where_woof/openspec/changes/scan-limits-gating/tasks.md

1. Schema & Queries

• 1.1 db/schema.sql: idempotent ALTER TABLE scans ADD COLUMN IF NOT EXISTS ip TEXT;; make db-up
• 1.2 queries.sql: GetOrderByID (:one), CountAlertsByTagSince (:one, tag_id + since → count of alert_sent), CountAlertsByIPSince (:one, ip + since); make generate; build

2. Gating & Limits

• 2.1 scan.go: capture client IP (X-Forwarded-For → RemoteAddr host); pass IP into InsertScan
• 2.2 shouldAlert: add paid-gating (order exists && status != 'paid' → false), per-tag daily cap (default 5, env ALERT_MAX_TAG_DAY), per-IP hourly cap (default 10, env ALERT_MAX_IP_HOUR) — checked in that order

3. Verification

• 3.1 Extend verify suite: lapsed-order tag → no alert; paid-order tag → alert; no-order tag → alert; tag over daily cap → no alert; IP over hourly cap → no alert
• 3.2 Existing suites (Phase 1/2/2.5) still pass on fresh DB
• 3.3 openspec validate scan-limits-gating; commit