Ben Stull 9e1b7ce34f feat(ratelimit): env-tunable per-IP auth limiter budgets ...

Add RATELIMIT_OTC_REQUEST_MAX / RATELIMIT_VERIFY_MAX / RATELIMIT_CHECK_MAX
(default to the existing secure values; non-positive/unparseable → default).
Lets a test/PPE stack that drives the auth endpoints repeatedly from one IP
lift the budget; production leaves them unset. Mirrors the existing
OTC_REQUEST_COOLDOWN_SECONDS knob.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-07 22:28:57 -07:00

..

__init__.py

Slice 1: scaffolding + propose-to-super-draft vertical

2026-05-24 04:31:11 -07:00

api_admin.py

§13: make graduation's RFC number optional; add retire (soft delete)

2026-06-01 22:27:46 -07:00

api_branches.py

fix(slice4): make all entry write paths sidecar-aware (§22.4a carried from SLICE-1)

2026-06-07 18:57:54 -07:00

api_collections.py

§22 S6: request-to-join + cross-collection inbox (§22.8) — v0.46.0

2026-06-06 02:11:16 -07:00

api_contributions.py

§22 S3: scope-role enforcement + collection-grain visibility (@S3) — v0.42.0

2026-06-05 18:07:51 -07:00

api_deployment.py

§22 S6: type-driven entry noun (§22.4a) — backend source of truth + chrome

2026-06-06 01:35:57 -07:00

api_discussion.py

§22 S3: scope-role enforcement + collection-grain visibility (@S3) — v0.42.0

2026-06-05 18:07:51 -07:00

api_graduation.py

fix(slice4): make all entry write paths sidecar-aware (§22.4a carried from SLICE-1)

2026-06-07 18:57:54 -07:00

api_invitations.py

§22 S1: thread collection_id through backend + update tests (N=1 unchanged, 454 green)

2026-06-05 08:26:14 -07:00

api_join_requests.py

§22 S6: request-to-join + cross-collection inbox (§22.8) — v0.46.0

2026-06-06 02:11:16 -07:00

api_memberships.py

§22 S4: scope-role invitation backend + capability flags (@S4 C.2)

2026-06-05 23:47:28 -07:00

api_metadata.py

fix(slice5): validate raw metadata input + prune stale bulk selections

2026-06-07 21:03:29 -07:00

api_notifications.py

§22 S1: thread collection_id through backend + update tests (N=1 unchanged, 454 green)

2026-06-05 08:26:14 -07:00

api_prs.py

fix(slice4): make all entry write paths sidecar-aware (§22.4a carried from SLICE-1)

2026-06-07 18:57:54 -07:00

api.py

feat(slice4): POST .../meta single-entry edit endpoint + GET RFC meta/can_edit_meta (§22.4a PUC-1)

2026-06-07 19:00:40 -07:00

auth.py

§22 S6: request-to-join + cross-collection inbox (§22.8) — v0.46.0

2026-06-06 02:11:16 -07:00

bot.py

fix(slice4): make all entry write paths sidecar-aware (§22.4a carried from SLICE-1)

2026-06-07 18:57:54 -07:00

cache.py

feat(slice3): persist entry metadata to cached_rfcs.meta_json at ingest (§22.4a)

2026-06-07 17:33:47 -07:00

chat.py

Release 0.5.0: PR-less per-RFC discussion (contribution still requires PR)

2026-05-27 23:04:52 -07:00

collections.py

v0.48.0 — SLICE-2: collection field schema + central validation (§22.4a)

2026-06-07 17:06:04 -07:00

config.py

feat(registry): hard-cut META_REPO -> REGISTRY_REPO; wire mirror into startup/webhook/sweep

2026-06-03 23:16:51 -07:00

db.py

§22 M3-backend Plan B (1/2): slug-keyed PK rebuilds activate project #2 (v0.36.0)

2026-06-04 06:30:37 -07:00

device_trust.py

Release v0.27.0: security hardening (audit 0026)

2026-05-28 18:28:10 -07:00

digest.py

v0.18.0 Slice 4: outbound_emails audit table + admin endpoint

2026-05-28 07:32:31 -07:00

docs_sessions.py

v0.19.0 backend: /api/docs/sessions/* endpoints + TTL cache

2026-05-28 09:07:01 -07:00

docs_specs.py

Release v0.20.0: /docs/specs surface + nested flyout nav + session body-list removal

2026-05-28 10:48:31 -07:00

docs.py

Release 0.14.0: public /docs user guide (DOCS.md served at /docs)

2026-05-28 03:08:28 -07:00

email_envelope.py

Release v0.28.0: security-audit-0026 I3 + I4 (HTML-email guard + async Turnstile)

2026-05-28 19:12:16 -07:00

email_invite.py

v0.18.0 Slice 4: outbound_emails audit table + admin endpoint

2026-05-28 07:32:31 -07:00

email_otc.py

v0.18.0 Slice 4: outbound_emails audit table + admin endpoint

2026-05-28 07:32:31 -07:00

email.py

v0.18.0 Slice 4: outbound_emails audit table + admin endpoint

2026-05-28 07:32:31 -07:00

entry.py

v0.47.0 — SLICE-1: metadata sidecars — storage + dual-read + migration tool

2026-06-07 08:24:27 -07:00

facets.py

feat(slice3): pure facet field-set + filter/count helper (§22.4a)

2026-06-07 17:34:33 -07:00

funder.py

§22 S1: thread collection_id through backend + update tests (N=1 unchanged, 454 green)

2026-06-05 08:26:14 -07:00

gitea.py

v0.47.0 — SLICE-1: metadata sidecars — storage + dual-read + migration tool

2026-06-07 08:24:27 -07:00

health.py

Release 0.2.3: /api/health framework dependency for flotilla

2026-05-26 19:40:40 -07:00

hygiene.py

fix(registry): clean content_repo failure in hygiene; retire META_REPO from .env.example; clarity + idempotency test

2026-06-03 23:28:08 -07:00

invites.py

docs(invites): correct stale last_seen_at NULL claim

2026-05-30 04:04:11 -07:00

main.py

fix(§22): heal mig-029 vs registry-mirror collection-id divergence

2026-06-07 21:54:52 -07:00

memberships.py

§22 S4: scope-role invitation backend + capability flags (@S4 C.2)

2026-06-05 23:47:28 -07:00

metadata_schema.py

v0.48.0 — SLICE-2: collection field schema + central validation (§22.4a)

2026-06-07 17:06:04 -07:00

metadata.py

feat(slice4): metadata sidecar git read/write helpers — dual-read + lazy-migrate ops (§22.4a)

2026-06-07 18:44:14 -07:00

models_resolver.py

§22 S6: per-collection enabled_models — the §22.12 model-universe chain

2026-06-06 01:30:16 -07:00

notify.py

§22 S6: request-to-join + cross-collection inbox (§22.8) — v0.46.0

2026-06-06 02:11:16 -07:00

otc.py

Release v0.27.0: security hardening (audit 0026)

2026-05-28 18:28:10 -07:00

passcode.py

Release 0.10.0: user-set passcodes (OTC stays as fallback)

2026-05-28 02:39:27 -07:00

philosophy.py

Slice 7: §14 chrome + settings and admin neighborhoods

2026-05-24 23:40:49 -07:00

projects.py

fix(§22): heal mig-029 vs registry-mirror collection-id divergence

2026-06-07 21:54:52 -07:00

providers.py

v0.24.0: Claude Haiku tag suggestions on propose-RFC (roadmap #27)

2026-05-28 13:25:39 -07:00

ratelimit.py

feat(ratelimit): env-tunable per-IP auth limiter budgets

2026-06-07 22:28:57 -07:00

registry.py

v0.48.0 — SLICE-2: collection field schema + central validation (§22.4a)

2026-06-07 17:06:04 -07:00

rfc_links.py

v0.29.0: #28 Parts 2+3 — create-RFC offers + contribute-to-pending requests

2026-05-28 20:10:13 -07:00

tag_suggest.py

v0.24.0: Claude Haiku tag suggestions on propose-RFC (roadmap #27)

2026-05-28 13:25:39 -07:00

turnstile.py

Release v0.28.0: security-audit-0026 I3 + I4 (HTML-email guard + async Turnstile)

2026-05-28 19:12:16 -07:00

webhooks.py

fix(registry): clean content_repo failure in hygiene; retire META_REPO from .env.example; clarity + idempotency test

2026-06-03 23:28:08 -07:00