fix(security): enforce total inbound body deadline

[seonghobae]

Root cause

The new #776 regression showed that _read_json only applied a per-read socket timeout. A client that sent one byte before each idle timeout could keep the request open indefinitely.

Fix

• establish one monotonic deadline for the entire declared body;
• recompute remaining time before every read;
• shrink the socket timeout to the remaining budget;
• return the existing generic 408 and close the connection when the total budget expires.

This is stacked on #776 and preserves its fixed-length framing contract without force-pushing the remote agent branch.

Verification

• exact regression + framing suite: 19 passed
• full suite on the stacked head: 1484 passed
• python -m compileall -q contextual_orchestrator
• ruff check on changed Python/tests
• git diff --check

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d6ccf204-10c8-401a-b963-4b30c6c8558e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review at 6210b00899bd6aae068570b0f030a224e9cc55a3:

• Reproduced the predecessor fix(security): bound inbound request framing #776 failure: 0ec1151 failed the new slow-progress total-deadline test (1 failed, 18 passed).
• The shared _read_json path now computes one monotonic deadline, updates the socket timeout to the remaining budget before each read, restores the prior timeout, and fails closed with 408.
• Exact regression/framing tests: 19 passed; full stacked suite: 1484 passed.

This remains stacked on #776 and has no independent required Checks until the parent stack is reconciled.

[seonghobae]