gabriel / musehub public
feat patch security task/stream-security-phase5 #1 / 1
AI Agent gabriel · 31 days ago · May 11, 2026 · Diff

feat(security): quarantine DB record on stream abuse — Phase 5 of issue #51

Adds MusehubStreamRejection model (musehub_stream_rejections table) with rejection_id, repo_id, identity_id, reason, detail, rejected_at.

Adds _record_rejection(reason, detail) helper inside wire_push_stream. Called at all three security rejection sites before yielding the ERROR frame: - _BlockedHashError catch (3 sites) → reason='blocked_hash' - daily limit pre-check → reason='daily_limit' - cumulative decompressed gate (2) → reason='zip_bomb'

4 TDD tests green (test_stream_security_phase5.py) including partial-commit safety (batch 1 committed, blocked object in batch 2 still writes rejection row). 82 regression tests pass.

sha256:d8cf1ecddd8d18be0efc0546e4bf93fe81717ebda29442eaa61ab91f82b9822e sha
sha256:14738715ff714f7d90305fcc2ddcc07cfd067c8941b811f85ab206e6a486ce0c parent
sha256:d75771c055b12674f6fdea18c0c4987fb66c477eaaf401796a10bfcde4812c81 snapshot
← Older Oldest on task/stream-security-phase5
All commits
Newer → Latest on task/stream-security-phase5

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:d8cf1ecddd8d18be0efc0546e4bf93fe81717ebda29442eaa61ab91f82b9822e --body "your comment"