gabriel / musehub public
feat patch security task/stream-security-phase5 #1 / 1
AI Agent gabriel · 124 days ago · May 11, 2026 · Diff

feat(security): quarantine DB record on stream abuse — Phase 5 of issue #51

Adds MusehubStreamRejection model (musehub_stream_rejections table) with rejection_id, repo_id, identity_id, reason, detail, rejected_at.

Adds _record_rejection(reason, detail) helper inside wire_push_stream. Called at all three security rejection sites before yielding the ERROR frame: - _BlockedHashError catch (3 sites) → reason='blocked_hash' - daily limit pre-check → reason='daily_limit' - cumulative decompressed gate (2) → reason='zip_bomb'

4 TDD tests green (test_stream_security_phase5.py) including partial-commit safety (batch 1 committed, blocked object in batch 2 still writes rejection row). 82 regression tests pass.

sha256:d8cf1ecddd8d18be0efc0546e4bf93fe81717ebda29442eaa61ab91f82b9822e sha
sha256:14738715ff714f7d90305fcc2ddcc07cfd067c8941b811f85ab206e6a486ce0c parent
+36 ~1 symbols
sha256:d75771c055b12674f6fdea18c0c4987fb66c477eaaf401796a10bfcde4812c81 snapshot
+36
symbols added
~1
symbol modified
0
dead code introduced
Semantic Changes 37 symbols
~ tests/test_stream_security_phase5.py .py 35 symbols added
+ _IDENTITY variable variable _IDENTITY L46–46
+ _collect function async_function _collect L96–100
+ _commit_pack function function _commit_pack L74–77
+ _end function function _end L80–81
+ _fw variable variable _fw L44–44
+ _header function function _header L59–64
+ _make_commit function function _make_commit L84–93
+ _make_repo function async_function _make_repo L114–136
+ _obj function function _obj L67–71
+ _pack function function _pack L51–52
+ _rejections function async_function _rejections L103–109
+ _stub_backend function function _stub_backend L139–157
+ _wrap function function _wrap L55–56
+ AsyncMock import import AsyncMock L29–29
+ AsyncSession import import AsyncSession L28–28
+ MuseWireFrameWriter import import MuseWireFrameWriter L42–42
+ MusehubBranch import import MusehubBranch L33–33
+ MusehubRepo import import MusehubRepo L33–33
+ SFRAME_COMMIT_PACK import import SFRAME_COMMIT_PACK L34–34
+ SFRAME_END import import SFRAME_END L34–34
+ SFRAME_ERROR import import SFRAME_ERROR L34–34
+ SFRAME_HEADER import import SFRAME_HEADER L34–34
+ SFRAME_OBJECT import import SFRAME_OBJECT L34–34
+ SFRAME_RESULT import import SFRAME_RESULT L34–34
+ annotations import import annotations L23–23
+ blob_id import import blob_id L31–31
+ db import import db L32–32
+ msgpack import import msgpack L25–25
+ now_utc_iso import import now_utc_iso L31–31
+ pytest import import pytest L26–26
+ select import import select L27–27
+ test_blocked_hash_writes_rejection_row function async_function test_blocked_hash_writes_rejection_row L165–203
+ test_daily_limit_writes_rejection_row function async_function test_daily_limit_writes_rejection_row L207–245
+ test_rejection_row_written_after_partial_commit function async_function test_rejection_row_written_after_partial_commit L289–337
+ test_zip_bomb_writes_rejection_row function async_function test_zip_bomb_writes_rejection_row L249–285
~ musehub/db/musehub_models.py .py 1 symbol added
+ MusehubStreamRejection class class MusehubStreamRejection L2209–2236
~ musehub/services/musehub_wire.py .py 1 symbol modified
~ wire_push_stream
← Older Oldest on task/stream-security-phase5
All commits
Newer → Latest on task/stream-security-phase5

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:d8cf1ecddd8d18be0efc0546e4bf93fe81717ebda29442eaa61ab91f82b9822e --body "your comment"