# hu13 definition of done (v1 gate)

Global rubric. v1 tags ONLY when every line passes, verified by supervisor
+ CI + dogfood, not by claim.

## Site

- [ ] `hu13 build <repo> -o dist/` on this repo + a fixture repo with no
  `.forge/` both exit 0; no warnings on clean input.
- [ ] dist/ works on `file://` and any static server, JS disabled.
- [ ] Code tab: tree, README, header (branch+sha, counts, CI verdict),
  clone cmd, `repo.bundle` (clones: `git clone repo.bundle` works),
  `repo.tar.gz` (extracts).
- [ ] File pages escaped (`<script>` in source shows as text), line numbers,
  raw byte-identical (`diff` clean), >256KB placeholder.
- [ ] Commit pages include full diff `<pre>`; message escaped.
- [ ] Issues/PRs numbers match `(created,id)` rank; patch.diff shown;
  tasks grouped; CI badges correct; releases list + artifacts download
  byte-identical with sha256 from notes; wiki index titles correct.
- [ ] feed.atom validates (50 max, newest first). api/*.json parse and
  match HTML counts. agents page has curl examples.

## Mailbox

- [ ] Only 2 POST routes; GET on them = 404/405. No inbox content in dist/.
- [ ] Caps enforced: over-limit -> 413, nothing stored. multipart -> rejected.
- [ ] Null bytes / non-UTF8 -> 400. Control chars stripped.
- [ ] Honeypot filled -> silent `received`, nothing stored.
- [ ] Rate limit 2/hr/IP -> 429. Quota 500 -> 503. No length -> drop.
- [ ] Ack uuid shown once, never in URL, no lookup endpoint.
- [ ] License unchecked -> 400. Checked -> stored license_version+hash.
- [ ] Daemon user writes ONLY inbox dir (verified in compose/dockerfile).
- [ ] `inbox list|show` prints escaped plain text only.

## Ship

- [ ] `cargo fmt --check`, `clippy -D warnings`, `cargo test` green.
- [ ] Docker: fresh `repo/` + restart rebuilds; inbox volume survives restart.
- [ ] CSS <15KB, binary <2MB (or documented cut list).
- [ ] License text owner re-read done (deferred issue closed).
- [ ] Tokyo Night dark, sharp corners (`border-radius: 0` grep clean).

## Verify loop

For each issue: implement -> `cargo test` + targeted checks -> dogfood build
-> supervisor re-tests rubric -> fail powers a fix commit on same branch,
never a new issue. Close only on green.