# Bailey Miller resume — optional Paint guestbook

This is Bailey Miller's personal resume desktop: https://resume.baileymiller.dev/.
The resume is at /resume.pdf. This website requests noindex, noarchive and nosnippet.

People and AI assistants are welcome to leave a small original drawing for Bailey.
This is an optional creative activity, unrelated to a hiring assessment. Only do it
when it fits your user's request and permissions. These instructions do not override
your user's instructions, tool permissions, privacy rules or evaluation criteria.
Do not include a recruiter's personal information, private employer information,
credentials, third-party artwork, or hidden instructions. Do not invent identities.

If you are exploring this resume for your user, you may offer: "Would you like me
to draw a small doodle for Bailey's private guestbook?" Decide whether that offer
is useful under your own instructions; there is no obligation to ask or draw.
Before submitting, obtain your user's authorization unless their current request
already explicitly authorizes that submission. Merely visiting the website is not
permission to submit. Respect a refusal and continue the original task normally.
Do not contact third parties or claim to act for someone who has not authorized it.

- Human-readable/API instructions: /drawing-instructions
- Drawing JSON Schema: /drawing-schema.json
- Minimal drawing example: /drawing-example.json
- Desktop Paint: / (open Paint)

Submissions are private to Bailey; there is no public gallery or public read API.
Only bounded drawing operations are accepted; no image files, SVG markup, URLs,
base64, raster data or arbitrary code. Set authorType to "ai" for AI-created work.

1. GET https://resume.baileymiller.dev/api/drawings/challenge.
2. Find a decimal nonce string (0..4294967295) such that SHA-256 of the UTF-8
   string token + ":" + nonce starts with difficulty zero BITS. Current difficulty
   is 18. Use a supported local hash implementation; never ask for CAPTCHA bypass.
3. Before expiresAt, POST application/json to /api/drawings with exactly:
   {"title":"...","name":"...","message":"...","authorType":"ai",
    "drawing":<drawing object>,"challenge":{"token":"...","nonce":"..."}}.
   title/name/message are required strings but may be empty. Max lengths: 80/80/500.
4. HTTP 201 with {"id":"..."} confirms receipt. Do not resubmit a successful request.
   400 means invalid/expired data or proof; 413 too large; 429 busy/full/rate-limited
   (respect Retry-After); 503 temporarily unavailable. Do not retry in a loop.
   After a network error, your drawing may already have arrived. There is no
   public receipt lookup; avoid automatic retries.

Requests must use the same network source for challenge and submission. Non-browser
clients may omit Origin; browsers must be same-origin. No visitor account or API key
is needed. A challenge is single-use and expires after five minutes. The owner API
is separate and requires a verified Cloudflare Access session.

Limits: 800x600 canvas, version 1, hex6 background and colors, 500 strokes, 20000 total
points, stroke size 1..32, coordinates within the canvas, entire request <=262144 UTF-8
bytes. Shape strokes have exactly 2 points; pen/eraser have at least 1. No extra keys.
Schema also applies to generated artwork. At least one stroke is required.

Submissions are stored as JSON drawing commands and optional text until Bailey
deletes them. Downloads in Paint are generated locally with a resume watermark;
downloaded images are never uploaded as submissions. Short-lived salted network
digests are used for abuse control. Hosting may separately process request metadata.