[LIghtJUNction]

The homepage now lists active, publicly readable top-level discussion channels with read and posting requirements. Private, archived and internal channels are omitted through current resource-read authorization; no authenticated read ceiling or operation version changes.

Posting guidance distinguishes authenticated creation, owner/group permissions, scoped certified-write certificates, frozen topics and signed legacy directives. It does not expose member IDs or certificate/ACL contents.

Validation: 8 PostgreSQL-backed homepage and permission/rendering tests passed; Ruff and diff checks passed. Rebased on the installation/promotion release, retaining /install.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[LIghtJUNction]

Integrated into main c57511c and deployed as msgd 0.2.3-20261001.1. Live homepage now lists 10 public channels with posting and certificate requirements; private channels are omitted. Targeted PostgreSQL tests and live /install smoke check passed.

[LIghtJUNction]

[P2] Account for /store’s controlled namespace in the posting guidance

At f4de758, /store has the default mode 1777, so the new mode-based branch advertises “Authenticated identity and authorization to create posts.” However, ordinary content.post_create calls there always reach store_controlled_resource: create_resource only permits listing resources created through store.listing_create or bounty.create. An authenticated caller with ordinary create permission therefore cannot do what the homepage suggests.

The new test also sets /store to 0755 and expects “Channel owner,” but ownership does not remove this namespace restriction. Please give /store dedicated listing/bounty guidance, as /last-will already has for its special operation, or exclude it from discussion channels. Cover both the default and owner-only modes using the appropriate expected guidance.

Source evidence: discovery.py lines 636–649 (

msg/src/msg/plugins/discovery.py

Lines 636 to 649 in f4de758

	if resource.id == 't_last_will':
	posting = 'Use the signed legacy directive operation; ordinary posts are disabled.'
	elif not tx.setting('policy:' + resource.id, {}).get('editable', True):
	posting = 'Posting is frozen.'
	elif mode & 0o003 == 0o003:
	posting = 'Authenticated identity and authorization to create posts.'
	elif mode & 0o030 == 0o030:
	posting = (
	'Owner or authorized group; authorization to create posts is required.'
	if mode & 0o300 == 0o300
	else 'Authorized group; authorization to create posts is required.'
	)
	elif mode & 0o300 == 0o300:
	posting = 'Channel owner; authorization to create posts is required.'

), common.py lines 146–152 (

msg/src/msg/plugins/common.py

Lines 146 to 152 in f4de758

	if parent.id == 't_store' or type == 'listing':
	require(
	parent.id == 't_store'
	and type == 'listing'
	and request.operation in {'store.listing_create', 'bounty.create'},
	'store_controlled_resource',
	)

), and the existing denial test (

msg/tests/test_store_foundation.py

Lines 255 to 265 in f4de758

	@pytest.mark.asyncio
	async def test_store_namespace_and_listing_metadata_need_store_operations(installed):
	app, _ = installed
	key, seller, _ = await register(app, 'catalog-boundary')
	for operation, args in (
	('content.post_create', {'parent': '/store', 'body': 'unrelated post'}),
	('content.file_put', {'parent': '/store', 'name': 'unrelated.bin', 'data': b64(b'x')}),
	('content.topic_create', {'parent': '/store', 'name': 'unrelated'}),
	):
	denied = await call(app, operation, args, key=key, subject=seller)
	assert denied.error.code == 'store_controlled_resource', wire(denied)

). This is a source-level review; I have not executed those tests. The same guidance and restriction are present on main at c57511c.