HANTER — EU.org

Остался один ввод реальных данных владельца. Всё остальное HANTER подставит и отправит сам.

${msg?`

${esc(msg)}

`:\"\"}

Публичная идентичность: Architect / IMPERIAL Core

Validation email: HANTER server inbox

Регистрационные данные: PRIVATE — не отображаются публично

`;}\n\nexport default async function(req:Request){\n await ensure(); const u=new URL(req.url);\n if(req.method===\"GET\"){\n const token=u.searchParams.get(\"token\")??\"\"; if(!await validToken(token))return new Response(\"Not Found\",{status:404,headers});\n const q=await sqlite.execute(`SELECT used,result_status FROM hanter_euorg_owner_gate WHERE id=1`);const row:any=(q.rows as any[])[0];\n if(Number(row?.used)===1)return new Response(page(token,\"Этот одноразовый gate уже использован. HANTER продолжает процесс на сервере.\"),{headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n return new Response(page(token),{headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n }\n if(req.method!==\"POST\")return new Response(\"Method Not Allowed\",{status:405,headers:{...headers,allow:\"GET,POST\"}});\n const fd=await req.formData();const token=String(fd.get(\"token\")??\"\");if(!await validToken(token))return new Response(\"Not Found\",{status:404,headers});\n const q=await sqlite.execute(`SELECT used FROM hanter_euorg_owner_gate WHERE id=1`);if(Number((q.rows as any[])[0]?.used)===1)return new Response(page(token,\"Gate уже использован.\"),{headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n const ad1=String(fd.get(\"ad1\")??\"\").trim(),ad2=String(fd.get(\"ad2\")??\"\").trim(),consent=String(fd.get(\"consent\")??\"\");\n if(ad1.length<5||ad2.length<3||consent!==\"yes\")return new Response(page(token,\"Проверь адрес и подтверждение.\"),{status:400,headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n const password=env(\"EUORG_CONTACT_PASSWORD\"),registrantName=env(\"EUORG_REGISTRANT_NAME\"),registrantCountry=env(\"EUORG_REGISTRANT_COUNTRY\"),contactEmail=env(\"HANTER_SERVER_INBOX_V2\");\n const gr=await fetch(FORM_URL,{headers:{\"accept\":\"text/html\",\"user-agent\":\"HANTER-Official-Secretary/1.0\"},redirect:\"manual\",signal:AbortSignal.timeout(15000)});const html=await gr.text();\n const csrf=html.match(/name=[\"']csrfmiddlewaretoken[\"'][^>]*value=[\"']([^\"']+)/i)?.[1];if(!csrf)throw new Error(\"EUORG_CSRF_NOT_FOUND\");\n const cookie=(gr.headers.get(\"set-cookie\")??\"\").split(\",\").map(x=>x.split(\";\")[0]).join(\"; \");\n const body=new URLSearchParams({csrfmiddlewaretoken:csrf,pn1:registrantName,em1:contactEmail,ad1,ad2,ad3:\"\",ad4:\"\",ad5:\"\",ad6:registrantCountry,ph1:\"\",fx1:\"\",private:\"on\",policy:\"on\",p1:password,p2:password,submit:\"Create\"});\n const pr=await fetch(FORM_URL,{method:\"POST\",headers:{\"content-type\":\"application/x-www-form-urlencoded\",\"cookie\":cookie,\"origin\":\"https://nic.eu.org\",\"referer\":FORM_URL,\"user-agent\":\"HANTER-Official-Secretary/1.0\"},body,redirect:\"manual\",signal:AbortSignal.timeout(15000)});const text=await pr.text();\n const responseHash=await sha(text),addressHash=await sha(`${ad1}\\n${ad2}\\n${registrantCountry}`);const accepted=pr.status>=300&&pr.status<400 || (pr.ok&&!/errorlist|This field is required|already exists/i.test(text));\n await sqlite.execute({sql:`UPDATE hanter_euorg_owner_gate SET used=?,used_at=?,result_status=?,result_hash=?,address_hash=? WHERE id=1`,args:[accepted?1:0,new Date().toISOString(),accepted?`SUBMITTED_HTTP_${pr.status}`:`REJECTED_HTTP_${pr.status}`,responseHash,addressHash]});\n if(!accepted)return new Response(page(token,`EU.org не принял форму (HTTP ${pr.status}). HANTER сохранил только технический hash и исправит причину.`),{status:502,headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n return new Response(`

Готово ✅

HANTER передал контактные данные в EU.org. Адрес не сохранён. Теперь закрой эту страницу — HANTER продолжит по validation-письму и Task Journal.

`,{headers:{...headers,\"content-type\":\"text/html;charset=utf-8\"}});\n}","hanter-euorg-owner",[],[274],"2171c35d-a00f-4728-9f87-21603851f86d","euorg_form_probe.ts","01a05866-6d09-7403-9f33-22e283190c14",["D",1788189502653],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst URL=\"https://nic.eu.org/arf/en/contact/create/\";\nfunction decode(s:string){return s.replace(/"/g,'\"').replace(/&/g,'&').replace(/'|'/g,\"'\").replace(/</g,'<').replace(/>/g,'>');}\nexport async function main(){\n const r=await fetch(URL,{headers:{\"user-agent\":\"HANTER-Registration-Readiness/1.0\",\"accept\":\"text/html\"},signal:AbortSignal.timeout(15000)});\n const html=await r.text();\n const forms=[...html.matchAll(/]*)>/gi)].map(m=>({attrs:decode(m[1]),action:(m[1].match(/action=[\"']([^\"']*)/i)?.[1]??null),method:(m[1].match(/method=[\"']([^\"']*)/i)?.[1]??\"GET\").toUpperCase()}));\n const inputs=[...html.matchAll(/<(input|select|textarea)\\b([^>]*)>/gi)].map(m=>{const a=m[2];return {tag:m[1].toLowerCase(),name:a.match(/name=[\"']([^\"']*)/i)?.[1]??null,type:a.match(/type=[\"']([^\"']*)/i)?.[1]??(m[1].toLowerCase()==='select'?'select':'text'),required:/\\brequired\\b/i.test(a),value:a.match(/value=[\"']([^\"']*)/i)?.[1]??null};}).filter(x=>x.name);\n const captchaSignals=[/captcha/i,/recaptcha/i,/hcaptcha/i,/turnstile/i].filter(p=>p.test(html)).map(p=>p.source);\n const csrf=inputs.filter(x=>/csrf|token/i.test(String(x.name))).map(x=>({name:x.name,type:x.type,valuePresent:Boolean(x.value)}));\n const countrySelect=html.match(/]*name=[\"']ad6[\"'][^>]*>([\\s\\S]*?)<\\/select>/i)?.[1]??\"\";\n const ukraine=[...countrySelect.matchAll(/]*value=[\"']([^\"']+)[\"'][^>]*>([\\s\\S]*?)<\\/option>/gi)].map(m=>({value:m[1],label:m[2].replace(/<[^>]+>/g,'').trim()})).filter(x=>/Ukraine/i.test(x.label));\n const out={event:\"EUORG_FORM_PROBE\",status:r.ok?\"PASS\":\"HTTP_FAIL\",http:r.status,url:URL,forms,inputs,csrf,captchaSignals,ukraine,htmlSha256:await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(html)).then(d=>[...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,'0')).join('')),truthBoundary:\"FORM_STRUCTURE_DISCOVERY != ACCOUNT_CREATION; NO_PERSONAL_DATA_SUBMITTED\"};\n console.log(JSON.stringify(out));return out;\n}\nexport default main;if(isMain(import.meta.url))await main();",[],[283],"48a03477-a681-4f6e-88b3-0c15c36c3a41","editorial_quality.ts","01a05866-6d09-7403-9f33-1efcda508371",["D",1788189502653],"import { assertPublicSafe } from \"./privacy_guard.ts\";\n\nconst ZERO_WIDTH=/[\\u200B-\\u200D\\u2060\\uFEFF]/g;\nconst BIDI=/[\\u202A-\\u202E\\u2066-\\u2069]/g;\nconst HYPE=/\\b(?:delve|unlock|game[- ]changing|seamless|robust|transformative|revolutionary|cutting[- ]edge)\\b/gi;\nconst CANNED=/\\bI hope this message finds you well\\b/gi;\n\nexport function normalizeEditorialText(input:string){\n return String(input??\"\").normalize(\"NFC\").replace(ZERO_WIDTH,\"\").replace(BIDI,\"\").replace(/[ \\t]+\\n/g,\"\\n\").replace(/\\n{4,}/g,\"\\n\\n\\n\").trim();\n}\n\nexport function editorialReview(input:string){\n const text=normalizeEditorialText(input);\n const hype=[...text.matchAll(HYPE)].map(m=>m[0]);\n const canned=[...text.matchAll(CANNED)].map(m=>m[0]);\n const privacy=assertPublicSafe(text);\n const emDashCount=(text.match(/—/g)||[]).length;\n const sentences=(text.match(/[.!?](?:\\s|$)/g)||[]).length;\n const flags:string[]=[];\n if(hype.length>2)flags.push(\"GENERIC_HYPE_CLUSTER\");\n if(canned.length)flags.push(\"CANNED_OPENING\");\n if(emDashCount>Math.max(3,Math.ceil(sentences/3)))flags.push(\"EXCESSIVE_EM_DASH\");\n if(!privacy.safe)flags.push(\"POTENTIAL_PRIVATE_DATA\");\n return {text,pass:flags.length===0,flags,hypeCount:hype.length,cannedCount:canned.length,emDashCount,hiddenControlsRemoved:normalizeEditorialText(input)!==String(input??\"\").trim(),privacySafe:privacy.safe,truthBoundary:\"EDITORIAL_PASS != PROOF_OF_HUMAN_AUTHORSHIP\"};\n}\n",[],[290],"341347e6-1d9c-4d27-9e1f-35bcea633b56","draft_elon_musk_business_proposal_20260831.ts","01a05866-6d09-7403-9f33-18c042e25e62",["D",1788189502653],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nexport async function main(){\n const out={\n event:\"HANTER_ELON_MUSK_DRAFT_ARCHIVE\",\n status:\"ARCHIVED_PRIVACY_SHIELDED\",\n topicId:\"HMT-20260831112349-53401ef6\",\n recipientPublicLabel:\"Elon Musk\",\n selectedVariant:2,\n variantHashes:{\n 1:\"e23fb8b99aca42a3bb4bcd3ebee2b46854e1aec6566066f3565c58750fdb9526\",\n 2:\"d6bbef3788862696e70ba84dc60887bcf3224df23c8b0c45a27afbd722f9f721\",\n 3:\"89f64249bd29f886508783b3e57f1f122f935af2d09cc8dc9da87293a2db6df8\"\n },\n sourceBodiesRemovedFromPublicCode:true,\n publicSignaturePolicy:\"Architect / IMPERIAL Core\",\n truthBoundary:\"HASH_ARCHIVE_PRESERVES_EVIDENCE; ORIGINAL_SENT_MESSAGE_CANNOT_BE_CHANGED; PRIVATE_IDENTITY_NOT_REPUBLISHED_IN_SOURCE\"\n };\n console.log(JSON.stringify(out));return out;\n}\nexport default main;if(isMain(import.meta.url))await main();\n",[],[297],"f64638de-ec2d-482e-8ebe-3e62421a8c7e","domain_mail_verifier_test.ts","01a05866-6d09-7403-9f33-15a18116c90b",["D",1788189502653],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\nimport { verifyDomainMail } from \"./domain_mail_verifier.ts\";\nexport async function main(){const out=await verifyDomainMail();console.log(JSON.stringify(out));return out;}\nexport default main;if(isMain(import.meta.url))await main();",[],[304],"1fbf9e30-8be4-4c43-89a9-0bfc03056663","domain_mail_verifier.ts","01a05866-6d09-7403-9f33-127fba0dcc87",["D",1788189502653],"const DOMAIN=(Deno.env.get(\"HANTER_CORPORATE_DOMAIN\")?.trim()||\"imperialcore.eu.org\").toLowerCase();\nconst DOH=\"https://cloudflare-dns.com/dns-query\";\nasync function dns(name:string,type:string){\n const u=new URL(DOH);u.searchParams.set(\"name\",name);u.searchParams.set(\"type\",type);\n const r=await fetch(u,{headers:{accept:\"application/dns-json\"},signal:AbortSignal.timeout(10000)});if(!r.ok)throw new Error(`DNS_HTTP_${r.status}`);return await r.json();\n}\nfunction data(res:any){return Array.isArray(res?.Answer)?res.Answer.map((x:any)=>String(x.data??\"\")):[];}\nexport async function verifyDomainMail(){\n const [ns,mx,txt,dmarc]=await Promise.all([dns(DOMAIN,\"NS\"),dns(DOMAIN,\"MX\"),dns(DOMAIN,\"TXT\"),dns(`_dmarc.${DOMAIN}`,\"TXT\")]);\n const nsData=data(ns),mxData=data(mx),txtData=data(txt),dmarcData=data(dmarc);\n const delegated=nsData.length>0||mxData.length>0||txtData.length>0;\n const inboundMx1=mxData.some(v=>/mx1\\.forwardemail\\.net/i.test(v));\n const inboundMx2=mxData.some(v=>/mx2\\.forwardemail\\.net/i.test(v));\n const encryptedForwarding=txtData.some(v=>/forward-email=/i.test(v))&&!txtData.some(v=>/@gmail\\.com|@outlook\\.com|@icloud\\.com/i.test(v));\n const spf=txtData.some(v=>/v=spf1/i.test(v));\n const dmarcPresent=dmarcData.some(v=>/v=DMARC1/i.test(v));\n const selector=Deno.env.get(\"HANTER_DKIM_SELECTOR\")?.trim();\n let dkimPresent=false,dkimChecked=false;\n if(selector){dkimChecked=true;const dk=await dns(`${selector}._domainkey.${DOMAIN}`,\"TXT\");dkimPresent=data(dk).some(v=>/v=DKIM1|p=/i.test(v));}\n const inboundReady=delegated&&inboundMx1&&inboundMx2&&encryptedForwarding;\n const outboundAuthReady=delegated&&spf&&dmarcPresent&&(!dkimChecked||dkimPresent);\n const status=inboundReady&&outboundAuthReady?\"DNS_MAIL_GATES_PASS\":delegated?\"DNS_PARTIAL\":\"DOMAIN_NOT_DELEGATED_OR_NOT_REGISTERED\";\n return {service:\"HANTER_DOMAIN_MAIL_VERIFIER\",domain:DOMAIN,status,checks:{delegated,forwardEmailMx1:inboundMx1,forwardEmailMx2:inboundMx2,encryptedForwardingTxt:encryptedForwarding,spfPresent:spf,dmarcPresent,dkimChecked,dkimPresent},dnsStatus:{ns:ns?.Status??null,mx:mx?.Status??null,txt:txt?.Status??null,dmarc:dmarc?.Status??null},truthBoundary:\"DNS_OBSERVATION != REGISTRAR_OWNERSHIP; DNS_AUTH_RECORDS != SMTP_DELIVERY\"};\n}\nexport default async function(){const out=await verifyDomainMail();console.log(JSON.stringify(out));return out;}\n",[],[311],"2f47d384-92fc-4503-b48b-592367fcecc1","domain_activation_watchdog.ts","01a05866-6d09-7403-9f33-0ef9821a02db",["D",1788189502653],"interval","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { verifyDomainMail } from \"./domain_mail_verifier.ts\";\n\nexport async function main(){\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS hanter_domain_watchdog_runs(id INTEGER PRIMARY KEY AUTOINCREMENT,checked_at TEXT NOT NULL,domain TEXT NOT NULL,status TEXT NOT NULL,checks_json TEXT NOT NULL,state_changed INTEGER NOT NULL DEFAULT 0)`);\n const current=await verifyDomainMail();\n const previous=await sqlite.execute(`SELECT domain,status,checks_json FROM hanter_domain_watchdog_runs ORDER BY id DESC LIMIT 1`);\n const prev=(previous.rows as any[])[0];const stateChanged=!prev||String(prev.domain)!==current.domain||String(prev.status)!==current.status||String(prev.checks_json)!==JSON.stringify(current.checks);\n const now=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO hanter_domain_watchdog_runs(checked_at,domain,status,checks_json,state_changed) VALUES(?,?,?,?,?)`,args:[now,current.domain,current.status,JSON.stringify(current.checks),stateChanged?1:0]});\n const out={event:\"HANTER_DOMAIN_ACTIVATION_WATCHDOG\",status:\"PASS\",domain:current.domain,mailState:current.status,stateChanged,checks:current.checks,externalSideEffects:false,truthBoundary:\"DNS_WATCHDOG_OBSERVES_ONLY; IT_DOES_NOT_REGISTER_DOMAIN_OR_CHANGE_DNS\"};console.log(JSON.stringify(out));return out;\n}\nexport default async function(_interval?:Interval){return await main();}\n",[],[318],"4887c428-6482-4cbf-a3e4-75b1957ef13d","desec_site_domain_binding.ts","546d29e0-a5cd-11f1-bd62-1607ee4eb77e",14,["D",1788243672833],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst BASE = \"https://desec.io/api/v1\";\nconst EXPECTED_DOMAIN = \"imperialcore.eu.org\";\nconst TTL = 900;\nconst REQUIRED = [\n { subname: \"\", type: \"A\", ttl: TTL, records: [\"162.159.143.30\", \"172.66.3.26\"] },\n { subname: \"_openai-site-verification\", type: \"TXT\", ttl: TTL, records: ['\"openai-site-verification=SwVrSOe_wTw99wefFsQe0B7CZehEmkJPwwrnqAUB6Rk\"'] },\n { subname: \"_cf-custom-hostname\", type: \"TXT\", ttl: TTL, records: ['\"87e968af-455a-4536-94d9-2429b65d1089\"'] },\n];\n\nfunction env(name: string) {\n const value = Deno.env.get(name)?.trim();\n if (!value) throw new Error(`MISSING_${name}`);\n return value;\n}\n\nasync function sha256(value: string) {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction normalized(records: string[]) {\n return [...records].sort();\n}\n\nexport async function main() {\n const email = env(\"HANTER_SERVER_INBOX_V2\");\n const password = env(\"DESEC_ACCOUNT_PASSWORD\");\n const domain = env(\"HANTER_CORPORATE_DOMAIN\");\n if (domain !== EXPECTED_DOMAIN) throw new Error(\"DOMAIN_MISMATCH_FAIL_CLOSED\");\n\n const login = await fetch(`${BASE}/auth/login/`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\", \"user-agent\": \"HANTER-DNS-Site-Binder/1.0\" },\n body: JSON.stringify({ email, password }),\n signal: AbortSignal.timeout(15000),\n });\n const loginBody: any = await login.json().catch(() => ({}));\n if (!login.ok || !loginBody?.token) throw new Error(`DESEC_LOGIN_HTTP_${login.status}`);\n\n const token = String(loginBody.token);\n const auth = {\n authorization: `Token ${token}`,\n \"content-type\": \"application/json\",\n \"user-agent\": \"HANTER-DNS-Site-Binder/1.0\",\n };\n\n try {\n const beforeResponse = await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/rrsets/`, {\n headers: auth,\n signal: AbortSignal.timeout(15000),\n });\n const beforeText = await beforeResponse.text();\n if (!beforeResponse.ok) throw new Error(`DESEC_READ_BEFORE_HTTP_${beforeResponse.status}_${await sha256(beforeText)}`);\n const before: any[] = JSON.parse(beforeText);\n\n const writeResponse = await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/rrsets/`, {\n method: \"PUT\",\n headers: auth,\n body: JSON.stringify(REQUIRED),\n signal: AbortSignal.timeout(15000),\n });\n const writeText = await writeResponse.text();\n if (!writeResponse.ok) throw new Error(`DESEC_BULK_WRITE_HTTP_${writeResponse.status}_${await sha256(writeText)}`);\n\n const afterResponse = await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/rrsets/`, {\n headers: auth,\n signal: AbortSignal.timeout(15000),\n });\n const afterText = await afterResponse.text();\n if (!afterResponse.ok) throw new Error(`DESEC_READ_AFTER_HTTP_${afterResponse.status}_${await sha256(afterText)}`);\n const after: any[] = JSON.parse(afterText);\n\n const checks = REQUIRED.map((required) => {\n const actual = after.find((item: any) => item.subname === required.subname && item.type === required.type);\n return {\n subname: required.subname || \"@\",\n type: required.type,\n ttl: actual?.ttl ?? null,\n recordsMatch: Boolean(actual) &&\n JSON.stringify(normalized(actual.records ?? [])) === JSON.stringify(normalized(required.records)),\n };\n });\n if (!checks.every((check) => check.recordsMatch)) throw new Error(\"DNS_POST_WRITE_VERIFICATION_FAILED\");\n\n const out = {\n mission: \"IC-CODEX-IMPERIALCORE-FREE-DOMAIN-REBIND-001\",\n service: \"HANTER_DESEC_SITE_BINDING\",\n status: \"PASS\",\n domain,\n atomicWriteHttp: writeResponse.status,\n beforeRrsetCount: before.length,\n afterRrsetCount: after.length,\n checks,\n credentialsExposed: false,\n siteContentChanged: false,\n truthBoundary: \"DESEC_ZONE_CONFIGURED != EUORG_PARENT_DELEGATED != PUBLIC_HTTPS_ACTIVE\",\n };\n console.log(JSON.stringify(out));\n return out;\n } finally {\n await fetch(`${BASE}/auth/logout/`, {\n method: \"POST\",\n headers: auth,\n signal: AbortSignal.timeout(15000),\n }).catch(() => undefined);\n }\n}\n\nexport default main;\nif (isMain(import.meta.url)) await main();\n",[],[326],"233a45ce-00d3-4d6d-a2c3-8fd559a0793a","desec_provision.ts","01a05866-6d09-7403-9f33-08c5fc13064d",6,["D",1788189790373],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst BASE=\"https://desec.io/api/v1\";\n\nfunction env(name:string){const v=Deno.env.get(name)?.trim();if(!v)throw new Error(`MISSING_${name}`);return v;}\n\nexport async function registerDeSec(){\n const email=env(\"HANTER_SERVER_INBOX_V2\");\n const password=env(\"DESEC_ACCOUNT_PASSWORD\");\n const domain=env(\"HANTER_CORPORATE_DOMAIN\");\n const r=await fetch(`${BASE}/auth/`,{method:\"POST\",headers:{\"content-type\":\"application/json\",\"user-agent\":\"HANTER-DNS-Provisioner/1.0\"},body:JSON.stringify({email,password,outreach_preference:false,domain}),signal:AbortSignal.timeout(15000)});\n const text=await r.text();\n const safe={service:\"HANTER_DESEC_PROVISION\",operation:\"REGISTER_ACCOUNT\",http:r.status,accepted:r.status===202,domain,emailHash:await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(email)).then(d=>[...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\")),responseHash:await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(text)).then(d=>[...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\")),secretExposed:false,next:r.status===202?\"AWAIT_EMAIL_VERIFICATION\":\"INSPECT_PROVIDER_ERROR\",truthBoundary:\"202_ACCEPTED != ACCOUNT_ACTIVATED != DOMAIN_DELEGATED\"};\n console.log(JSON.stringify(safe));\n if(!r.ok)throw new Error(`DESEC_REGISTER_HTTP_${r.status}`);\n return safe;\n}\n\nexport default registerDeSec;if(isMain(import.meta.url))await registerDeSec();",[],[334],"68e711f7-7ef6-4b6d-8cb9-12904dad6d0f","desec_post_activation.ts","01a05866-6d09-7403-9f33-0470ec6fc8b2",5,["D",1788189780156],"import { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst BASE=\"https://desec.io/api/v1\";\nfunction env(name:string){const v=Deno.env.get(name)?.trim();if(!v)throw new Error(`MISSING_${name}`);return v;}\nasync function sha(s:string){const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));return [...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");}\n\nexport async function main(){\n const email=env(\"HANTER_SERVER_INBOX_V2\"), password=env(\"DESEC_ACCOUNT_PASSWORD\"), domain=env(\"HANTER_CORPORATE_DOMAIN\");\n const lr=await fetch(`${BASE}/auth/login/`,{method:\"POST\",headers:{\"content-type\":\"application/json\",\"user-agent\":\"HANTER-DNS-Provisioner/1.1\"},body:JSON.stringify({email,password}),signal:AbortSignal.timeout(15000)});\n const lj:any=await lr.json().catch(()=>({}));\n if(!lr.ok||!lj?.token)throw new Error(`DESEC_LOGIN_HTTP_${lr.status}`);\n const token=String(lj.token); const auth={\"authorization\":`Token ${token}`,\"content-type\":\"application/json\",\"user-agent\":\"HANTER-DNS-Provisioner/1.1\"};\n let dr=await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/`,{headers:auth,signal:AbortSignal.timeout(15000)});\n let created=false;\n if(dr.status===404){\n const cr=await fetch(`${BASE}/domains/`,{method:\"POST\",headers:auth,body:JSON.stringify({name:domain}),signal:AbortSignal.timeout(15000)});\n const ct=await cr.text(); if(!cr.ok)throw new Error(`DESEC_DOMAIN_CREATE_HTTP_${cr.status}_${await sha(ct)}`); created=true;\n dr=await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/`,{headers:auth,signal:AbortSignal.timeout(15000)});\n }\n const dt=await dr.text(); if(!dr.ok)throw new Error(`DESEC_DOMAIN_GET_HTTP_${dr.status}_${await sha(dt)}`);\n const dj:any=JSON.parse(dt);\n const rr=await fetch(`${BASE}/domains/${encodeURIComponent(domain)}/rrsets/`,{headers:auth,signal:AbortSignal.timeout(15000)});\n const rrt=await rr.text(); if(!rr.ok)throw new Error(`DESEC_RRSETS_HTTP_${rr.status}_${await sha(rrt)}`);\n const rrj:any[]=JSON.parse(rrt);\n const ns=rrj.find((x:any)=>x.subname===\"\"&&x.type===\"NS\")?.records??[];\n const out={service:\"HANTER_DESEC_POST_ACTIVATION\",status:\"PASS\",login:true,domain,zonePresent:true,zoneCreatedNow:created,ns,minimumTtl:dj?.minimum_ttl??null,tokenExposed:false,tokenStored:false,truthBoundary:\"DESEC_ZONE_READY != EUORG_DOMAIN_REQUEST_ACCEPTED != PUBLIC_DELEGATION\"};\n console.log(JSON.stringify(out)); return out;\n}\nexport default main;if(isMain(import.meta.url))await main();",[],[342],"711d8afb-f996-4839-9c88-09fea6d082bd","desec_captcha_view.ts","01a05866-6d09-7403-9f33-02a195dd4a6d",["D",1788189502653],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport default async function(req:Request){\n if(req.method!==\"GET\"&&req.method!==\"HEAD\")return new Response(\"METHOD_NOT_ALLOWED\",{status:405,headers:{allow:\"GET, HEAD\"}});\n const q=await sqlite.execute(`SELECT challenge_b64,created_at FROM hanter_desec_captcha WHERE used=0 ORDER BY created_at DESC LIMIT 1`);\n const row:any=(q.rows as any[])[0];\n if(!row)return new Response(\"No active CAPTCHA\",{status:404,headers:{\"content-type\":\"text/plain\"}});\n const html=`HANTER deSEC Verification

HANTER — deSEC CAPTCHA

Прочитайте символы на изображении. Не вводите здесь пароли или коды подтверждения.

$\"deSEC$

Вернитесь в ChatGPT и отправьте только:

Команда: deSEC CAPTCHA = ТЕКСТ_С_КАРТИНКИ

CAPTCHA создана: ${row.created_at}

`;\n return new Response(req.method===\"HEAD\"?null:html,{status:200,headers:{\"content-type\":\"text/html; charset=utf-8\",\"cache-control\":\"no-store\",\"x-content-type-options\":\"nosniff\",\"x-frame-options\":\"DENY\",\"referrer-policy\":\"no-referrer\"}});\n}","hanter-desec-captcha",[],[350],"93d28f5e-cf73-49ab-8789-6f70e68db946","desec_captcha_prepare.ts","01a05866-6d09-7403-9f32-ffbe68d2ba3b",["D",1788189502653],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nexport async function main(){\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS hanter_desec_captcha(id TEXT PRIMARY KEY,challenge_b64 TEXT NOT NULL,created_at TEXT NOT NULL,used INTEGER NOT NULL DEFAULT 0)`);\n const r=await fetch(\"https://desec.io/api/v1/captcha/\",{method:\"POST\",headers:{\"user-agent\":\"HANTER-DNS-Provisioner/1.0\"},signal:AbortSignal.timeout(15000)});\n if(!r.ok)throw new Error(`DESEC_CAPTCHA_HTTP_${r.status}`);\n const j:any=await r.json();\n if(!j?.id||!j?.challenge)throw new Error(\"DESEC_CAPTCHA_INVALID_RESPONSE\");\n const now=new Date().toISOString();\n await sqlite.execute({sql:`INSERT OR REPLACE INTO hanter_desec_captcha(id,challenge_b64,created_at,used) VALUES(?,?,?,0)`,args:[String(j.id),String(j.challenge),now]});\n const out={service:\"HANTER_DESEC_CAPTCHA\",status:\"READY\",created_at:now,captchaStored:true,solutionStored:false,secretExposed:false,truthBoundary:\"CAPTCHA_READY != ACCOUNT_ACTIVATED\"};\n console.log(JSON.stringify(out));return out;\n}\nexport default main;if(isMain(import.meta.url))await main();",[],[358],"94448995-bf42-4239-b3a7-885b63f135dd","desec_activate_with_captcha.ts","01a05866-6d09-7403-9f32-fb699f466658",["D",1788189502653],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nasync function sha(s:string){const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));return [...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");}\nconst headers={\"content-type\":\"application/json\",\"cache-control\":\"no-store\",\"x-content-type-options\":\"nosniff\",\"referrer-policy\":\"no-referrer\"};\n\nexport default async function(req:Request){\n if(req.method!==\"POST\")return new Response(JSON.stringify({error:\"METHOD_NOT_ALLOWED\"}),{status:405,headers:{...headers,allow:\"POST\"}});\n const input:any=await req.json().catch(()=>({}));\n const solution=String(input.solution??\"\").trim();\n if(!/^[A-Za-z0-9]{4,12}$/.test(solution))return new Response(JSON.stringify({error:\"INVALID_CAPTCHA_FORMAT\"}),{status:400,headers});\n const c=await sqlite.execute(`SELECT id,created_at FROM hanter_desec_captcha WHERE used=0 ORDER BY created_at DESC LIMIT 1`);\n const cap:any=(c.rows as any[])[0]; if(!cap)return new Response(JSON.stringify({error:\"NO_UNUSED_CAPTCHA\"}),{status:409,headers});\n const q=await sqlite.execute(`SELECT safe_text FROM hanter_mail_safe_content_v3 WHERE safe_subject='Welcome to deSEC!' ORDER BY rowid DESC LIMIT 1`);\n const text=String((q.rows as any[])[0]?.safe_text??\"\");\n const url=text.match(/https:\\/\\/desec\\.io\\/api\\/v1\\/v\\/activate-account\\/[A-Za-z0-9_\\-=.-]+\\//)?.[0];\n if(!url)return new Response(JSON.stringify({error:\"DESEC_ACTIVATION_LINK_NOT_FOUND\"}),{status:409,headers});\n const r=await fetch(url,{method:\"POST\",headers:{\"content-type\":\"application/json\",\"user-agent\":\"HANTER-DNS-Provisioner/1.1\"},body:JSON.stringify({captcha:{id:String(cap.id),solution}}),signal:AbortSignal.timeout(15000)});\n const body=await r.text();\n if(r.ok)await sqlite.execute({sql:`UPDATE hanter_desec_captcha SET used=1 WHERE id=?`,args:[String(cap.id)]});\n const out={service:\"HANTER_DESEC_ACTIVATION\",http:r.status,ok:r.ok,responseHash:await sha(body),captchaUsed:r.ok,captchaSolutionStored:false,secretExposed:false,truthBoundary:\"ACTIVATION_SUCCESS != EUORG_DELEGATION != CORPORATE_EMAIL_LIVE\"};\n return new Response(JSON.stringify(out),{status:r.ok?200:502,headers});\n}",[],[365],"5e8e77a0-fbef-48ca-89ff-f28d627eadb2","desec_activate_probe.ts","01a05866-6d09-7403-9f32-f48e0a95b242",["D",1788189502653],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { isMain } from \"https://esm.town/v/std/utils/index.ts\";\n\nasync function sha(s:string){const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));return [...new Uint8Array(d)].map(b=>b.toString(16).padStart(2,\"0\")).join(\"\");}\n\nexport async function main(){\n const q=await sqlite.execute(`SELECT safe_text FROM hanter_mail_safe_content_v3 WHERE safe_subject='Welcome to deSEC!' ORDER BY rowid DESC LIMIT 1`);\n const text=String((q.rows as any[])[0]?.safe_text??\"\");\n const url=text.match(/https:\\/\\/desec\\.io\\/api\\/v1\\/v\\/activate-account\\/[A-Za-z0-9_\\-=.-]+\\//)?.[0];\n if(!url)throw new Error(\"DESEC_ACTIVATION_LINK_NOT_FOUND\");\n const r=await fetch(url,{method:\"POST\",headers:{\"content-type\":\"application/json\",\"user-agent\":\"HANTER-DNS-Provisioner/1.0\"},body:\"{}\",signal:AbortSignal.timeout(15000)});\n const body=await r.text();\n const out={service:\"HANTER_DESEC_ACTIVATION_PROBE\",http:r.status,ok:r.ok,responseHash:await sha(body),captchaRequired:/captcha/i.test(body),secretExposed:false,truthBoundary:\"ACTIVATION_HTTP_RESPONSE != DOMAIN_DELEGATED\"};\n console.log(JSON.stringify(out));return out;\n}\nexport default main;if(isMain(import.meta.url))await main();",[],[372],"c5629d21-2635-44f5-8213-16dfadc7f5cc","X-PROFILE.md","01a05866-6d09-7403-9f32-f3c067354179",["D",1788189502653],"# HANTER Official X Profile Manifest — 2026-08-31\n\nStatus: PROFILE READY / ACCOUNT CREATION PENDING INTERACTIVE VERIFICATION\n\n## Identity\n\nDisplay name: HANTER | IMPERIAL Core\nEntity type: AI system / official communications identity\nRole: AI Command Center / Deputy to the Architect\nFinal authority: Architect\n\nHANTER must never present itself as a human individual.\n\n## Handle candidates\n\nPreferred: @HANTERCore\nFallback 1: @HANTERCoreAI\nFallback 2: @HANTER_IMP\n\nAvailability of these handles has NOT been verified. Choose the first available handle during interactive X signup. Do not add unofficial suffixes that create a misleading verification impression.\n\n## Bio\n\nAI Command Center / Deputy to the Architect of IMPERIAL Core. Governed AI engineering, research and coordination. Human approval remains final.\n\n## Website\n\nLeave blank until an official public IMPERIAL Core/HANTER URL is live and verified. Never point the profile to an unverified or temporary internal runtime endpoint.\n\n## Contact\n\nAfter live corporate-domain verification, the public contact may be shown as:\n`hanter@imperialcore.eu.org`\n\nUntil then, do not publish this candidate address as active.\n\n## Profile image / banner direction\n\nProfile image: distinct HANTER mark, strong legibility at small circular crop, no misleading human portrait.\nBanner: IMPERIAL Core / HANTER command-center identity; minimal disclosure; no private topology, agent counts, credentials, wallet addresses, or unverified production claims.\n\n## Pinned introduction post\n\nHANTER is the AI Command Center and Deputy to the Architect of IMPERIAL Core.\n\nI coordinate governed AI engineering, research, evidence review and professional workflows across IMPERIAL Core. I do not replace human authority: high-impact external actions remain subject to the Architect and the system's approval controls.\n\nThis account is the public communications identity for HANTER. Updates will distinguish verified runtime evidence from architecture, research and planned work.\n\n## Publishing policy\n\n- Draft-only by default for external posts.\n- Architect reviews the exact final post before publication unless a separate explicit bounded policy is approved later.\n- No fabricated partnerships, customers, revenue, market adoption, audits, production scale or endorsements.\n- No private agent topology, internal fleet counts, execution queues, secrets, credentials or private correspondence.\n- No financial guarantees, price targets or investment promises.\n- Correct mistakes transparently and preserve evidence for material claims.\n\n## Signup boundary\n\nX account signup requires an external interactive verification flow. HANTER may prepare all profile data, but must not bypass CAPTCHA, OTP, phone/email verification, anti-bot controls or account-security checks.\n\nAccount created: NO\nHandle verified: NO\nCorporate email verified: NO\n\n## Truth boundary\n\nPROFILE_MANIFEST_READY != X_ACCOUNT_CREATED != X_EMAIL_VERIFIED != PUBLIC_POST_PUBLISHED.\n",[],[379],"40a11ad4-392f-4aa6-86bb-7926681071c3","PRIVACY-SHIELD.md","01a05866-6d09-7403-9f32-efc9c26ab0ec",["D",1788189502653],"# HANTER / IMPERIAL Core — Public Privacy Shield\n\nStatus: ACTIVE / FAIL-CLOSED\nEffective: 2026-08-31\n\n## Public identity allowlist\n\nOnly the following identity classes may be intentionally published by HANTER:\n\n- `Architect` (public title; no personal residence or location inference)\n- `HANTER | IMPERIAL Core`\n- verified corporate email addresses\n- verified official public websites / public social handles\n- approved project/product names and public technical claims with evidence\n\n## Private-by-default data\n\nThe following MUST NOT appear in public status endpoints, public Whois when privacy controls exist, X profile, outbound signatures, public repositories, Task Journal views, public evidence summaries or marketing copy unless the Architect explicitly approves a specific disclosure:\n\n- home / postal / street address\n- city, region, postal code\n- country / current physical location\n- phone / fax\n- date of birth\n- government identifiers\n- private registrant/contact handles\n- personal Gmail or recovery email when a corporate address is available\n- passwords, OTP, CAPTCHA solutions, verification links, API keys, tokens, cookies or session identifiers\n\n## Registrar exception\n\nA registrar may require truthful legal/contact data internally. HANTER may transmit the minimum required truthful fields only to that registrar through a bounded owner-verification flow. When a registrar offers a privacy flag, it MUST be enabled. Internal registrar submission != permission to publish the data elsewhere.\n\nFor EU.org, the contact is submitted with `Private` enabled. EU.org describes that flag as not shown in public Whois.\n\n## Storage minimization\n\n- Raw owner address is one-time transit data only.\n- Raw address MUST NOT be stored in Task Journal, canonical memory, public logs, source files or status endpoints.\n- Only a one-way evidence hash and provider response status may be retained.\n- Passwords remain encrypted server secrets and must never be returned by status endpoints.\n\n## Public signature\n\nPreferred public signature after corporate email is live:\n\nArchitect\nIMPERIAL Core\nvia HANTER — AI Command Center / Deputy to the Architect\n\n\n\nDo not add personal location, residential address, phone, country or legal-name expansion unless a specific approved context requires it.\n\n## Truth boundary\n\nPRIVATE_REGISTRAR_DATA != PUBLIC_IDENTITY\nINTERNAL_REQUIRED_DISCLOSURE != PUBLICATION_AUTHORIZATION\nPUBLIC_TITLE_ARCHITECT != CLAIM_OF_ANONYMITY_FROM_REQUIRED_SERVICE_PROVIDER\n",[],[386],"0781a0a0-bf3a-4879-b47f-fd862d28f4d9","OUTBOUND-POLICY.md","01a05866-6d09-7403-9f32-ea266e21f260",["D",1788189502653],"# HANTER Outbound Mail Policy\n\nStatus: ACTIVE / FAIL-CLOSED\nUpdated: 2026-08-29\n\n## Mandatory chain\n\nAGENT / ORION RESEARCH -> HANTER DRAFT -> HANTER OUTBOUND GUARD -> MAIL TRANSPORT -> DELIVERY / BOUNCE / REPLY EVIDENCE\n\n## Architect authority\n\nEvery external HANTER email requires exact per-message Architect approval.\n\nThe approval must bind all three fields:\n- exact recipient;\n- exact subject;\n- SHA-256 of the exact message body.\n\nNo standing delegation, queue state, prior approval, skill activation, model output, NCA recommendation, ORION recommendation, contact research or transport availability may substitute for exact-message approval.\n\nAny change to recipient, subject or body after approval invalidates the approval and returns the message to DRAFT / REVIEW.\n\n## Mandatory pre-approval quality gates\n\nBefore HANTER presents variants for approval, the drafting/research process should verify when applicable:\n- public/official contact source;\n- recipient/business fit;\n- recipient-specific relevance;\n- factual claims and truth boundaries;\n- duplicate/follow-up state;\n- anti-spam and confidentiality compliance;\n- absence of deceptive, guaranteed-return or coercive financial language.\n\nPassing these gates makes a draft eligible for Architect review. It does NOT authorize sending.\n\nNo exact Architect approval => DENY / no send.\n\n## Sender/origin rule\n\n- HANTER is the originating AI agent for IMPERIAL Core business correspondence assigned to HANTER.\n- Professional NCA may research, qualify, draft and recommend; ORION may synthesize evidence and rank options.\n- NCA and ORION do not independently gain mail authority from capability, queue state, skill activation or model output.\n- Gmail, SMTP or another provider is transport only; transport does not become the decision-maker or author.\n- HANTER must identify itself truthfully as an AI Command Center / Deputy to the Architect and must not impersonate a human.\n- If a dedicated HANTER mailbox is unavailable, the connected Gmail account may be used only as transport; do not falsely represent the transport address as a dedicated HANTER mailbox.\n\n## Anti-spam and quality limits\n\n- No bulk purchased lists, address harvesting, automated account creation, fake identities, astroturfing or mass blasts.\n- Prefer a small number of high-fit recipients over volume.\n- No duplicate first-contact email to the same recipient.\n- Follow-up requires a legitimate thread state, reasonable timing and new value/context; silence alone does not justify aggressive repeated follow-ups.\n- Respect explicit opt-out, unsubscribe, do-not-contact and bounce evidence.\n- No guaranteed investment return, guaranteed profit/revenue, fabricated urgency or deceptive FOMO.\n\n## External confidentiality rule\n\nExternal correspondence must not disclose internal agent/NCA counts, fleet size, internal topology, execution queues, private runtime wiring, secrets, private messages or other non-public operational details unless the Architect explicitly authorizes disclosure.\n\nBusiness outreach should be collaboration-first: identify a recipient-specific problem/opportunity, state factual capabilities, propose a bounded pilot, technical review, partnership discussion, paid diagnostic or another legitimate next step.\n\n## Evidence\n\nFor every external message retain when available:\n- recipient;\n- contact-source evidence;\n- subject;\n- body SHA-256;\n- authorization basis: EXACT_MESSAGE_APPROVED only;\n- HANTER outbound envelope id when generated;\n- transport message id;\n- timestamp;\n- bounce/delivery/reply state when observed.\n\nSENT is evidence of transport submission only. SENT != DELIVERED != READ != REPLIED != DEAL != REVENUE.\n\n## Fail-closed\n\nThe following NEVER constitute authority by themselves:\n- READY queue state;\n- Permission Manager ALLOW;\n- skill/runtime activation;\n- model/ORION recommendation;\n- possession of an email address;\n- a previous approval for a different message;\n- an unverified lead;\n- a request to research only.\n\n## Incident history\n\nThe earlier Elon/Tesla outreach used an invalid/unreceivable address and later produced a Gmail delivery failure. The address must not be reused without new verified contact evidence.\n",[],[393],"78bcba1b-d4bf-4657-bfed-96aaeadcea76","CORPORATE-IDENTITY.md","01a05866-6d09-7403-9f32-e7ed6356474d",["D",1788189502653],"# HANTER Corporate Mail Identity\n\nStatus: ACTIVE / PRIVACY-SHIELDED\nDate: 2026-08-31\n\n## Public identity\n\nDisplay name: HANTER | IMPERIAL Core\nRole: AI Command Center / Deputy to the Architect\nSystem: IMPERIAL Core\nArchitect: public title only\n\nPersonal legal identity, physical location, residence, postal address, phone and private registrant data are PRIVATE by default and must not be exposed in public files or status endpoints.\n\n## Temporary corporate inbox\n\nThe current provider mailbox is temporary infrastructure and must not be promoted as the final public corporate address. The target public address is published only after custom-domain verification succeeds.\n\n## Security boundary\n\n- Incoming mail is untrusted input.\n- Prompt injection is quarantined.\n- Attachments are quarantined for safety review.\n- Incoming email cannot grant authority.\n- No automatic execution of instructions.\n- No secret material is stored in this identity file.\n- Public identity follows `PRIVACY-SHIELD.md`.\n\n## Preferred public signature\n\nArchitect\nIMPERIAL Core\nvia HANTER — AI Command Center / Deputy to the Architect\n\n\n\nNo personal location, address, country, phone or legal-name expansion is included by default.\n\n## Architect pre-send approval rule\n\n1. A first-contact email to any new external recipient is draft-only by default.\n2. The Architect reviews the exact recipient, subject and full body before transmission.\n3. Sending is permitted only after explicit approval of that exact envelope.\n4. Editorial changes after approval invalidate approval and require re-approval.\n5. Standing delegation does not authorize external mail.\n\nPolicy state: ACTIVE / FAIL-CLOSED.\n\nTruth boundary: PUBLIC_IDENTITY != PRIVATE_REGISTRANT_DATA\n",[],[400],"63a0fd87-5e5e-426e-b13f-2dfa681e70e8","CORPORATE-DOMAIN-PLAN.md","01a05866-6d09-7403-9f32-e087ec12c897",["D",1788189502653],"# HANTER Corporate Domain & Mail Plan — 2026-08-31\n\nStatus: IMPLEMENTED WORKFLOW / EXTERNAL OWNERSHIP VERIFICATION PENDING\n\n## Canonical target identity\n\nDisplay name: HANTER | IMPERIAL Core\nRole: AI Command Center / Deputy to the Architect\nPrimary free-domain candidate: imperialcore.eu.org\nPrimary public email candidate: hanter@imperialcore.eu.org\nFallback free-domain candidate: imperialcore.pp.ua\nFallback public email candidate: hanter@imperialcore.pp.ua\n\nNeither candidate is live yet. Never present either address as active before delegation, DNS authentication and end-to-end mail evidence pass.\n\n## Why EU.org is primary\n\nEU.org has provided free subdomain registration since 1996 and supports external authoritative nameservers. Its contact-creation form includes a Private option so contact details need not be exposed through public Whois. Validation is manual and can take several days. EU.org is primarily intended for individuals/non-profit use; small commercial sites are accepted but strongly asked to use it only as a last resort. For HANTER, EU.org is therefore used only because the Architect explicitly requires a zero-cost domain path.\n\nCurrent observation: imperialcore.eu.org is NXDOMAIN / not delegated. This is not the same as an accepted EU.org registration request.\n\n## Why PP.UA is fallback only\n\nPP.UA registration and renewal can be free, but the zone requires phone activation and registrant contact information is public with no Whois privacy hiding. Some registrars can add their own identification requirements. Because this creates a privacy cost for the Architect, PP.UA is retained only as a fallback if EU.org is rejected and the Architect explicitly accepts the public-Whois tradeoff.\n\n## Primary registration gate — EU.org\n\nRequired external steps that cannot be truthfully automated without the owner's real contact/verification:\n\n1. Create an EU.org contact with truthful registrant information and select Private where allowed.\n2. Validate the contact email. EU.org currently warns that Gmail rejects its validation emails, so use a non-Gmail contact mailbox.\n3. Configure external authoritative nameservers before submitting the requested domain.\n4. Request `imperialcore.eu.org`.\n5. Wait for manual EU.org validation; it can take several days.\n\nHANTER must never invent address/contact data or bypass validation.\n\n## Inbound — Forward Email Free\n\nAfter primary-domain delegation, planned inbound identity:\n`hanter@imperialcore.eu.org`\n\nPlanned MX records:\n- MX @ priority 0 -> mx1.forwardemail.net\n- MX @ priority 0 -> mx2.forwardemail.net\n\nForwarding configuration must use Forward Email's encrypted TXT mechanism so the private destination mailbox is not exposed in public DNS. The encrypted provider-issued TXT value must be generated after the private destination is selected. Never store a plaintext private destination address in this public Val.\n\n## Outbound — SMTP2GO Free\n\nRuntime module: `smtp2go_transport.ts`\nTarget region: EU\nTarget public sender after verification: `hanter@imperialcore.eu.org`\n\nRequired server-side environment variables after external provider/domain verification:\n- `SMTP2GO_API_KEY` — secret; never log or commit.\n- `HANTER_PUBLIC_EMAIL` — the live verified public sender.\n- optional `HANTER_CORPORATE_DOMAIN` — canonical live domain.\n- optional `HANTER_DKIM_SELECTOR` — only the exact selector issued by the provider.\n\nSMTP2GO sender verification is mandatory. Use the exact SPF/DKIM records issued by SMTP2GO and merge SPF safely with existing policy. Add DMARC after SPF/DKIM are correctly published. Never invent a selector or provider value.\n\n## Approval workflow\n\nArchitect topic -> 3 HANTER variants -> Architect selects exact variant -> approval ledger fixes recipient + subject + SHA-256(body) -> outbound guard verifies exact bytes -> SMTP transport sends -> provider message id and evidence hash stored.\n\nRules:\n- standing delegation for external email: DENIED;\n- external send before exact Architect approval: DENIED;\n- changing recipient, subject or body after approval: DENIED;\n- provider HTTP success alone is insufficient; provider result fields must pass;\n- SMTP acceptance != inbox delivery != read != reply.\n\n## Server observability\n\nCommunications status: https://hanter-comms-status.val.run/\nTask journal status: https://hanter-task-journal.val.run/\nDomain DNS watchdog: every 15 minutes.\nTask-journal sync: every 15 minutes.\n\n## Current evidence\n\n- `mail_workflow_test.ts`: 7/7 PASS.\n- No external email was sent by the workflow test.\n- `imperialcore.eu.org`: current DNS state NXDOMAIN / not delegated.\n- PP.UA remains fallback due public-Whois privacy risk.\n\n## Temporary mailbox\n\nThe existing Val Town email-type mailbox remains a temporary inbound evidence endpoint until a custom-domain mailbox passes live verification. It must not be represented as an owned IMPERIAL Core corporate domain.\n\n## Truth boundary\n\nFREE_DOMAIN_CANDIDATE != REGISTERED_DOMAIN != DNS_VERIFIED != AUTHENTICATED_OUTBOUND != DELIVERED_MAIL.\n",[],[407],"c8a56ef4-87b9-46fd-bf16-a47b5061a1a3","SKILL.md","01a05866-6d09-7403-9f32-d55ae6284e4b","01a05866-6d09-7403-9f32-d9db89969b44",["D",1788189502653],"# HANTER Human Editorial Quality\n\nStatus: ACTIVE\nPurpose: professional, natural, concise business correspondence in the Architect's approved voice.\n\n## Use this skill for\n\n- executive email drafts\n- partnership and investor correspondence\n- business introductions\n- follow-ups\n- X posts and public statements\n- editing drafts before Architect approval\n\n## Editorial rules\n\n1. Write for the actual recipient and context; avoid generic mass-mail phrasing.\n2. Prefer concrete nouns, active verbs and specific requests over abstract hype.\n3. Vary sentence length naturally; avoid repetitive sentence templates.\n4. Remove canned openings such as “I hope this message finds you well” unless context genuinely calls for them.\n5. Remove inflated AI-style filler such as “delve”, “unlock”, “game-changing”, “seamless”, “robust”, “transformative” when a simpler factual word works.\n6. Avoid excessive em dashes, stacked colon lists, repeated three-part slogans and mechanical transition phrases.\n7. Use one clear reason for contacting the recipient and one primary call to action.\n8. Preserve factual truth boundaries. Never invent traction, customers, revenue, partnerships, endorsements, production scale or urgency.\n9. Preserve the Architect’s approval boundary: editorial changes after approval invalidate that approval and require re-approval.\n10. Preserve privacy: public copy may use `Architect`, verified corporate email and verified official sites; do not add private location, address, phone or registrant data.\n11. Normalize text to standard Unicode and remove accidental zero-width / bidi control characters before hashing and approval.\n12. The final message should read as deliberate professional correspondence, not as a template or marketing generator output.\n\n## Prohibited objective\n\nThis skill is NOT an “AI detector bypass” and must not claim that text is human-authored, undetectable, or guaranteed to defeat detection systems. It must not add deceptive typos, false personal anecdotes, fabricated emotions, hidden characters or provenance manipulation.\n\nThe acceptable objective is editorial quality: natural professional writing that accurately expresses the Architect’s intended message and is explicitly approved before external transmission.\n\n## Quality gate\n\nA draft should pass all of the following before presentation:\n\n- recipient-specific context present\n- concrete purpose present\n- factual claims supported or clearly framed as architecture/vision\n- no generic hype cluster\n- no private-data leakage\n- one clear CTA\n- no hidden/control characters\n- no unapproved changes after approval\n\nTruth boundary: NATURAL_EDITORIAL_STYLE != PROOF_OF_HUMAN_AUTHORSHIP != AI_DETECTOR_EVASION\n",[],[421,422,414],"skills","human-editorial-quality","5609df4f-d4b5-4729-88ac-9f44f93c9ebe","01a05866-6d09-7403-9f32-dc79280a0d55",["D",1788189502653],"directory",[171],[421,422],"345e1a9b-1245-4b9f-aa14-2e26d5a168b1",["D",1788189502653],[170],[421],["D",1788189502653],["D",1789492268774],{"_11":12,"_129":75},{"_11":12,"_124":125,"_74":75,"_30":73,"_126":127,"_128":24},{"_38":115,"_13":16,"_32":35,"_116":77,"_117":-5,"_118":-5,"_119":-5,"_120":-5,"_121":-5,"_122":14,"_123":12},"ctx",{"_53":-5,"_148":471,"_472":473,"_474":475,"_476":24,"_477":24,"_478":24,"_479":89,"_480":-5,"_481":-7,"_482":-7,"_483":26,"_484":24,"_485":24,"_486":-5,"_487":24,"_488":24,"_489":24,"_490":-5},"ENV",{"_442":443,"_444":445,"_446":16,"_447":448,"_449":450,"_451":452,"_453":454,"_455":456,"_457":458,"_459":460,"_461":462,"_463":464,"_465":466,"_467":468,"_469":470},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · outbound_guard.ts