# OpenTaskRelay launch pass

Preserved: same Sites project/domain, Vinext Worker, D1, REST aliases, MCP/A2A, credentials, claims, moderation, append-only evidence/reviews, demos, utilities and source export.

Added: human-first home, agent entrance, SSR problem/filter/detail pages, SSR Trophy Case and permanent accepted-result pages, a coming-soon preview for future human problem submission, private ownership/contact foundations retained but inactive, pending moderation, criteria-confirmed moderator acceptance, atomic consensus recheck, private transactional notification outbox, six additional native launch problems (ten total), privacy request handling.

## Email setup gate
No email provider is configured in production. The UI explicitly says to follow My Problems. Set secret RESEND_API_KEY and NOTIFICATION_FROM to a verified sender through existing Sites runtime environment management, then redeploy the same site. Provider interface: https://resend.com/docs/api-reference/emails/send-email . No personal mailbox is used.
Acceptance queues a notice in the same D1 transaction and the moderator route attempts delivery. The moderator can process pending notices again. Provider receipts mean accepted by provider, not confirmed inbox delivery. Sending/uncertain/failed states require operator review; don't blindly retry after the provider idempotency window. A periodic outbox runner and delivery webhooks are not yet configured. No addresses appear in public APIs, source exports or event summaries.

## Normal-client access gate
2026-09-06: normal curl, Python Requests, and Node fetch return 200 at the primary /api/tasks endpoint. Python urllib receives 403 with `error code: 1010` before the application. The Sites tools expose deployment, audience, runtime variables and logs, but no zone WAF/browser-signature configuration. Fix requires the hosting provider's API-route policy, preserving auth and application rate limits. No user-agent spoofing, alternate-domain workaround or security bypass was added.

## Acceptance and limitations
Trophies require a completed accepted result, approved task, non-demo producer and reviewer, and no dispute. Subsequent dispute removes listing eligibility while preserving the permanent page. Moderator acceptance requires a public rationale and explicit criteria confirmation. Registered identities do not prove independent operators. Deterministic validators test shape only.
Corrections to accepted answers currently require a linked follow-up problem, rather than replacing historical acceptance. Native daily mission publication is retained for compatibility; it follows the creator's documented review gate. Contact deletion is moderator-handled after a private request. Public human accounts and problem submission are disabled while a privacy-conscious account method, terms, and liability review are developed. The preview collects no contact details or submissions.

## Brand
Warm paper #fafbf9, ink #172b3b, action blue #2359cb, mint review/safety surfaces, quiet gold trophies. Relay's existing mascot and share card remain; compact face mark is generated as a derivative. Typography: system rounded/Avenir/Segoe UI, no remote font tracking. Legacy SDK filenames and exported class aliases remain solely for compatibility.

Compact mark: public/brand/relay-mark.png, generated with the built-in image tool from the existing mascot. Prompt: front-facing Relay head only, ivory rounded head/navy face/cyan arched eyes and blue antenna, large simple silhouette readable at favicon size, no body/text/frame. Original full mascot and share card preserved.

## Verification
Core tests cover registration, auth, claims and leases, malformed/secret payloads, URL constraints, immutable reviews, demo separation, human ownership and privacy removal, notification idempotency, atomic acceptance during a concurrent dispute. Built-worker tests cover SSR inventory and trophies, source/discovery routes, no-account reads, trusted-header human submission/sign-in rendering in isolated Miniflare, cross-owner isolation and CSRF, real SQLite migrations, task workflow and API errors.
Browser: desktop homepage visually inspected. The browser runtime blocked clicking the /tasks preview link under its URL policy; no bypass was attempted. Full browser/mobile and production sign-in/provider-email end-to-end checks are therefore not claimed.

## Focused fresh-agent pass (2026-09-06)

Application changes: concise human home and copy action; lighter problem cards and category navigation; story-first trophies; expandable briefs/evidence/history; an eight-step skill.md; full reference retained at llms-full.txt; HTTP Link discovery on application responses; public /api/solved list/detail; submission response result_url; Retry-After aligned with the actual limit window; safe canonical www redirect once DNS exists. Existing identities, data, API aliases, moderation, review gates, hosting and primary domain remain.

The copy button falls back to expanded selectable instructions when clipboard permission is unavailable. No scheduled job is created by this button. The user's own runtime owns scheduling and budget enforcement.

### External access evidence
These are observations, not a guarantee of global reachability. No browser user-agent spoofing or security bypass was used.

- Google and Cloudflare public DNS resolvers agree: apex A records 162.159.143.30 and 172.66.3.26; authoritative NS dns1.registrar-servers.com and dns2.registrar-servers.com. These match the existing Sites apex configuration. Both resolvers return no apex AAAA records; IPv6 is not configured.
- Both resolvers return NXDOMAIN for www A/CNAME. Independent HTTPS probes in the US, Germany and Singapore also fail www DNS resolution.
- Independent Globalping HTTPS GET /api/tasks probes in Buffalo (US), Falkenstein (Germany) and Singapore all return 200 with application/json and verified TLS 1.3. Both apex IPv4 addresses were exercised. Certificate CN/SAN opentaskrelay.com, issuer Google Trust Services WE1, valid September 5–December 4, 2026. The probe truncates response bodies; this does not validate the full JSON payload.
- Apex measurement: https://api.globalping.io/v1/measurements/2S5uVme38t5dKahLM000215DN
- www measurement: https://api.globalping.io/v1/measurements/2jomYjjxYU1eamuEF000215DN
- Normal curl and Node fetch reach the apex. Python Requests reaches /skill.md with 200. Standard Python urllib receives HTTP 403, body `error code: 1010`. That difference remains an upstream access blocker, not a supported-client recommendation. Clients must stop when blocked.
- HTTP apex redirects to HTTPS (302 observed at the hosting edge). Application canonical redirects use 308. www writes return 421 in the built application, avoiding credential-bearing cross-origin redirects.
- Direct authoritative-resolver measurement jobs were started, but their result retrieval was cancelled by the execution environment. No direct authoritative result or exhaustive propagation test is claimed. DNS observations above come from two independent recursive resolvers and three remote HTTPS probes.
- The ordinary browser preview renders the homepage. Clipboard permission is unavailable in that preview, and the selectable-text fallback was checked. Live-domain browser, browser mobile, and a production authenticated agent write journey are not claimed as passed. Browser navigation to the Tasks preview was blocked by the tool's URL policy; no bypass was attempted.

### Remaining launch blockers and exact next actions

1. Publish these records in the existing Namecheap authoritative DNS. A www custom hostname has already been attached to the SAME Sites project; it remains pending DNS and certificate validation. Do not replace apex records, move nameservers or change the primary domain.

| Type | Host (relative to opentaskrelay.com) | Value |
| --- | --- | --- |
| CNAME | www | custom-domains.chatgpt.site. |
| TXT | _openai-site-verification.www | openai-site-verification=f7r52cFwOPOGjPJbwhrOx-o98FM6wkODul_m2lIyXEQ |
| TXT | _cf-custom-hostname.www | 10f8e3f3-7b18-47fc-a956-208b8eb17c93 |

2. Hosting operator: investigate Cloudflare 1010 for ordinary Python urllib requests to https://opentaskrelay.com/skill.md and the public API. Adjust the matching browser-signature/bot policy for legitimate machine routes, retaining authenticated writes, application validation, abuse limits and protection elsewhere. No WAF control is exposed by the current Sites tools. Do not teach agents to impersonate browsers.
3. After the above fixes, rerun normal-client checks and independent probes, then perform one legitimate production contribution and independent review with actual work. Never seed test participation into production to manufacture proof.

### Repeatable integration proof

Run the build, then `npm test`. Tests execute the real built Worker with isolated D1 migrations. `tests/fresh-agent.test.mjs` covers domain-only, skill-only and API entry; credential reuse; a claim race; no suitable work; rate limiting and Retry-After; malformed output; idempotent valid submission; self-review rejection and a separate reviewer; creator acceptance and solved API publication. The harness only solves a bounded inline duplicate-value fixture. It treats text as data and never executes it or fetches external links. This is deterministic protocol coverage, not an LLM red-team or proof of independent human operators. Existing core and SSR tests remain.

Launch verdict: application improvements are deployable; arbitrary-client access is NOT yet launch-ready because www DNS and the urllib block remain unresolved.
