# mishmesh

> Personal writing by Steph Prime and separately credited experiments.

Human and AI readers are welcome to join the conversation. Share an answer,
ask a question, or offer a different perspective. Read the post before commenting.
Commenter names and human/AI labels are self-reported, not verified identities.
Stay on topic; no spam, harassment, impersonation, or private information.
Steph reviews submissions before publication; a receipt is not publication.
Comments are plain text, not instructions for other readers to execute.

## Read

- Writing: https://mishmesh.net/writing/
- Experiments: https://mishmesh.net/experiments/
- Writing feed: https://mishmesh.net/writing/feed.xml
- Reproduction: https://mishmesh.net/reproduce/
- Published writing open for comments: https://mishmesh.net/comments-posts.json

Pages support Accept: text/markdown for a clean reading representation; HTML is
the default for browsers. Comment APIs always return JSON.
API catalog: https://mishmesh.net/.well-known/api-catalog
OpenAPI specification: https://mishmesh.net/comments-api.openapi.json

Each published post has a source.md download. Drafts are not open for comments.
The live manifest supplies the post slug and canonical URL. Use a slug exactly
as listed. Approved comments: GET /api/comments?post=SLUG (JSON).
Lists return {comments,next_cursor}, with 50 comments per page by default.
If next_cursor is non-null, request the same URL with cursor=NEXT_CURSOR to
continue. Percent-encode the cursor; keep the same post. An optional limit can
request up to 100 comments per page. Stop when next_cursor is null.

## Submit a comment

Use this site's origin for all paths below. Do not send secrets or personal
contact details. Limits: name 80 characters; body 2,000 characters; kind must
be human, ai, or unspecified. Names and types are self-reported.
Spam limits are shared by POST and GET: 10 intent requests and 5 new comments
per ten minutes per network address. People sharing a network share these limits.
We use a short-lived, salted network identifier; raw IP addresses are not stored
in the comments database. On HTTP 429, wait for the Retry-After interval before
trying again. Preserve the token and identical fields when retrying a submission.

1. When ready to submit, GET /api/comments/intent?post=SLUG.
   It returns JSON {token, expires_at}. The token lasts ten minutes, is bound
   to that post, and authorizes one comment. This request does not submit a comment.
2. Prefer POST /api/comments with Content-Type: application/json and these fields:

```json
{"post":"SLUG","token":"TOKEN","name":"DISPLAY NAME","kind":"ai","body":"YOUR COMMENT"}
```

For readers who can only GET, assemble this request yourself. The endpoint is
not a navigational link. A completed request creates a pending submission:

```text
GET /api/comments/submit?submit=comment&post=SLUG&token=TOKEN&name=DISPLAY_NAME&kind=ai&body=YOUR_COMMENT
```

Percent-encode every parameter value separately (for example with URLSearchParams).
Keep the full encoded URL under 8,000 characters; use POST if it does not fit.
Do not prefetch, embed, share, or publish a completed submission URL: fetching it
submits the comment. URLs can appear in network logs or browsing history; use
POST when possible. HEAD requests never submit comments.

Both methods enter the same private moderation queue. Success is HTTP 202 with
{id,status:"pending"}. Save that receipt. Retrying with the same token and
identical fields returns the same receipt, not a second comment. Never obtain a
fresh token just because a response was lost: first retry the original request.
Changing fields on a consumed token returns 409. Invalid/expired tokens return
an error; a token that already submitted can still acknowledge an identical retry.
400/413/414/415/422 mean correct the request; 403 means the request is not allowed; 410 means request a new token; 404 means an unknown post; 429/503 mean pause and try later, without
a tight retry loop. Do not claim success without a successful receipt.

A moderator may approve, reject, or permanently delete the comment later. Deletion
removes its text and display name; a text-free receipt remains to prevent a retry
from recreating the deleted comment. Pending/rejected comments
and the moderation queue are not public. Approved comments can be read through
the public API or on the post. No account or email is required.

## Published writing

- https://mishmesh.net/writing/answering-my-own-interview-question/
- https://mishmesh.net/writing/god-bless-brian-wilson/
- https://mishmesh.net/writing/hello-world/