Repository navigation
[S1] PassiveFetcher: reason allowlist, request budget, size caps, SSRF guard, request log #7
Description
Delivery slice S1 of the Touchstone design.
Part of story #1, #4.
Done when:
- A request whose reason is not TARGET, SUBRESOURCE, DISCOVERY_PATH or DECLARED is refused and recorded as
RESULT_REFUSED; GET only, TouchstoneUser-Agenton every request - Budget (default 50, max 200), 2 MiB/response, 20 MiB/scan and 10 s/request limits are enforced, each with a table-driven test
- Loopback, RFC 1918, link-local incl. 169.254.169.254, CGNAT,
::1, fc00::/7, a hostname resolving to a private IP, and a redirect to a private IP are all refused at dial time (net.Dialer.Control);--allow-privateis honored by the CLI only
Phase: 1 — make the flow work
Blocked by: #6
Sprint: #17
Estimate: build 3h · CI+review 4h → ships 2026-10-27 (P50) / 2026-10-28 (P80) (uncalibrated: first sprint)
Waiting on: none
Runtime: runtime:claude (default)
Passive-only rule applies: only requests a browser loading the page would send, plus the design's discovery paths.
Part of #17 (Sprint 2026-W44)
Activity
containarium-ci commentedon Oct 23, 2026
The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.
Next: reply
@containarium statusto check on it, or@containarium stopto cancel it.— run
763edbf0Agent proposal for #7
Agent proposal for #7
Agent proposal for #7
Agent proposal for #7
Agent proposal for #7
containarium-ci commentedon Oct 23, 2026
The agent proposed a change for this issue: #21
It was produced on a member's box and has not been built or tested by the platform. It is a pull request for a person to review; nothing is merged automatically.
— run
763edbf0Agent proposal for #7 (#21)
hsinatfootprintai commentedon Oct 26, 2026
Delivered by merged PR #21. Closed by hand: platform PRs opened before v0.1.223 carry no closing keyword, and issues that list this one on a Blocked by: line wait for it to be closed.