizeof(uint32_t));
+	ByteSpan mid_bytes{fid.ptr+ppk.size, sizeof(uint32_t)};
+
 	// - ts
+	// uint64_t (seconds? we dont want milliseconds
+	ByteSpan ts_bytes{mid_bytes.ptr+mid_bytes.size, sizeof(uint64_t)};
 
 	// file content
 	// - message type (text/textaction/file(ft1sha1))
@@ -64,6 +78,8 @@ void NGCHS2Send::handleSingleMessage(Contact3Handle c, const Events::NGCFT1_recv
 	//   - file type
 	//   - file id
 
+	// for queue, we need group, peer, msg_ppk, msg_mid, msg_ts
+
 	// dedupe insert into queue
 }