Beta feedback — reviewed private draft and exact-event outbox

Source implementation only until isolated backend, project typecheck and installed
acceptance pass. Trigger placement remains deferred; no global feedback button.
No public issue or screenshot has been sent during qualification.

Authenticated admin feedback.collect/get/retain-reviewed/manage RPCs retain existing
CSRF and rate controls. collect selects an explicit public profile, rejecting node
identities and unavailable node identity information. It retains a private draft
with bounded diagnostics and an exact unsigned event preview. manage supports list,
prepare, screenshot-store/get/remove, upload-receipt, begin-send and finish-send.

Canonical target: signed kind30617 repository announcement d=archy owned by
npub1w3sqdkrhn0gyuvsex32effzgnfpyde6qrrc4u467flg5e9txh4wsfn5vjg.
NIP34 issue kind1621 uses exact a/p/subject tags and t="feedback from beta".
Reference: https://github.com/nostr-protocol/nips/blob/master/34.md
Only verified repository-announced relays and the selected public author's signed
kind10063 Blossom server list qualify destinations. No fallback store or mirroring.

Upstream GitWorkshop main checked 2026-11-10:
- src/factories/IssueFactory.ts retains supplied label strings as t tags and
  accepts NIP-94 imeta through extraTags.
- src/components/LabelBadge.tsx displays the label directly.
- CreateIssueForm.tsx restricts manually entered labels to letters/numbers,
  so the required spaced label cannot be entered through that input.
- useBlossomUpload.ts uses kind-10063 owner server lists and Blossom upload.
  It also supplies fallback servers and mirrors in the background; those
  behaviors must NOT be adopted for private feedback.
- Existing nsitePublishing.ts provides bounded receipt/readback and relay OK
  acknowledgement patterns. Do not reuse website-project storage for reports.

Privacy and bounds:
Draft directories0700/files0600; atomic writes and fsync precede sends. Maximum20
reports,256KiB/report,24KiB description,64KiB public event,60s node-wide collection
and submission cooldowns,8 send attempts. No automatic eviction. Reads enforce
O_NOFOLLOW, regular files and byte limits, including existing screenshot paths.
No hostname/IP/onion/hardware unique identifier or wallet state belongs in public
diagnostics. Public journal/browser error output contains only fixed categories,
codes, numeric timestamps/priorities and counts; arbitrary MESSAGE strings are
never copied. Private operation correlation remains private; public diagnostics
show only method/code/presence. Human-authored prose still requires owner review.

Collector includes bounded OS/kernel/resource/disk/inode/restart/update/app status,
known app kinds with pseudonym slots, connectivity capability booleans, and a
bounded measured running-executable hash (not attestation). Probes have byte/time
limits; unavailable evidence is explicitly unavailable. Review can omit sections
without deleting the private capture. No raw logs are automatically public.

Reusable review UI selects author, descriptions, diagnostic sections and verified
destinations, displays exact event JSON, and requires explicit confirmation before
public action. Capture is explicit browser display permission with audio disabled;
tracks always stop. Crop/opaque mask editor and removal precede retained pixels.
At most3 PNG attachments,1MiB each,1920x1080; metadata rejected/removed. Users must
review pixels because image contents cannot be guaranteed anonymous automatically.

Uploads occur only after review to the selected owner-configured Blossom server,
with exact author-signed kind24242 hash/size/server/expiry authorization, cookies
omitted and redirects rejected. HTTP402 never triggers payment. Descriptor and
bounded readback must match exact bytes/hash before an upload receipt is retained.
An upload may remain public if a later step fails; errors say so.

The outbox verifies the complete retained repository/store signed proofs, author,
attachment metadata and reconstructed review digest on every load/begin/retry.
Retained event signature/id and exact pubkey/kind/content/tags/created_at must match
the reviewed preview. Timestamp binds the original draft/signing context, never a
fresh retry TTL. Browser revalidates retained bindings before uploads and after
begin-send. A retry sends the same event; it never signs a replacement issue.
Durable per-relay attempt receipts precede/record network action. Only matching
Nostr OK event IDs count as accepted. Lost ACK remains retryable with the same ID;
already accepted reports do not resend. Receipts are browser-observed, not native
independent relay attestations. Failed drafts remain private and resumable.

Remaining qualification: isolated native compile/tests; full project typecheck;
installed owner/CSRF/rate, screenshot/review and relay-failure acceptance; actual
GitWorkshop render/filter of the spaced label (source supports literal tags).
No public test issue without separate explicit authority. Trigger placement is
still a user decision and is not required to reuse the review component.