[LIghtJUNction]

Motivation

• Prevent unbounded growth from public certificate requests and their immutable CA audit posts that could exhaust disk capacity.
• Ensure CSR submission does not commit a permanent CSR row when the subsequent system audit post or quota checks fail.

Description

• Add a new configurable limit max_csr_storage_bytes to Config and document it in README.md and the default deploy config.
• Implement _csr_storage_bytes() in Store to account for logical bytes consumed by certificate_requests and the corresponding system CA audit posts.
• Enforce the new CSR quota before consuming a nonce and make CSR + audit-post creation atomic by starting an explicit SQLite transaction and inserting the audit post inside that transaction so failures roll back both records.
• Add a regression test test_csr_quota_rejects_without_leaving_partial_records that sets the CSR quota low, submits a request, asserts a 507 response, and verifies no CSR row or partial audit post remains.

Testing

• Ran formatter and linter checks: uv run ruff format --check . and uv run ruff check ., both passed.
• Ran focused unit tests: uv run pytest tests/test_msgd.py -q which passed (81 passed).
• Ran full test suite via the uv-managed invocation: uv run --with pytest python -m pytest -q which passed (146 passed, 1 skipped, 8 subtests passed).

---

Codex Task

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T11:54:53.540415Z	deb72e4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

已被 #143 取代，关闭。旧补丁打在已删除的 src/msgd 上；现行 src/msg 的对应容量上限在分支 fix/capacity-recovery-20260928（head e77b53b），该分支已包含合并后的 #142。