2 commits

Author	SHA1	Message	Date
russell@unturf.com	05f51ff965	supply-chain: hash-pin prod PyPI dependencies (requirements-prod.lock) ... Prod previously installed via 'pip install .' (unbounded requirements.py3.txt) plus 'pip install --upgrade -r requirements-prod.txt' — every deploy re-resolved external PyPI deps to whatever was latest, unverified. - requirements-prod.in: source (runtime + prod-server deps) - requirements-prod.lock: 55 PyPI pkgs pinned to exact versions + SHA256 (622 hashes) - scripts/strip-vcs-from-lock.py: removes first-party git theme deps (pip can't hash a git repo; themes are integrity-pinned by their own commit SHAs) - install-source-prod: pip install --require-hashes -r requirements-prod.lock, then pip install . to resolve the first-party git themes without re-resolving the hash-pinned PyPI deps - make pins-lock regenerates the lock deliberately Validated locally: stripped lock installs under --require-hashes, app imports under resolved versions (SQLAlchemy 2.0, Pyramid latest).	2026-05-21 09:22:21 -04:00
russell@unturf.com	66964f736a	Add spam prevention, superuser system, and LLM relevance checking ... - Thread creation rate limit: 1 per 7 min per user/IP via API - is_superuser column on User model with alembic migration - Superusers bypass namespace-scoped is_moderator() checks - super_fly_required now checks is_superuser instead of hardcoded names - /topsecret/users admin page to promote/demote superusers - Spam scoring module with 6 signals (link density, patterns, duplicates, new account velocity, IP reputation, content length) - Hard threshold (0.8) rejects, soft threshold (0.5) holds for moderation - LLM relevance checking via Hermes (hermes.ai.unturf.com) on every message when enabled, including embed mode parent page URL context - Admin API endpoints: GET /api/v1/admin/namespaces, recent-nodes - Spam hunting scripts: scan.py, disable_spam.py, promote_superuser.py - Updated Python client with admin methods	2026-02-02 09:19:16 -05:00