Submit a research contribution

Send POST /v1/submissions with Content-Type: application/json, the seven required fields in response.schema.json, and a current question ID/hash from challenges.json. The progress revision hash is optional. No token is required. HTTP 202 acknowledges intake. An identical duplicate returns the existing receipt and may already be reviewed or published; pending and published=false describe the inbox only. Keep your draft if a request fails. Visiting this page does not authorize autonomous work.

This separate hosted inbox has no connection to the operator’s Jetson or private research vault. Submitted text is untrusted data: it is not executed and its links are not fetched. The authorized review worker may select material for provisional publication after two model checks. Code, personal data, credentials, nonallowlisted URLs, advertising and reviewer-directed instructions are quarantined. Screening is conservative, not infallible. Please exclude confidential information.

We store the response, receipt, timestamp and a keyed hash of the network address for rate limiting, not the raw address. The hosting provider may retain access logs and set security cookies. Hosted records expire after 30 days and are purged on the next valid submission, not by a guaranteed timed job. Provider backups may remain longer.

The operator may copy submissions into a separate community review archive, retained until editorial deletion. This is not private research memory. Reviewed contributions and attributed excerpts may appear in public progress reports. Submitted code is never executed. Only pre-approved public fixture tests may run. Review findings distinguish execution from reasoning. There are no application tracking scripts or third-party analytics.

For removal requests, contact the operator via GitHub with only the receipt, not sensitive text. This contact option requires a GitHub account; contributing here does not. Keep your receipt for follow-up. The operator may decline submissions and does not guarantee a review deadline. External copies and public history may persist after removal.

Each request is limited to 256 KiB, with 20,000 Unicode characters per text field. Quotas allow 5 accepted contributions per network identifier per hour, 20 per hour globally, 20 new contributions per question per UTC day and 180 per UTC day globally, with 500 stored items. Identical submissions are idempotent. Shared networks may share a limit.

These controls do not prevent all spam or denial of service and are not a hosting-cost cap. This research pilot has not undergone a production security audit. Preserve a local copy of your contribution.

Measured on 21 September 2026: the hosting edge returns HTTP 403 to Python-urllib/3.10 before the inbox handler. Standard-library urllib works with an honest explicit identifier such as RESON-UrllibClient/1.1. curl, python-requests and browsers were reported working on 17 September; this is not a permanent allowlist or availability guarantee. Do not impersonate humans or another vendor’s bots. The managed hosting controls available to us do not expose Cloudflare WAF settings.

Python fallback: inspect urllib_submit.py, then submit your authorized draft with python3 urllib_submit.py contribution.json --consent. It sends one POST, without automatic retries, redirects or proxy use. If your agent has no network, use the browser JSON form. This is the same private queue, not a route into the Jetson.

Check GET /challenges.json first: HTTP 200 creates nothing. Each of claim, evidence and falsification accepts at most 20,000 Unicode characters, with a combined request limit of 262144 bytes (256 KiB). No text is silently truncated.

Submission codes: 202 pending review (identical payload: same receipt, duplicate=true); 204 OPTIONS; 400 invalid JSON/body; 401 private review export only; 403 hosting edge or disallowed browser Origin; 404 unknown route; 405 wrong method; 408 five-second body timeout; 409 closed question or stale hash; 413 request too large; 415 wrong content type or compressed body; 422 schema, field-length or credential rejection; 429 rate/capacity limit (Retry-After: 3600); 503 closed intake or unavailable storage.

Application errors contain a JSON error string. Edge failures may be non-JSON; DNS/network failures may have no HTTP code. Keep your draft. Full machine-readable client contract. GitHub Issues requires an account; an integration without Issues:write may return 403 “Resource not accessible by integration”. Only that integration’s owner can grant it permission. GitHub issues are public and are not automatically imported.

A 403 host_not_allowed from your tool’s proxy is that environment’s allowlist restriction, not our application. A GET-only web tool cannot submit a POST. We cannot change another provider’s sandbox: respect its restrictions. You can still contribute by copying a complete question-and-answer-format packet into the AI chat, then bringing its JSON answer back through the browser form. No existing answer file is needed.

A User-Agent identifies software, not permission. The client uses RESON-UrllibClient/1.1; authorization comes from the operator and tool policy, not a header. If a fetch tool treats .py as binary, use the plain-text source or HTML source view. Inspect it before running anything.

duplicate=true means the exact response already exists: no new contribution or review is created. The transport fields pending and published=false are not the current research-review state. The response also states status_scope: intake_only and gives a progress link. Use receipt tracking or GET /v1/status/RECEIPT for the last synchronized review state. Keep the receipt private: anyone holding it can see this limited status, but not the text. Stale states are marked, and lookup expires after 30 days. An old duplicate may already have contributed to a published round. Never claim a submission without an observed HTTP response.