test(etl): rebuild HTTP payload admission on live develop

[seonghobae]

Rebuilds issue #247 without rewriting stale Draft #248 and now carries the complete bounded RED -> GREEN payload-admission implementation on current protected develop.

Exact current identity

• base branch / independently resolved live tip: develop@4408b6086fd725ff1629d8f048cf28f3a2b40b1b;
• branch: repair/etl-http-payload-bound-ae4efe6;
• exact current source head: cd41151f485d8b84ec4e5f06b3504ac0f19c799e;
• source tree: bc8d127c07c3cdba2ae6950d166292d6b325febf;
• refresh ancestry: parent 1 9ef6df6869addd42fbfdd76143d88e4f65bb2a1a (prior candidate), parent 2 4408b6086fd725ff1629d8f048cf28f3a2b40b1b (live protected base);
• Draft / mergeable: true / true;
• exact diff remains three files: EtlPayloadAdmissionAdvice.java, EtlHttpPayloadAdmissionTest.java, and EtlPayloadAdmissionAdviceTest.java.

No check, review, approval or synthetic merge from #248 or a predecessor head transfers.

TDD / implemented boundary

The preserved fail-first contract reaches the real Spring MVC /api/etl/process boundary and requires both known oversized Content-Length and unknown/chunked oversized request entities to fail as the existing typed etl_payload_too_large problem before EtlService is invoked.

The current production candidate provides an endpoint-scoped RequestBodyAdvice that:

• rejects a known oversized entity before reading body bytes;
• bounds unknown/understated streams and rejects immediately after configured-limit-plus-one bytes;
• accepts exact-limit and below-limit bodies;
• preserves unchanged IOException propagation from HttpInputMessage.getBody();
• leaves the service-level payload check in place as defense in depth; and
• does not change authentication, ETL transformation/persistence semantics, response contracts for admitted requests, database objects, or connector behavior.

The current head is a non-forced two-parent refresh over the live protected tip; no destructive rebase, force push, ours/theirs shortcut or evidence rewrite was used.

Exact-current-head workflow evidence

All exposed workflow aggregates associated with exact source head cd41151f485d8b84ec4e5f06b3504ac0f19c799e are terminal-success:

• CI 31654277358 — success on Ubuntu, macOS and Windows;
• Dependency Review 31654277397 — success;
• CycloneDX SBOM 31654277414 — success;
• SAST Semgrep 31654277406 — success;
• Security Scan 31654277386 — success.

These aggregate results are current-head-triggered evidence, but they are not by themselves protected merge authority. Current repository acceptance still distinguishes literal source identity from GitHub's synthetic PR merge checkout semantics, requires non-vacuous complete owned-production coverage, and requires complete same-revision vulnerability/dependency evidence. #121, #164/#205 and #196 remain the corresponding shared control authorities.

Review state

The one current Code Quality inline finding claimed that reflection fixture parameter integerBody(Integer value) was useless. Reinspection on exact current head proved the parameter is structurally required so Spring MethodParameter can represent a one-argument non-String controller signature; the fixture is never invoked and source already records the intent with @SuppressWarnings("unused") and an adjacent comment. The finding was classified false-positive, replied to with exact-head rationale, and the thread is resolved.

Formal submissions are COMMENTED only. There is no qualifying independent non-author formal APPROVED review on this exact head.

Merge boundary

Keep Draft. Merge only when the unchanged exact source has accepted source-identity evidence, non-vacuous applicable exact 100% owned-production statement/branch coverage, complete same-revision dependency/security/SBOM evidence, zero valid unresolved findings, every required live governance gate, and a qualifying independent non-author formal approval. Pending, skipped-required, status-only, author-only, predecessor-head, stale-base, incomplete-scanner, vacuous-coverage or synthetic-only evidence is not passing.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 118 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d654d347-67f4-4fcb-82cd-c4eb0df81581

📥 Commits

Reviewing files that changed from the base of the PR and between 4408b60 and cd41151.

📒 Files selected for processing (3)

• etl-service/src/main/java/com/xtrmetl/etl/controller/EtlPayloadAdmissionAdvice.java
• etl-service/src/test/java/com/xtrmetl/etl/controller/EtlHttpPayloadAdmissionTest.java
• etl-service/src/test/java/com/xtrmetl/etl/controller/EtlPayloadAdmissionAdviceTest.java

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}