QueryLayer forms and submissions contract

Status: active private-pilot contract

#Public intake

Public sites submit to the unauthenticated form-intake Edge Function with the Supabase publishable key. The streaming handler enforces a body-size ceiling even when Content-Length is absent, derives keyed one-way request/network markers, and calls the service-only submit_screened_form operation. Public responses are generic and never reveal whether screening allowed, quarantined, or rejected the request. Anonymous callers receive no database-function or table privileges and cannot enumerate form definitions, versions, submissions, screening events, or rate markers.

The database resolves the active immutable form version and rejects missing required fields, unexpected fields, non-text values, invalid email values, oversized values, oversized payloads, and invalid source paths. Provider-independent screening combines the honeypot, accessible low-confidence timing, duplicate payload detection, atomic per-request limits, and a form-wide ceiling that cannot be evaded by rotating request metadata. Allowed and quarantined payloads are retained; rejected traffic leaves only a privacy-safe immutable screening event and never stores its payload. Anonymous rejection events expire after 30 days.

The production contact form uses Turnstile without changing the public contract: when the server-only TURNSTILE_SECRET is installed, the intake requires a browser token and verifies it against Cloudflare before invoking the submission RPC. Missing, failed, or unavailable verification records only a payload-free challenge_missing, challenge_failed, or challenge_unavailable rejection event and returns the same generic public response. The public site renders the challenge only when PUBLIC_TURNSTILE_SITE_KEY is configured. Backup Generator Guide has both keys configured and the expected production hostname enforced.

#Private operations

Human members of the owning organization can read the site's inbox. Owners, administrators, and editors can review quarantined items, restore them to the ordinary inbox, reject them, or mark allowed items new, read, or archived. Every screening review is immutable and attributable. Only owners and administrators can permanently delete payloads. Agent content permissions do not grant access to submissions.

Inbox export is an explicit user action and downloads the currently retained rows as JSON, including the exact form version, source path, timestamps, state, and field values.

#Pilot retention

The Backup Generator Guide contact form collects name, email, subject, and message only. Each accepted submission receives an expiry timestamp 90 days after receipt. A nightly database job deletes expired payloads. Manual and retention deletions preserve only a non-sensitive audit event containing the opaque submission ID, site/form relationship, actor type, timestamp, and deletion reason.

No submission payload may be copied into public content contracts, audit details, error messages, delivery logs, or browser console logs.

#Delivery boundary

The intake function stores an allowed or quarantined submission first. Only an allowed classification may enter the Resend ledger; a database trigger enforces that boundary independently of the Edge Function. Quarantined and rejected requests never queue email. A queue error does not remove or roll back an allowed submission.

Each submission/provider pair has exactly one ledger row and one deterministic provider idempotency key. The ledger records the rendered sender, recipients, reply-to, subject, text and HTML bodies, attempt count, provider message ID, outcome, and a bounded error message. A one-minute dispatcher claims only due jobs for active integrations, recovers claims abandoned for ten minutes, applies exponential backoff, and stops after five attempts. Resend also receives the same idempotency key on every retry.

Human site members can inspect the ledger in the Inbox; anonymous visitors and browser clients cannot queue, claim, or complete deliveries. RESEND_API_KEY exists only as a Supabase Edge Function secret. Non-secret integration configuration records the intended sender, recipient, sending domain, and secret reference.

Deleting or expiring a submission redacts its reply-to and rendered message content from the ledger. The delivery outcome, attempt count, provider ID, opaque submission reference, and deletion audit remain for operations evidence without defeating the submission retention window.

Backup Generator Guide uses notifications@backupgeneratorguide.com through the verified backupgeneratorguide.com Resend sending domain. The sending-only key is server-side, the governed integration is active, and a real provider delivery was proven on 2026-09-03.

The Integrations screen and get_delivery_integration_metadata_readiness RPC expose a bounded, owner/admin-only readiness diagnostic for this boundary. It reports configuration shape and explicit blockers without reading a secret or calling Resend. Database readiness never substitutes for provider verification; the production activation is recorded separately as operating evidence.