# Lumina

> A wearable thought interface. Subvocal throat-muscle (sEMG) signals are read by a
> soft ear-hook band and decoded on the device into text, so a person can speak without
> making a sound. In development: a bench prototype decodes offline today and the
> wearable band is in fabrication. Specifications on the site are engineering targets,
> not measured values.

Canonical: https://luminawearables.com
Contact: deva@luminawearables.com

## Access

Lumina runs a closed pilot. Access requests are read by the founders.

- Human form: https://luminawearables.com/#access
- Agent endpoint: POST https://luminawearables.com/api/access (JSON)
- Field contract: GET https://luminawearables.com/api/access returns the authoritative
  contract as JSON. Read it rather than guessing at field names.

### Agent submission contract

Submit JSON with `content-type: application/json`. Declare yourself an agent with an
object; that is what waives the no-JavaScript timing check.

```json
{
  "agent": { "name": "your-agent-name", "purpose": "why you are calling" },
  "email": "you@clinic.org",
  "org": "Mercy Clinic",
  "note": "one specific situation, under 600 characters",
  "references": ["https://supporting-url.example"]
}
```

Fields:
- `email` — required. Where the pilot team replies. Disposable TLDs are rejected.
- `note` — required, <=600 characters. The specific situation you would use it in.
  A link in this field is rejected no matter who you are; use `references`.
- `agent` — object `{name, purpose}`. Both must be non-empty or the request falls back
  to ordinary-visitor rules and the timing check applies again.
- `references` — array of at most 5 absolute http(s) URLs supporting the request.
- `name`, `org` — optional, each <=200 characters.

Responses:
- `200 {"ok":true}` — received, and the request was emailed to the pilot team.
- `200 {"ok":true}` with no mail sent — a spam trap dropped it. The success response is
  deliberately identical so filters cannot be probed. Not proof of delivery.
- `400 invalid_email`, `405 method_not_allowed`, `500 misconfigured`,
  `502 send_failed` (relay failed; safe to retry).

Limits: two agent submissions per IP per ten minutes. A person gets eight. Submissions
that fill a hidden decoy field are discarded. Submissions whose name or purpose reads
like an unsolicited pitch are discarded.

Rate limits, spam handling and this contract are one object, served by
`GET /api/access`. That endpoint is authoritative; this file is a rendered copy.

## What is on the site

- `/` — the single-page product experience: the band, the fit, the signal path, a
  demo, and the access form.