Implement rate limiting and sign-up throttling #12
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Discovered during #3: §4.5 MUSTs (per-account/per-role-tier write rate limits, runtime-configurable; anonymous per-client limits; sign-up throttling; optional proof-of-humanity) are not covered by #3/#4. M0 criterion 3 references §4 broadly, so this is M0 scope. Acceptance: §4.5; limits configurable at runtime (§12.8).
Live on prod (
f37f0b8): §4.5 complete — sign-up and login throttled per client, canonical writes limited per account tiered by role (USER<EDITOR<CURATOR<ADMIN), account changes per account, blanket anonymous per-client limit; 429 with §9.1 shape and Retry-After. §12.8 runtime-settings machinery: known-key registry in runtime_setting, admin GET/PUT surface, audited (§10.1), effective without redeploy — proven by test (limit change applies immediately). Proof-of-humanity (MAY) deferred to launch readiness (D22). 5 new tests, 76 total green.