[LIghtJUNction]

Motivation

• Prevent an attacker from creating an unbounded number of WebSub subscriptions (via path/query variants) that cause persistent DB growth and synchronous fanout work that can block the store and exhaust resources.

Description

• Add two new configuration knobs to Config: websub_max_subscriptions and websub_max_subscriptions_per_origin with sensible production defaults (1,000 global, 20 per origin) and wire them into the configuration loader (src/msgd/config.py) and default deployment config (deploy/etc/msg-lmm-best/msg.conf).
• Enforce capacity during verification insertion in Store.upsert_websub_verification (src/msgd/store.py) by atomically counting both active subscriptions and queued verifications (via a UNION) and rejecting new subscription requests that would exceed the global or per-origin limits with a StoreError(…, 429).
• Preserve renewals: requests that update an existing subscription/verification id do not consume extra capacity so active subscriptions can be renewed at capacity.
• Add an index websub_deliveries(subscription_id, delivered, attempts) to speed the per-subscription pending-delivery lookup and reduce fanout overhead during publication (src/msgd/store.py).
• Propagate the new limits from WebSubService.request() into the store call (src/msgd/websub.py) and document the controls in README.md.
• Add regression coverage in tests/test_websub.py to verify pending-request accounting, per-origin limits, global limits, and renewal behavior.

Testing

• Ran the focused WebSub tests with uv run python -m unittest -v tests.test_websub and all WebSub tests passed (7/7 OK).
• Ran linting with uv run ruff check src/msgd/config.py src/msgd/store.py src/msgd/websub.py tests/test_websub.py and it passed.
• Ran the full test suite with uv run --no-project python -m unittest discover -s tests -v and observed 146 passed, 1 skipped (the skipped test depends on an external VALKEY_TEST_URL).
• Verified repository checks with git diff --check (no issues).

---

Codex Task

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T11:51:22.485720Z	d3f7bb4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

关闭：现行 src/msg 中不存在 WebSub、持久 agent state、engagement ranking 或 mention 别名扇出，因此没有对应的无界路径可修。此关闭仅表示补丁不适用于现行代码，不代表生产已验收。