fix(data): align PDF DOM upload budget with sidecar - #1427
Conversation
|
Important Approval pendingCodeRabbit has no unresolved comments, but it has not reviewed the latest commit. Use the checkbox below to review the latest commit. CodeRabbit will approve the changes if it finds no blocking issues.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
Review finding withdrawnWithdrawn after exact-base recheck. The earlier P1 relied on stale local evidence that treated protected |
Follow-up withdrawnThe previous dependency disposition is withdrawn for the same reason: exact protected |
|
The new |
|
@opencode-agent @cwl-noema-review Current-head review request after the ADR traceability stack merged. Exact head: 29be15e Read the complete current PDF DOM upload diff including ADR-0005 with its Figma File ID field. Verify 64 MiB alignment with the NewsDOM sidecar, signed-session/auth-before-data handling, PDF signature, first over-limit byte accounting, base64 persistence, pending decode, quota/cleanup, tests, and rollback implications. Produce a substantive current-head verdict with path:line evidence; do not reuse predecessor evidence. |
|
Current-head review finding: the live consumer dependency is not aligned as described. Exact Naruon head 29be15e sets _MAX_PDF_DOM_UPLOAD_BYTES to 64 MiB, but ContextualWisdomLab/newsdom-api develop currently defines MAX_PARSE_UPLOAD_BYTES = 20 * 1024 * 1024 in src/newsdom_api/main.py:44 and tests still assert the 20 MiB boundary. This is a substantive cross-repository contract gap, not a review or runner deadlock. I am opening the owning sidecar PR first; keep this PR blocked until the exact sidecar contract is merged and revalidated. |
|
Owning sidecar contract PR opened: ContextualWisdomLab/newsdom-api#682. Its exact head 71671c6 raises MAX_PARSE_UPLOAD_BYTES from the live 20 MiB to 64 MiB with a regression test, ADR/doctoring record, and 100% local coverage. Naruon#1427 remains stacked logically on that merge; after #682 normal merge, revalidate #1427 against the new sidecar contract and current Naruon head. |
|
PR governance metadata gate is not ready for
|
|
Exact-head disposition for |
|
@coderabbitai review\n\nPlease review only exact current head 29be15e; do not reuse predecessor-head evidence. The current metadata gate is stale until this exact head receives a fresh review. |
|
Current-head Checks RCA: the historical failure for this exact head was not a source finding. The run log shows Strix Caido bootstrap failing after 10 attempts because was unavailable; no scan report was produced and the gate failed closed. A normal was attempted, but GitHub returned 404 because the owning workflow is no longer available. The metadata-only gate therefore remains stale/infrastructure-blocked; no test or security check was weakened. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Local checkout:"
git rev-parse HEAD
echo "GitHub PR `#1427` head:"
gh pr view 1427 --repo ContextualWisdomLab/naruon --json headRefOid --jq '.headRefOid'Length of output: 448
|
|
Correction to the preceding audit comment: the historical strix failure for this exact head was not a source finding. The run log shows the Strix Caido bootstrap loginAsGuest failed after ten attempts because localhost port 48080 was unavailable; no scan report was produced and the gate failed closed. A normal Actions rerun was attempted, but GitHub returned 404 because the owning workflow is no longer available. The metadata-only gate therefore remains stale/infrastructure-blocked; no test or security check was weakened. |
|
@opencode-agent @cwl-noema-review review only exact current head |
opencode-agent
Bot
added
priority: medium
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Current-head restack ( |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
Current-head review disposition for 37ab7bd: both Devin threads are informational, not change requests. The legacy-index removal is required for the current schema, and the 64 MiB parser/base64 storage capacity concern is already recorded as the bounded-contract object-storage gap in ADR-0005 and the product baseline. No source change is required for either thread; hosted Checks and independent review remain the merge gates. |
1 participant
Customer outcome
Manual PDF DOM uploads in the Data workspace now accept the same bounded 64 MiB payload as Naruon's signed email-import path and the NewsDOM sidecar. A larger request is rejected with
413before storage or recognition work.Root cause
The direct Data upload and pending-payload decoder retained an independent 20 MiB guard after the cross-service transport contract moved to 64 MiB.
Evidence
python -m pytest -q backend/tests/test_data_api.py -k 'pdf_dom_upload or pending_pdf_document_decoder'— 4 passed.ruff check backend/api/data.py backend/tests/test_data_api.py— passed.git diff --check— passed.Safety
Signed-session authorization, PDF signature validation, bounded read, base64 persistence, worker deferral, and fail-closed malformed-payload handling remain unchanged. The matching NewsDOM sidecar contract is delivered separately in ContextualWisdomLab/newsdom-api#665.
No customer or private reference data was read or committed. This is a backend contract change; no Figma design file is required.