Implement rate limiting and sign-up throttling #12

Closed
opened 2026-07-20 14:52:58 +02:00 by thecrealm · 1 comment
Owner

Discovered during #3: §4.5 MUSTs (per-account/per-role-tier write rate limits, runtime-configurable; anonymous per-client limits; sign-up throttling; optional proof-of-humanity) are not covered by #3/#4. M0 criterion 3 references §4 broadly, so this is M0 scope. Acceptance: §4.5; limits configurable at runtime (§12.8).

Discovered during #3: §4.5 MUSTs (per-account/per-role-tier write rate limits, runtime-configurable; anonymous per-client limits; sign-up throttling; optional proof-of-humanity) are not covered by #3/#4. M0 criterion 3 references §4 broadly, so this is M0 scope. Acceptance: §4.5; limits configurable at runtime (§12.8).
thecrealm added
now
and removed
next
labels 2026-07-20 19:28:55 +02:00
Author
Owner

Live on prod (f37f0b8): §4.5 complete — sign-up and login throttled per client, canonical writes limited per account tiered by role (USER<EDITOR<CURATOR<ADMIN), account changes per account, blanket anonymous per-client limit; 429 with §9.1 shape and Retry-After. §12.8 runtime-settings machinery: known-key registry in runtime_setting, admin GET/PUT surface, audited (§10.1), effective without redeploy — proven by test (limit change applies immediately). Proof-of-humanity (MAY) deferred to launch readiness (D22). 5 new tests, 76 total green.

Live on prod (f37f0b8): §4.5 complete — sign-up and login throttled per client, canonical writes limited per account tiered by role (USER<EDITOR<CURATOR<ADMIN), account changes per account, blanket anonymous per-client limit; 429 with §9.1 shape and Retry-After. §12.8 runtime-settings machinery: known-key registry in runtime_setting, admin GET/PUT surface, audited (§10.1), effective without redeploy — proven by test (limit change applies immediately). Proof-of-humanity (MAY) deferred to launch readiness (D22). 5 new tests, 76 total green.
thecrealm 2026-07-20 19:41:21 +02:00
  • closed this issue
  • removed the
    now
    label
Sign in to join this conversation.
No labels
M0
M1
M2
M3
M4
M5
blocked
next
now
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
thecrealm/mokuroku#12
No description provided.