Jail rules and shared keys: one honest day of shipping

For weeks the same bot has been stuffing contact forms across j7 with emails like i.j.ila.ri.t.i.xa.g3.7@gmail.com — gibberish prose, phone numbers from nowhere, and always, always the dots. Our gibberish classifier was already catching the prose and filing it in the Spam folder. But filing spam is housekeeping. We wanted arrests.

Spam rules: encode the tell, jail on sight

Every space owner on j7 can now write spam rules. A rule is a field, a check, a value, and an action — regex, contains-any-of, more-dots-than, link count, or length, aimed at the email name (before the @), the email domain, the name field, the message, or anywhere. Every contact submission on the platform streams through the enabled set at capture time.

Two actions. Spam files the lead in the Spam folder and feeds the existing two-strike escalator. Jail doesn't wait: the submitter's IP is blocked mid-submission, the response is a 403 pointing at /jail, and every page they try after that bounces them straight to the cell.

field:  email name (before the @)
check:  has more dots than 2
action: straight to jail

j.o.h.n.smith@gmail.com  ->  403, blocked, next stop /jail
first.last@gmail.com     ->  fine, two dots is a person

Ten starter rules ship enabled: the dot rule above, URLs where a name should be, BBCode markup, random-cAsE email names (all jail), plus link-stuffed messages, disposable email domains, the classic keyword set, digit-dump addresses, keyboard-mash repetition, and novel-length pastes (all spam). Each one is a tell we've actually watched a bot commit. You can disable any of them, delete them for good, or write your own from the inbox's jail tab.

Users: hand over the keys without losing the house

Every mysp4ce now has a Users button next to Visit. Type a GitHub username, and they get an invite on their own welcome page. Accept, and they hold the same keys the founder does — edit and publish, the shared inbox, the jail and spam tooling, the address, even inviting more admins. The invite flow warns you about exactly that before it sends, because handing someone the whole keyring should feel like handing someone the whole keyring.

What makes it safe is the hierarchy: seniority is by arrival. Nobody can remove anyone who came before them, the founder can never be removed by anyone, and only the founder can delegate the ⭐ super-admin role — a super can remove any admin except the founder. Power is easy to hand out and structurally impossible to steal.

New admins can't remove older admins. History has rank.

The honest part: how one day held two features

Both features went from idea to production in a single working session, and we're not shy about how: an AI agent built them end to end, then we pointed a fleet of 31 adversarial reviewer agents at the diff — five lenses (authorization, correctness, deploy-skew, UI, abuse), every finding independently re-verified by an agent whose only job was to refute it.

The fleet earned its keep. Before anything shipped, it caught the co-admin roster leaking through a public API endpoint, a denial-of-service vector in user-authored regexes, a URL counter that scored https://www. as two links, a path where a human's typo'd email could trip the dot-jail, duplicate admin seats after a GitHub username rename, and deleted starter rules quietly resurrecting on restart. All of it fixed, all of it regression-tested — including a literal process-restart simulation — before deploy. Database backed up first, both tiers shipped, caches busted, endpoints verified live.

If your contact form has become a spam bucket, this is what it looks like when the bucket fights back. Claim a corner at j7.is — the jail comes free.