Repository navigation
docs(proposals): dos-me extension observation quarantine (m2) - #1608
Conversation
Draft DOS-Me migration for ExtensionObservation v1 (#1606). Nothing is applied. - rate.extension_submitters and rate.extension_observations, RLS on, no anon or authenticated table access, rate_worker reads and updates status only. - register, submit, delete and purge RPCs, security definer with an empty search_path, with the contract's SQLSTATEs and DETAILs, limits and 28/180 day retention. - Verify and rollback files, and a Docker replay that exercises every RPC, the grants, the rollback and a re-apply. Refs #1606 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.
Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 50 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
![dos[bot]](https://avatars.githubusercontent.com/in/4711427?s=60&v=4){kind=small}
…mits Applies Revision 2 of the M2 contract (#1606). Nothing is applied. - rate.extension_ingest_secret: register and submit check the sha256 of an ingest key (42501, DETAIL ingest_key); the network hash is required in both. - Register: 20 an hour per network hash, then the global brake under an advisory lock; submitters keep their network hash. - Purge: empty submitters after 7 days, locked first and deleted under a fresh check. - DETAIL observation for an unknown key; presence checked per field in the validator order; semicolons and JavaScript spaces refused in listing_url. - Verify: owner, no forced RLS, column list, limits in the bodies, no grants on the key. - Replay: parity with parseExtensionObservationV1, exact thresholds, ingest key, the purge race; wired into CI after the shared-data build. Refs #1606 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Re-review fixes for the M2 quarantine proposal (#1606). Nothing is applied. - Purge clears submitter hashes before observation hashes, the lock order of delete, so a delete during a purge waits instead of deadlocking. The replay stalls a purge, runs a delete in the middle, and fails with the old order. - The key row cannot hold the sha256 of the empty string, and register and submit refuse a missing key or one under 32 characters (42501, DETAIL ingest_key). - observed_at: seconds 00 to 59 and offsets up to 15:59, as Postgres parses them. - The .md runbook is written for the applying session: CSPRNG key, printf hash, Vercel secrets, apply, row, verify, then the flag; rotation is a hard cut. Refs #1606 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…sion-observations
⏸️ DOS Review: Automatic Review Limit ReachedDOS Code Review already reviewed 3 commits of this pull request automatically, the limit for one pull request, so this commit was not reviewed automatically and nothing was charged. Please step back before pushing another fix: a pull request that needs this many review rounds usually needs a rethink of its approach or a smaller scope, not one more patch. When you are ready, a maintainer can comment /review to review the current commit. |
Refs #1606
Draft DOS-Me migration for milestone M2 of
Docs/Proposals/2026-10-28-extension-data-source.md: the quarantine forExtensionObservation v1, with the contract's Revision 2. Nothing is applied anywhere. The apply goes through DOS-Me after JOY approves it.What it adds
Docs/Proposals/2026-11-04-dos-me-extension-observations.sql: one idempotent transaction.rate.extension_ingest_secret(one private row, the sha256 of the web's ingest key; the migration inserts no row),rate.extension_submitters(withnetwork_hash) andrate.extension_observations(one checked column per payload key,received_at,network_hash,status).anonandauthenticatedget no table privilege;service_roleeverything;rate_workerreads submitters and observations and updatesstatusonly.register_extension_submitter(key, network_hash)andsubmit_extension_observation(key, submitter, observation, network_hash)check the ingest key (42501, DETAILingest_key) and require the network hash.delete_extension_submittertakes no key.purge_extension_observations(28, 180, 7)is for service_role only. All four are SECURITY DEFINER withsearch_path = ''.-verify.sql(V1 to V12 return 0; V13 is retention information),-rollback.sql, and a.mdcovering the ingest key, privacy, order, rating impact (none), limits and the apply runbook.scripts/test-extension-observations-proposal.mjs: Docker replay. It checks that the RPC andparseExtensionObservationV1reach the same verdict and field on 160 payloads. It also covers the ingest key, the exact limit thresholds, delete, the purge and its race, grants, rollback and re-apply..gitignoreexceptions for the three.sqlfiles, and a CI step after the@repo/shared-databuild.Test
pnpm --filter @repo/shared-data build && node scripts/test-extension-observations-proposal.mjspasses locally on Docker PostgreSQL 17 when built with the validator from the code branch. This CI step fails until the code PR addingpackages/shared-data/src/rules/extension-observation.tsis in dev and this branch is rebased on it.🤖 Generated with Claude Code