Untrusted Intake

Tier: 3 · Normative weight: implements TM-EVD-001; supports TM-PUB-006 Requires: nothing

Problem it removes

Material arriving from outside — an emailed spreadsheet, a form submission, an exported report — gets applied where it lands. Import is update; a wrong or malicious arrival becomes current truth with no seam at which anyone could have caught it.

Mechanism

A declared intake area (inbox/, an intake table, a landing bucket) with one rule enforced at its boundary: admission is not promotion (TM-EVD-001). Arrivals are recorded with who or what sent them and when, retained in their source form where policy permits, and remain inert until reconciliation proposes — and review accepts — whatever change they support. Outside contributions through any published surface return through the same door (TM-PUB-006): an answer or approval is evidence, never a direct edit.

The intake area’s scoped guidance states what may land there and what must be refused outright, per Evidence Hygiene.

Cost

Authoring: a directory and its rules in an afternoon. Per change: arrivals gain one explicit admission step — the step that was previously implicit and unguarded. Per session: none.

Do not adopt when

Nothing arrives from outside the review boundary; all change is authored in-repository, where Git review already is the intake.

Evidence

Assessed in inference-ops (inbox for arriving material), project-proposals (proposal intake and lifecycle), and kinra-corpus; the flow intake governs customer documents.

Template

None — adopted by convention; the arrival area’s guidance carries the rules.

Related patterns

Evidence Packet is what an admitted arrival becomes when it needs durable identity.