Skip to content

Commit 3aa67fb

Browse files
midiakiasatmidiakiasat
authored
Build APPLY terminal intake control plane
Builds APPLY terminal intake control plane.
1 parent 5c1af18 commit 3aa67fb

58 files changed

Lines changed: 830 additions & 390 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/pages.yml‎

Lines changed: 47 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,51 @@
11
name: Publish apply surface
2-
32
on:
4-
push:
5-
branches: [ main ]
6-
workflow_dispatch:
7-
3+
push:
4+
branches: [ main ]
5+
workflow_dispatch:
86
permissions:
9-
contents: read
10-
pages: write
11-
id-token: write
12-
13-
concurrency:
14-
group: pages
15-
cancel-in-progress: true
16-
7+
contents: read
8+
pages: write
9+
id-token: write
1710
jobs:
18-
deploy:
19-
runs-on: ubuntu-latest
20-
environment:
21-
name: github-pages
22-
url: ${{ steps.deployment.outputs.page_url }}
23-
steps:
24-
- uses: actions/checkout@v4
25-
- uses: actions/configure-pages@v5
26-
27-
- name: Prepare artifact
28-
shell: bash
29-
run: |
30-
set -euo pipefail
31-
rm -rf dist
32-
mkdir -p dist/submit dist/task dist/confirm
33-
cp CNAME dist/CNAME
34-
cp public/index.html dist/index.html
35-
cp public/404.html dist/404.html
36-
cp public/submit/index.html dist/submit/index.html
37-
cp public/task/index.html dist/task/index.html
38-
cp public/confirm/index.html dist/confirm/index.html
39-
cp -R surface-system dist/surface-system
40-
grep -Fx "apply.verifrax.net" dist/CNAME
41-
test -f dist/surface-system/shell/base.css
42-
43-
- uses: actions/upload-pages-artifact@v3
44-
with:
45-
path: dist
46-
47-
- id: deployment
48-
uses: actions/deploy-pages@v4
11+
contract:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v4
15+
- uses: actions/setup-node@v4
16+
with:
17+
node-version: "22"
18+
- run: npm test
19+
- run: npm run verify
20+
deploy-static-fallback:
21+
needs: contract
22+
runs-on: ubuntu-latest
23+
environment:
24+
name: github-pages
25+
url: ${{ steps.deployment.outputs.page_url }}
26+
steps:
27+
- uses: actions/checkout@v4
28+
- uses: actions/configure-pages@v5
29+
- name: Prepare static artifact
30+
shell: bash
31+
run: |
32+
set -euo pipefail
33+
rm -rf dist
34+
mkdir -p dist
35+
cp -R public/. dist/
36+
cp CNAME dist/CNAME
37+
grep -Fx "apply.verifrax.net" dist/CNAME
38+
test -f dist/index.html
39+
test -f dist/task/index.html
40+
test -f dist/submit/index.html
41+
test -f dist/confirm/index.html
42+
test -f dist/status/index.html
43+
test -f dist/privacy/index.html
44+
test -f dist/admin/index.html
45+
test -f dist/tasks/protocol-review.json
46+
test -f dist/schemas/submission.schema.json
47+
- uses: actions/upload-pages-artifact@v3
48+
with:
49+
path: dist
50+
- id: deployment
51+
uses: actions/deploy-pages@v4

‎404.html‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,15 @@
44
<meta charset="utf-8">
55
<meta name="viewport" content="width=device-width,initial-scale=1">
66
<title>VERIFRAX Apply</title>
7-
<meta name="description" content="Intake surface for the VERIFRAX public perimeter. This surface accepts intake only. It does not publish proof, determine verification truth, issue authority, or execute governed actions.">
7+
<meta name="description" content="Terminal intake control plane for VERIFRAX. This host converts untrusted human intent into structured private review signal only. It does not publish proof, verify truth, issue authority, execute governed actions, recognize terminal truth, or assign recourse.">
88
<link rel="canonical" href="https://apply.verifrax.net/">
99
<link rel="stylesheet" href="assets/surface.css">
1010
</head>
1111
<body>
1212
<main class="wrap">
1313
<div class="kicker">VERIFRAX / apply</div>
1414
<h1>404 — VERIFRAX Apply</h1>
15-
<p class="lead">Intake surface for the VERIFRAX public perimeter. This surface accepts intake only. It does not publish proof, determine verification truth, issue authority, or execute governed actions.</p>
15+
<p class="lead">Terminal intake control plane for VERIFRAX. This host converts untrusted human intent into structured private review signal only. It does not publish proof, verify truth, issue authority, execute governed actions, recognize terminal truth, or assign recourse.</p>
1616
<p class="copy">Bounded public tool surface inside the VERIFRAX perimeter.</p>
1717
<div class="rule"></div>
1818

@@ -28,6 +28,7 @@ <h2>System map</h2>
2828
<li class="row"><span class="label">Runtime</span><span class="value"><a href="https://corpiform.verifrax.net">corpiform.verifrax.net</a></span></li>
2929
<li class="row"><span class="label">Execution</span><span class="value"><a href="https://api.verifrax.net">api.verifrax.net</a></span></li>
3030
<li class="row"><span class="label">Status</span><span class="value"><a href="https://status.verifrax.net">status.verifrax.net</a></span></li>
31+
<li class="row"><span class="label">Archive</span><span class="value"><a href="https://sigillarium.verifrax.net">sigillarium.verifrax.net</a></span></li>
3132
</ul>
3233
</article>
3334

‎README.md‎

Lines changed: 28 additions & 149 deletions
Original file line numberDiff line numberDiff line change
@@ -1,169 +1,48 @@
11
# APPLY
22

3-
* License: GNU Affero General Public License v3.0
3+
APPLY is the VERIFRAX terminal intake control plane.
44

5-
APPLY is the Verifrax intake boundary: the public surface that accepts structured intake into the Verifrax system without becoming authored protocol source, authority issuance, governed execution, public verification, proof publication, or archive/reference.
5+
`APPLY = intake(filter(humans)) -> structured_signal`
66

7-
## Proof artifacts
7+
APPLY accepts structured intake, rejects incomplete intake, normalizes applicant signal, scores reviewability, issues intake receipts, routes records into a private queue, exposes protected reviewer workflow, and emits review state.
88

9-
This repository is part of the VERIFRAX proof perimeter.
9+
APPLY does not decide truth.
1010

11-
- **ARTIFACT-0006**
12-
- **ARTIFACT-0005**
13-
- **ARTIFACT-0004**
14-
- **ARTIFACT-0003**
15-
- **ARTIFACT-0002**
16-
- **ARTIFACT-0001**
11+
APPLY may not define law, accept canonical state, issue authority, execute governed actions, verify artifacts, publish proof, archive evidence, recognize terminal truth, assign terminal recourse, or publish applicant PII.
1712

18-
**Canonical public proof surface:** https://proof.verifrax.net
19-
**Canonical proof publication repository:** https://github.com/Verifrax/proof
20-
**Canonical evidence root:** https://github.com/Verifrax/VERIFRAX
13+
## Live host
2114

22-
## Terminal planes
15+
https://apply.verifrax.net
2316

24-
- **[ANAGNORIUM](https://github.com/Verifrax/ANAGNORIUM)** — terminal recognition
25-
- **[REGRESSORIUM](https://github.com/Verifrax/REGRESSORIUM)** — terminal recourse
17+
## Required routes
2618

27-
## Status
19+
Public: `/`, `/task`, `/submit`, `/confirm`, `/status`, `/privacy`, `/admin`.
2820

29-
* Surface class: intake
30-
* Repository class: intake host surface
31-
* Public host ownership: `apply.verifrax.net`
32-
* Host class: tool
33-
* Role: apply
34-
* Deploy mode: static-root
35-
* Current repository posture: live public intake boundary
36-
## Boundary
21+
API: `/api/submit`, `/api/confirm`, `/api/status`, `/api/admin/submissions`, `/api/admin/submission/:id`.
3722

38-
This repository owns structured intake only.
23+
## Tracks
3924

40-
It accepts bounded submissions into the Verifrax system.
41-
It exposes intake-surface role truth and intake-entry behavior.
25+
- protocol-review
26+
- security-adversarial-review
27+
- verifier-engineering
28+
- surface-frontend
29+
- enterprise-compliance
30+
- documentation-systems
4231

43-
It does not author normative source material.
44-
It does not issue authority.
45-
It does not execute governed actions.
46-
It does not verify published material.
47-
It does not publish proof.
48-
It does not serve as archive/reference.
49-
It does not replace adjacent sovereign boundaries.
32+
## Queue states
5033

51-
## What it does
34+
`new`, `review`, `accepted`, `rejected`, `deferred`, `spam`, `quarantined`.
5235

53-
- accepts structured intake into the Verifrax system
54-
- provides a bounded host surface for intake entry
55-
- preserves a clean intake boundary for public users and system routing
56-
- keeps intake distinct from authority, execution, verification, proof publication, and archive/reference
57-
- anchors intake-surface role truth for adjacent repositories and hosts
36+
## Scoring law
5837

59-
## What it does not do
38+
`S = 0.5 * output_presence + 0.2 * link_quality + 0.2 * alignment + 0.1 * clarity`
6039

61-
- not authored protocol source; that belongs to VERIFRAX
62-
- not authority issuance; that belongs to AUCTORISEAL
63-
- not governed execution; that belongs to CORPIFORM
64-
- not public verification; that belongs to VERIFRAX-verify
65-
- not proof publication; that belongs to proof
66-
- not archive/reference; that belongs to SIGILLARIUM
67-
- not constitutional doctrine; that belongs to SYNTAGMARIUM
68-
- not canonical world-state; that belongs to ORBISTIUM
69-
- not reconciliation or repair; that belongs to CONSONORIUM
70-
- not sovereign cognition; that belongs to TACHYRIUM
40+
## Runtime
7141

72-
## Adjacent sovereign surfaces
42+
Cloudflare Pages Functions + D1:
7343

74-
- `VERIFRAX` — authored protocol and evidence-root boundary
75-
- `AUCTORISEAL` — authority issuance
76-
- `CORPIFORM` — governed execution
77-
- `VERIFRAX-verify` — public verification
78-
- `proof` — proof publication
79-
- `SIGILLARIUM` — archive/reference
80-
81-
VERIFRAX authors.
82-
AUCTORISEAL issues.
83-
CORPIFORM executes.
84-
proof publishes.
85-
VERIFRAX-verify verifies.
86-
APPLY accepts intake.
87-
88-
That separation must remain explicit.
89-
90-
## Public host ownership
91-
92-
This repository owns the public intake host for:
93-
94-
* `https://apply.verifrax.net/`
95-
96-
That host must remain intake only.
97-
98-
It must not become:
99-
100-
* authored protocol source
101-
* authority issuance
102-
* governed execution
103-
* verifier UI
104-
* proof publication
105-
* archive/reference
106-
* docs mirror
107-
* commercial landing
108-
109-
## Public surface
110-
111-
The public surface of this repository is its repository identity, README boundary, public intake host surface, and intake-facing materials carried by this repository.
112-
113-
Publication here is not authored source.
114-
Publication here is not authority.
115-
Publication here is not execution.
116-
Publication here is not verification.
117-
Publication here is not proof publication.
118-
Publication here is not archive/reference.
119-
120-
## Package / host / repo truth
121-
122-
Repository truth for APPLY lives in this repository.
123-
124-
Host truth for this surface is `https://apply.verifrax.net/`.
125-
Host presentation and repository truth are related but not interchangeable.
126-
Repository boundary still controls intake role truth here.
127-
128-
## Intake meaning in-system
129-
130-
Intake in-system means the stack can point to APPLY and say that a bounded intake surface, intake-entry path, or submission-acceptance surface belongs to this boundary.
131-
132-
Intake here accepts.
133-
Intake here does not author.
134-
Intake here does not issue authority.
135-
Intake here does not execute.
136-
Intake here does not verify.
137-
Intake here does not publish proof.
138-
139-
That does not by itself mean:
140-
141-
- the intake surface became authored protocol source
142-
- the intake surface issued authority
143-
- the intake surface executed a governed action
144-
- the intake surface verified truth
145-
- the intake surface published proof
146-
- the intake surface replaced archive/reference
147-
- the intake surface replaced the evidence-root repository
148-
149-
## Not this
150-
151-
APPLY is not authored protocol source.
152-
APPLY is not authority issuance.
153-
APPLY is not governed execution.
154-
APPLY is not public verification.
155-
APPLY is not proof publication.
156-
APPLY is not archive/reference.
157-
158-
## Validation
159-
160-
- `surface.host.json` must continue to declare:
161-
- repo = `apply`
162-
- host = `https://apply.verifrax.net`
163-
- hostClass = `tool`
164-
- role = `apply`
165-
- deployMode = `static-root`
166-
167-
## License
168-
169-
This repository is licensed under the GNU Affero General Public License v3.0. See `LICENSE`.
44+
- `APPLY_DB`
45+
- `ADMIN_TOKEN`
46+
- `RECEIPT_HMAC_SECRET`
47+
- `TURNSTILE_SECRET`
48+
- `APPLY_WEBHOOK_URL`

‎docs/APPLY_TERMINAL_INTAKE_CONTROL_PLANE.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# APPLY Terminal Intake Control Plane
2+
3+
A static page saying "submit" is not intake.
4+
5+
Finished APPLY completes:
6+
7+
`visitor -> self-selection filter -> bounded task -> structured artifact -> validation -> score -> receipt -> private queue -> sixty-second decision`
8+
9+
No public APPLY surface may make an applicant submission appear verified, authorized, proven, recognized, or accepted as truth.
10+
11+
## Release gates
12+
13+
1. Six bounded task lanes exist.
14+
2. Form captures required structured signal.
15+
3. Missing artifact is rejected.
16+
4. Missing work link is rejected.
17+
5. Honeypot is rejected.
18+
6. Overlong narrative is rejected.
19+
7. Submission receives deterministic score.
20+
8. Submission writes to private queue.
21+
9. Receipt is generated.
22+
10. Admin queue requires bearer token.
23+
11. Reviewer can transition queue state.
24+
12. Full record read is protected.
25+
13. Public confirmation is receipt-only.
26+
14. Status route is APPLY-only.
27+
15. PII never enters public repository.
28+
16. Static contract tests pass.

‎docs/CLOUDFLARE_DEPLOYMENT.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# APPLY Cloudflare Deployment
2+
3+
```bash
4+
wrangler d1 create verifrax-apply
5+
wrangler d1 migrations apply verifrax-apply
6+
wrangler pages secret put ADMIN_TOKEN
7+
wrangler pages secret put RECEIPT_HMAC_SECRET
8+
````
9+
10+
Optional:
11+
12+
```bash
13+
wrangler pages secret put TURNSTILE_SECRET
14+
wrangler pages secret put APPLY_WEBHOOK_URL
15+
```
16+
17+
Admin: `https://apply.verifrax.net/admin`
18+
19+
Queue: `/api/admin/submissions?state=new`
20+
21+
Record: `/api/admin/submission/:id`

‎functions/api/admin/submission/[id].ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
import { json, fail } from "../../../lib/http";
2+
import { assertAdmin } from "../../../lib/auth";
3+
interface Env { APPLY_DB: D1Database; ADMIN_TOKEN: string; }
4+
export const onRequestGet: PagesFunction<Env> = async ({request,env,params})=>{if(!assertAdmin(request,env))return fail("unauthorized",401);const id=Array.isArray(params.id)?params.id[0]:params.id;const row:any=await env.APPLY_DB.prepare("select * from submissions where id = ?").bind(id).first();if(!row)return fail("not_found",404);return json({ok:true,submission:{...row,score:JSON.parse(row.score_json),receipt:JSON.parse(row.receipt_json),submission:JSON.parse(row.submission_json)}})};

‎functions/api/admin/submissions.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
import { json, fail } from "../../lib/http";
2+
import { assertAdmin } from "../../lib/auth";
3+
import { STATES, REVIEW_REASONS } from "../../lib/validation";
4+
interface Env { APPLY_DB: D1Database; ADMIN_TOKEN: string; }
5+
export const onRequestGet: PagesFunction<Env> = async ({request,env})=>{if(!assertAdmin(request,env))return fail("unauthorized",401);const state=new URL(request.url).searchParams.get("state")||"new";const rows=await env.APPLY_DB.prepare("select id, created_at, updated_at, state, track, github_url, artifact_url, score_total, score_json from submissions where state = ? order by created_at desc limit 100").bind(state).all();return json({ok:true,state,submissions:rows.results})};
6+
export const onRequestPatch: PagesFunction<Env> = async ({request,env})=>{if(!assertAdmin(request,env))return fail("unauthorized",401);const input:any=await request.json();if(!STATES.has(input.state))return fail("invalid_state",400);if(input.reason&&!REVIEW_REASONS.has(input.reason))return fail("invalid_reason",400);await env.APPLY_DB.prepare("update submissions set state = ?, updated_at = ? where id = ?").bind(input.state,new Date().toISOString(),input.id).run();await env.APPLY_DB.prepare("insert into review_decisions (id, submission_id, created_at, decision, reason, produced_something, aligned, above_baseline, review_seconds) values (?, ?, ?, ?, ?, ?, ?, ?, ?)").bind(crypto.randomUUID(),input.id,new Date().toISOString(),input.state,input.reason||null,Boolean(input.produced_something),Boolean(input.aligned),Boolean(input.above_baseline),Number(input.review_seconds||0)).run();await env.APPLY_DB.prepare("insert into submission_events (id, submission_id, created_at, from_state, to_state, actor, reason) values (?, ?, ?, ?, ?, ?, ?)").bind(crypto.randomUUID(),input.id,new Date().toISOString(),null,input.state,"admin",input.reason||"manual_review").run();return json({ok:true})};

‎functions/api/confirm.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
import { json, fail } from "../lib/http";
2+
interface Env { APPLY_DB: D1Database; }
3+
export const onRequestGet: PagesFunction<Env> = async ({ request, env }) => { const id=new URL(request.url).searchParams.get("id"); if(!id)return fail("missing_id",400); const row:any=await env.APPLY_DB.prepare("select receipt_json from submissions where id = ?").bind(id).first(); if(!row)return fail("not_found",404); return json({ok:true,receipt:JSON.parse(row.receipt_json)}); };

‎functions/api/status.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
import { json } from "../lib/http";
2+
export const onRequestGet: PagesFunction = async () => json({ok:true,role:"apply_intake_only",truth_warning:"INTAKE_ONLY_NOT_TRUTH",queue_states:["new","review","accepted","rejected","deferred","spam","quarantined"]});

0 commit comments

Comments
 (0)