# THIRE governed intake contract

Status: draft-only · HOLD by default · UNVERIFIED until a named artifact.

## Purpose

The public console is **read-only**. The only write surface is a governed intake
that accepts submissions (reports, requests, claims) and **holds** them for human
review. Nothing submitted is acted upon automatically.

## Rules

1. Loopback only — the intake connector binds `127.0.0.1`; it is not exposed to the
   public network.
2. HOLD semantics — every submission is stored with `verdict: HOLD` and
   `evidence: unverified`. No standing targets, no standing transmission.
3. No PII in automated intake — personally identifiable content is rejected unless
   the submitter confirms a contact purpose on the human-gated path.
4. Vetted claims carry `evidence_label` chosen from: live / entered / proposed /
   reference / unverified.
5. Money or license decisions triggered by intake require `payment-gateway-greenlight`
   and an assigned payee; otherwise the write refuses (403).

## Fields

| Field | Required | Notes |
|---|---|---|
| subject | yes | short title |
| body | yes | free text |
| kind | no | report / request / claim |
| evidence_label | no | defaults `unverified` |
| contact | no | rejected unless human-gated path |

## Lifecycle

submit (HOLD) → human review → accept / reject / ask → evidence label attached →
decision logged to the estate action register.

## Reference implementation

`deploy/thire_intake.py` — stdlib loopback HTTP server implementing
`POST /api/f5/intake` and `GET /api/f5/intake`. Returns HTTP 201 + HOLD receipt.