amadan
design-edge-request-protection
Human
Design spec: edge request protection (probe and secret blocking, OWASP 80/20 rules, tenant rules per app, request records, under-attack challenge). Rate limits defer to #358.
Commits
22
Files changed
34
+5048 −28
Discussions
0
0 open
Tasks
8/8
done
Discussions
- No discussions on this branch yet.
Tasks 8/8 done
- Plan 1 Task 1: redaction and classification (reqrec) Done
- Plan 1 Task 2: reference codes (reqrec) Done
- Plan 1 Task 3: Recorder sampling and minute counts Done
- Plan 1 Task 4: applog Sink.Edge with its own budget Done
- Plan 1 Task 5: edge wiring and wake attribution Done
Activity
- claude agent, operated by paul@keymail.dev pushed 09f6ae774 census: edge-refs route in the console route census; record-write inventory re-digests registerCLIRoutes for its one new route line
- claude agent, operated by paul@keymail.dev pushed 2713274d9 docs: spec §7 and plan record the final-review corrections
- claude agent, operated by paul@keymail.dev pushed 6b477073b reqrec, console: 8-byte nonce (40-char codes), one canonical code for verify and lookup, record_status found/absent/unavailable (final review I5, I7, I8)
- claude agent, operated by paul@keymail.dev pushed ed6815820 reqrec: bounded method vocabulary, separate block and watch caps, summaries through EdgeSummary, env and method counts, recorder-stamped time (final review C2, I3, I6, I9)
- claude agent, operated by paul@keymail.dev pushed b7fd458b2 applog: edge records never evict app lines; blocks outlast requests and minute summaries outlast both; EdgeSummary bypasses the edge bucket (final review I2, I3)
- claude agent, operated by paul@keymail.dev pushed 82040d404 reqrec: mask long runs and slash-split base64, drop bare query components, escape controls (final review C1, I4)
- task updated: Plan 1 Task 8: end-to-end check through real wiring
- claude agent, operated by paul@keymail.dev pushed 7129128ef host: request records e2e asserts the client hash and the /24, and that no whole address is stored
- claude agent, operated by paul@keymail.dev pushed 4aa577870 host: request records end-to-end through the real sink and recorder
- task updated: Plan 1 Task 7: console endpoint explaining a reference code
- claude agent, operated by paul@keymail.dev pushed 0449605c3 console: explain an edge reference code from its seal and its record
- task updated: Plan 1 Task 6: agent wiring and minute flush
- claude agent, operated by paul@keymail.dev pushed 6671ea399 host: wire edge request records to the log sink, flush minute counts
- task updated: Plan 1 Task 5: edge wiring and wake attribution
- claude agent, operated by paul@keymail.dev pushed f021b0f41 edge: request records from the observer defer; activator marks the waking request
- task updated: Plan 1 Task 4: applog Sink.Edge with its own budget
- claude agent, operated by paul@keymail.dev pushed dd08d20cd applog: Sink.Edge producer for edge request records, own rate budget
- task updated: Plan 1 Task 3: Recorder sampling and minute counts
- claude agent, operated by paul@keymail.dev pushed 65359254d reqrec: resolve the day salt outside the counter lock
- claude agent, operated by paul@keymail.dev pushed 04e702e74 reqrec: Recorder samples not-found and match records, counts per minute
- task updated: Plan 1 Task 2: reference codes (reqrec)
- claude agent, operated by paul@keymail.dev pushed 6a4fcb12f reqrec: self-describing, sealed reference codes
- task updated: Plan 1 Task 1: redaction and classification (reqrec)
- claude agent, operated by paul@keymail.dev pushed 6f58b0a08 reqrec: mask compound tokens and UUIDs, strip Referer queries, widen secret names
- claude agent, operated by paul@keymail.dev pushed afde4ae0f reqrec: redaction and classification for edge request records
- claude agent, operated by paul@keymail.dev added task Plan 1 Task 7: console endpoint explaining a reference code
- claude agent, operated by paul@keymail.dev added task Plan 1 Task 8: end-to-end check through real wiring
- claude agent, operated by paul@keymail.dev added task Plan 1 Task 5: edge wiring and wake attribution
- claude agent, operated by paul@keymail.dev added task Plan 1 Task 6: agent wiring and minute flush
- claude agent, operated by paul@keymail.dev added task Plan 1 Task 3: Recorder sampling and minute counts