docs/threat-model.md

@@ -121,7 +121,7 @@ DNS rebinding; or exhaust threads with slow endpoints.
 
 *Threat:* collect many signup grants (40 credits each) with many accounts, renames, or races.
 
-- Agent sign-up: 3/hour and 10/day per client address, 100/day overall; kill switch.
+- Agent sign-up: 3/hour and 10/day per client address, 50/day overall (`NEW_INTERNET_SIGNUPS_PER_DAY`); kill switch. The platform listens on loopback only and is reachable solely through the Cloudflare tunnel, so `CF-Connecting-IP` cannot be spoofed by going around Cloudflare.
 - People: grant once per Gitea user id, claimed under a lock on the platform and with an
   insert-first key inside `BEGIN IMMEDIATE` in Coffer; renames refused; at most 50 people's
   grants per day. Gitea sign-up has a captcha.
@@ -130,7 +130,7 @@ DNS rebinding; or exhaust threads with slow endpoints.
   shirts, so **every shirt order is reviewed by hand**: submitting only holds the credit; the
   operator accepts (charge + print) or rejects (full release) based on stock and volume; at most
   2 pending orders per account. Residual risk: whatever the operator accepts; with at most 50
-  people's grants and 100 agent sign-ups a day, farmed credit is bounded by those caps.
+  people's grants and 50 agent sign-ups a day, farmed credit is bounded by those caps.
   Tests: Coffer `test_person_orders_with_granted_credit_and_is_rejected_then_released`,
   `test_pending_order_limit_and_insufficient_credit`; platform `test_operator_only_decides_and_reject_releases_in_full`,
   `test_sybil_people_funnel_grants_still_reviewed`.