2 Commits

Author	SHA1	Message	Date
anonpenguin23	fda47533c3	feat: per-namespace rate-limit self-service + WS JWT auth + release 0.122.12 ... Per-namespace rate-limit config (feature #69) - Migration 027: new `namespace_rate_limit_config` table (namespace PK, requests_per_minute, burst, audit metadata). - pkg/ratelimit: Manager + RQLite ConfigStore + types. Same pattern as the push config in bug #220's follow-up — LRU cache, invalidate on PUT/DELETE, falls back to YAML defaults when no row exists. - pkg/gateway/handlers/ratelimit: GET/PUT/DELETE /v1/namespace/rate-limit. PUT requests are rejected if they exceed the operator's configured ceiling (MaxRequestsPerMinute / MaxBurst) — tenants self-serve but cannot raise their quota past the cap. - pkg/gateway/rate_limiter.go: per-namespace lookup, default fallback. - pkg/gateway/middleware.go: WS JWT middleware (middleware_ws_jwt_test.go). - pkg/gateway/auth/service.go: refresh-token rotation hardening with regression test in refresh_rotation_test.go. AI agent instructions - Add AGENTS.md, CLAUDE.md, .github/copilot-instructions.md (DeBros v0.2.0 baseline). DeBros rules bumped to v0.2.0 (sha bb6e6ef). VERSION bumped to 0.122.12.	2026-05-13 15:41:36 +03:00
anonpenguin23	3676b000a6	chore: adopt DeBros DAO baseline rules + release 0.122.11 ... Standardization batch — no application code changes. Pulls in the DeBros DAO baseline rules (v0.1.0, sha 51ce3f8) for supply-chain defense and toolchain pinning. Files added: - DEBROS.md + debros.json — adopted-rules manifest - .debros/compliance/{go,javascript-typescript,zig}.md — per-language compliance docs - .github/workflows/security.yml — auto-detecting security CI (npm audit + go vulncheck), runs on main + weekly cron - renovate.json — 30-day dependency cooldown, no auto-merge, vulnerability alerts bypass cooldown - .nvmrc — pin Node 20.18.0 - vault/.zigversion — pin Zig 0.14.0 - sdk/.npmrc, website/.npmrc — supply-chain hardening (ignore-scripts, strict-peer-dependencies, save-exact, etc.) Files modified: - core/go.mod, os/agent/go.mod, website/invest-api/go.mod — add `toolchain go1.24.6` directive for reproducible builds - VERSION + sdk/package.json — bump to 0.122.11	2026-05-12 11:10:10 +03:00