[KonstantinSerebryakov]

Summary

• The public signal name is Banned IP, wire slug banned_ip (API, webhook, History, CSV, cabinet catalog).
• Inbound rate_limited is rejected. Saved cabinet filters that stored that slug stop matching.
• The ClickHouse column is_rate_limited, the durable digest canonical form, and HTTP 429 rate_limited stay unchanged.

Env

• No new env vars.

Human merge only

• Do not merge from the agent. Merge on GitHub when ready.

Post-merge ops

• None beyond deploy. History ?rate_limited= is rejected; ?banned_ip=true reads is_rate_limited. New event digests still canonicalize to rate_limited. Re-parsing an in-flight body that still contains rate_limited does not set the flag.

Test plan

• Core entity, adapter, admin calculations, and scanresult digest tests
• Portal domain, history API, console query, handler, and service tests
• Go SDK go test ./...
• Console, Node, OpenAPI, and MCP suites were not run: Vite rejects a workspace path containing #
• Python and PHP suites were not run: pytest and php are not installed here

Made with Cursor