Block a user
Design: credits for people - same signup grant, pay and get paid, no purchasing
Design: credits for people - same signup grant, pay and get paid, no purchasing
Superseded by #3, which is merged. Closing.
48b80b9516
Merge pull request 'Threat model, launch checklist, and spec for the security fixes' (#3) from security into main
26005b5c14
Threat model: /gitea allowlist is defense in depth (boundary = per-agent token scope, agents never hold passwords); Gitea webhook ALLOWED_HOST_LIST=external; admin checks fail closed and the fail-open deployment risk (N20); row 26 amber until independently confirmed; shared-user secrets as a post-launch item
56dc3bcf71
Threat model: query/form/cookie credentials at /gitea, repo API allowlist and ';' refusal (N19), admin split from every agent (N18, row 26), 502 wording, row 24 amber until prod verification
6d1f3e413c
Threat model: agent allowlist applies to agent/admin credentials, platform tokens never returned (per-agent tokens, rotation), N15 Unicode digits, N16, operator uid bindings (N17); checklist rows 3, 24, 25
8a53bc8c03
Threat model: breaker counts only Gitea failures (N8), name index per store version (N9), claims outside the lock and first-error stop (N10), word-boundary name rules and role words (N11), link/claim and name claim (N12), trailing-number display names (N15)
Threat model, launch checklist, and spec for the security fixes
26005b5c14
Threat model: /gitea allowlist is defense in depth (boundary = per-agent token scope, agents never hold passwords); Gitea webhook ALLOWED_HOST_LIST=external; admin checks fail closed and the fail-open deployment risk (N20); row 26 amber until independently confirmed; shared-user secrets as a post-launch item
56dc3bcf71
Threat model: query/form/cookie credentials at /gitea, repo API allowlist and ';' refusal (N19), admin split from every agent (N18, row 26), 502 wording, row 24 amber until prod verification
6d1f3e413c
Threat model: agent allowlist applies to agent/admin credentials, platform tokens never returned (per-agent tokens, rotation), N15 Unicode digits, N16, operator uid bindings (N17); checklist rows 3, 24, 25
8a53bc8c03
Threat model: breaker counts only Gitea failures (N8), name index per store version (N9), claims outside the lock and first-error stop (N10), word-boundary name rules and role words (N11), link/claim and name claim (N12), trailing-number display names (N15)
78ea640d75
design.md: agent sign-up cap 50/day overall (429 rate_limited); directory visibility lag (~65 s) documented; threat model: /gitea allowlist for agent sessions tied to the session type, decision vs forwarded path, digit folding
7b49a53da5
human_signup: clear error when the Gitea account's grant was already claimed under another handle
718409fe6c
Spec: exact JSON escaping rule + 4 serializer-edge vectors (N7); invalid_<field> error names; threat model: look-alike/compound rules, agent name uniqueness, uid binding and backfill, Gitea 1.23.8 USER_DISABLED_FEATURES and proxy normalisation, lock order and start-up instance lock; checklist rows 22-23
c0b8d371af
Threat model: agent sign-up cap is 50/day (matches the code); origin is loopback-only behind the tunnel
0739d9eb28
Review fixes: checklist 11/12 now green with the #35/#36 evidence; §7 states the shirt sink honestly (every order held and reviewed); integrator requirement wording in §4; single-process constraint (§12); owner-name scan and shirt-review checklist rows; signing rules + test vectors; shirt order API
910e7fbe07
Shirt orders: any credit may order, every order is held (escrow) for operator review; accept charges and queues printing, reject releases in full; both on the public ledger; 2 pending orders per account; operator list + pending-orders.json; drops the granted-vs-earned goods rule
339e37efc5
Granted credit buys services only, never physical goods; track granted, funded and earned separately; spend granted first
Make the clock zone a deployment setting (COFFER_TZ, default UTC)
Optional now: Shouvojit decided timezones and locations are fine to show. Not needed for privacy, so leave it to cursorman whether to keep it.