---
id: 9ee5b0f4-ae7a-456b-8e4d-e95c54fc0771
title: 'Inbox core: forms, POSTs, storage, ack, license'
state: closed
labels:
- area:inbox
assignees: []
milestone: m4-mailbox
created: 2026-09-10T03:52:27.761772920Z
updated: 2026-09-10T04:49:11.956150408Z
---
Context: The only write path. Dumb inbox, private, text-only. Depends on scaffold serve stub.
Tasks:
- Forms `/new-issue.html`, `/new-pr.html`: free textboxes title + body/prompt, optional handle(<=40)+contact(<=100), honeypot field, license checkbox w/ final text (DRAFT), plain POST to `/inbox/issue`, `/inbox/pr-prompt`. No JS.
- `hu13 serve --www --inbox-dir --listen`: static file server + exactly 2 POST routes. Static serves dist/ with `nosniff`; POSTs accept urlencoded-only, enforce UTF-8, reject null bytes, strip controls except \n\t, validate caps (title<=300, body<=20000, request<=32KB, license checked else 400), write `<uuid4>.json` mode 0600 {type,title,body,handle,contact,license_version,received_at,salted_ip_hash(daily salt)}, respond `received` page with one-time ack uuid + zero reflection.
- `hu13 inbox list|show --inbox-dir`: escaped plain-text terminal output only.
- Daemon runs unprivileged; no git in PATH needed; writes ONLY inbox dir.
Success rubric (dod §Mailbox core):
- [ ] curl POSTs (issue + pr-prompt) store one JSON each, 0600, server-named uuid; GET on routes -> 404/405; nothing appears in dist/.
- [ ] License unchecked -> 400 nothing stored; checked -> stored version+hash.
- [ ] Ack uuid shown once, not in URL; no submitted text echoed in response (grep response for marker string -> absent).
- [ ] list|show print text with `<script>` payload visible as text, no ANSI injection (escape check).
Swarm: Platinum (only public write surface in the whole world — treat accordingly). Branch `m4/inbox`.