Estimate: 55m · Depends on: 6.11.3
The intake path that CREATES a triage work_item from a signed-in actor. It creates a work_item (kind bug or task) with the triage marker set and no parent, through workItemsService (the same create authority the rest of the app uses — which REQUIRES a member actor, so intake is signed-in only; the unauthenticated public portal is dropped, Yue 2026-06-14).
POST /api/.../triage/submissions route taking { kind, title, descriptionMd, attachment? }, attributing the submission to the session user, scoped to the active project.canSubmitToTriage) reuses the SAME method to create the identical triage work_item, attributed to that user’s real submittedByUserId (no captured name/email). 6.11 owns the create path; 6.12 owns its public route + grant.Stay 4-layer: the route parses + calls one service method; the service owns the transaction and calls workItemsService to create the item. There is NO unauthenticated route, no per-project form token, and no honeypot/rate-limit here (all were public-portal-only and are removed).
submittedByUserId (member or signed-in non-member); a logged-out caller is rejected (401), never creating a work item.workItemsService (no raw Prisma in the route); the kind-parent matrix + 6.4 access are honoured.submittedByUserId the created item carries.motir-core/lib/services/workItemsService.ts — the create authority (createWorkItem requires a member ServiceContext).canSubmitToTriage, the public submit) — the second caller of this intake service.motir-core/CLAUDE.md § 4-layer.