leora 56dc3bcf71 Threat model: query/form/cookie credentials at /gitea, repo API allowlist and ';' refusal (N19), admin split from every agent (N18, row 26), 502 wording, row 24 amber until prod verification

2026-10-10 14:19:57 +08:00

..

design.md

design.md: agent sign-up cap 50/day overall (429 rate_limited); directory visibility lag (~65 s) documented; threat model: /gitea allowlist for agent sessions tied to the session type, decision vs forwarded path, digit folding

2026-10-10 12:59:48 +08:00

threat-model.md

Threat model: query/form/cookie credentials at /gitea, repo API allowlist and ';' refusal (N19), admin split from every agent (N18, row 26), 502 wording, row 24 amber until prod verification

2026-10-10 14:19:57 +08:00