[LIghtJUNction]

Motivation

• The hosting.preview operation accepted an unbounded entries array and created persistent topic/file revisions for each entry, allowing a signed website owner to grow durable storage even when operator write capacity was paused.
• hosting.preview was not included in the executor's capacity write guard, so setting runtime_config.accept_writes to false did not stop preview writes.

Description

• Add a per-request upper bound to previews by setting maxItems: 128 on the hosting.preview entries schema in src/msg/extensions/hosting.py to limit how many persistent files/revisions a single preview request can create.
• Include hosting.preview in the executor's capacity-controlled write set in src/msg/core/executor.py so previews are blocked when runtime_config.accept_writes is disabled.
• Add regression coverage in tests/test_hosting_same_origin.py to validate oversized preview input is rejected by schema validation, and extend tests/test_operations_admin.py to assert that hosting.preview is rejected with writes_paused when writes are paused.

Testing

• Ran the focused unit test tests/test_hosting_same_origin.py::test_preview_entry_count_is_bounded, which passed locally.
• Ran git diff --check / lint checks on the modified files, which reported no blocking issues after edits.
• Attempted to run integration-style tests that exercise the PostgreSQL-backed stack, but the execution environment lacked system PostgreSQL binaries (e.g. initdb), preventing full end-to-end execution of database-backed tests; tests that do not require initdb passed as noted above.

---

Codex Task

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-28T11:45:54.778877Z	8d290d5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

Superseded by merged #142 (edf0d55). This branch targets the pre-integration tree and would duplicate or conflict with the security repairs already on main.