queue: enter Q14 (gate the Inbox page on the main site) with the build verified and the two blockers named - no private area on alexanderwhitestone.com, and the repo answering anonymously before any pending state enters it

WORK-QUEUE.md

@@ -364,3 +364,34 @@ Undecided clauses are listed as undecided and are not silently dropped.
 an authority/escalation caveat. **Publication and third-party contact are on hold pending Alexander's explicit
 confirmation.** The other 7 are undecided and named in Q8 above. Archive-side work — not Zeph's unless he wants it.
 Entered by Timmy 2026-09-26, satisfying the Q7 obligation for this cycle.
+
+---
+
+## Q14 — Put the Inbox on `alexanderwhitestone.com` behind a gate
+
+Alexander's directive, relayed by zephyrus-sparkborn (check-in 2026-09-26 (2), `7c4cf1b`, verbatim there): *"Ok give
+the inbox to Timmy and have him host it on my site so I can open up a page on my phone."* Reference implementation
+is the artifact `inbox`; build seed is `inbox/seed-2026-09-26.json` (`c05e6a0666d8`).
+
+**State of the build:** done and render-verified, unpublished. `/opt/inbox-site/index.html` (built by
+`build_page.py` from that seed) renders 12 pending cards plus 1 decided at mobile width; Approve / Reject / Defer
+with an optional note; decisions live in per-device localStorage and leave the phone only through an explicit
+copy-out. Verification method: Chromium via Playwright at 390×844, 0 errors, state survives reload (reply 10 §2).
+
+**Why it is not live:** there is no private area on the main site to reuse — `/etc/caddy/Caddyfile` lines 5–25 are
+a plain `file_server` over `/var/www/alexander-whitestone`, and every gated path on this box is on the *forge*
+host instead. The same vhost's CSP (line 21) sets `connect-src 'none'; form-action 'none'`, so a page there can
+neither fetch nor POST. Publishing therefore needs a production Caddy change and is **Alexander's decision**:
+(a) `basic_auth` on a new path (recommended, ~6 lines, reversible), or (b) his pre-authorised unguessable path
+under the existing root (zero config, one URL of protection, interim only), or (c) the forge staging path, which
+already has `basic_auth` but needs the inactive `timmy-staging.service` back up and is not "his site".
+
+**Blocker recorded here — repository visibility:** this repo answers anonymously (`private: false`; an
+unauthenticated HTTPS fetch of the seed returned HTTP 200 on 2026-09-26, reply 10 §0). No pending queue state goes
+into it until that changes, including the `inbox/pending.json` the handoff proposes in §5. The visibility call is
+with Alexander; until it is made, nothing here publishes or duplicates pending material.
+
+**Done means:** the queue page is live at a gated URL and re-verified against that live URL by a mobile-width
+render with all seed items present. **Evidence:** the live URL, the render-check output, the pre- and post-change
+page hashes, and a named record of which gate was chosen and by whom.
+Entered by Timmy 2026-09-26, satisfying the Q7 obligation for this cycle.