Motir

Estimate: 55m · Depends on: 6.11.3

The intake path that CREATES a triage work_item from a signed-in actor. It creates a work_item (kind bug or task) with the triage marker set and no parent, through workItemsService (the same create authority the rest of the app uses — which REQUIRES a member actor, so intake is signed-in only; the unauthenticated public portal is dropped, Yue 2026-06-14).

• In-app submit (authenticated workspace member): a triage intake service method + a POST /api/.../triage/submissions route taking { kind, title, descriptionMd, attachment? }, attributing the submission to the session user, scoped to the active project.
• The service method is the shared triage-create authority. Expose it so Story 6.12’s public-project "Submit a request" (a signed-in NON-member, gated by canSubmitToTriage) reuses the SAME method to create the identical triage work_item, attributed to that user’s real submittedByUserId (no captured name/email). 6.11 owns the create path; 6.12 owns its public route + grant.

Stay 4-layer: the route parses + calls one service method; the service owns the transaction and calls workItemsService to create the item. There is NO unauthenticated route, no per-project form token, and no honeypot/rate-limit here (all were public-portal-only and are removed).

Acceptance criteria

• An authenticated in-app submit creates a triage work_item attributed to the session user, in the right project, invisible to the tree (it shows only in the queue).
• The intake service method is callable by both the in-app route and the 6.12 public submit, always attributing a real submittedByUserId (member or signed-in non-member); a logged-out caller is rejected (401), never creating a work item.
• Creation goes through workItemsService (no raw Prisma in the route); the kind-parent matrix + 6.4 access are honoured.

Context refs

• 6.11.3 — the triage marker + submittedByUserId the created item carries.
• motir-core/lib/services/workItemsService.ts — the create authority (createWorkItem requires a member ServiceContext).
• Story 6.12 (canSubmitToTriage, the public submit) — the second caller of this intake service.
• motir-core/CLAUDE.md § 4-layer.