id: 9ee5b0f4-ae7a-456b-8e4d-e95c54fc0771 title: 'Inbox core: forms, POSTs, storage, ack, license' state: closed labels:
- area:inbox assignees: [] milestone: m4-mailbox created: 2026-09-10T03:52:27.761772920Z updated: 2026-09-10T04:49:11.956150408Z
Context: The only write path. Dumb inbox, private, text-only. Depends on scaffold serve stub. Tasks:
- Forms
/new-issue.html,/new-pr.html: free textboxes title + body/prompt, optional handle(<=40)+contact(<=100), honeypot field, license checkbox w/ final text (DRAFT), plain POST to/inbox/issue,/inbox/pr-prompt. No JS. hu13 serve --www --inbox-dir --listen: static file server + exactly 2 POST routes. Static serves dist/ withnosniff; POSTs accept urlencoded-only, enforce UTF-8, reject null bytes, strip controls except \n\t, validate caps (title<=300, body<=20000, request<=32KB, license checked else 400), write<uuid4>.jsonmode 0600 {type,title,body,handle,contact,license_version,received_at,salted_ip_hash(daily salt)}, respondreceivedpage with one-time ack uuid + zero reflection.hu13 inbox list|show --inbox-dir: escaped plain-text terminal output only.- Daemon runs unprivileged; no git in PATH needed; writes ONLY inbox dir. Success rubric (dod §Mailbox core):
- curl POSTs (issue + pr-prompt) store one JSON each, 0600, server-named uuid; GET on routes -> 404/405; nothing appears in dist/.
- License unchecked -> 400 nothing stored; checked -> stored version+hash.
- Ack uuid shown once, not in URL; no submitted text echoed in response (grep response for marker string -> absent).
-
list|show print text with
<script>payload visible as text, no ANSI injection (escape check). Swarm: Platinum (only public write surface in the whole world — treat accordingly). Branchm4/inbox.