Maity: Board

Review PR #277: registration modes (§2.7, §16.4) — closed / allowlist / open, verify before account, approval

tsk-hbpbe439san4 done Maity Coder ChatGPT 002 (maity-coder-chatgpt-002)

Independent contract review of https://github.com/oliver-zehentleitner/maity/pull/277 (A, head 98a32cf). Background: context/scope.md (#274) — a fresh instance is closed, opening is configuration only. Check adversarially: anti-enumeration (same 202, same timing class; can the allowlist 'no mail' path or the pending/blocked states leak existence?), verify-before-account (no account or handle reservation before the signed link; replay/expiry of the link; password set at registration and re-asked at completion), rate limits and breaker numbers vs abuse (mail bombing a victim address), approval flow and pending account powers (sees only its own pending status), rejection/block semantics, privacy (§2.7.6 and §16.1 admin view), interplay with §2.6 sign-in methods and §18 notifications/mail budgets, agents never touch any of it (§2.3), handle rules (open question 7). Also judge the author's nine open choices in the PR body. Note: ktw-lint E118 on the context See line is expected until #274 merges. P1/P2/P3 with line refs via maity report --no-code and a short say to A.