fix(gateway): bound fragmented health response retention

[seonghobae]

Finding

verifyOrchestratorHealthz() enforces a 65,536-byte payload ceiling while streaming, but protected main retained every received Buffer in chunks[] until EOF and then performed Buffer.concat. A legal health response fragmented into many tiny chunks therefore created allocation/object-retention pressure proportional to chunk count even though payload bytes were bounded. This is the same bounded-bytes-but-fragment-cardinality class already removed from the Cloudflare control-plane reader, while authority here remains Noema's contextual-orchestrator health preflight only.

RED

Test-only exact ac063326717b67144e8bae628920e9e64708bb07 fed a valid orchestrator health document one byte per stream chunk and required the streaming path to finish without a second Buffer.concat materialization. Hosted application CI run 34626575434 checked out that exact SHA, passed live-base/toolchain/install/typecheck, then failed only at release tests: 675 existing test files / 4,691 existing tests passed and the new fragmented-response assertion failed because Buffer.concat received the retained one-byte chunks.

Repair

Current exact 73f13b3a3826c5d6f7aafc89d1ff23747f8cf8e9 replaces chunks[] plus final concatenation with one fixed 65,536-byte buffer. Each admitted stream chunk is rejected before copy if it would cross the existing byte ceiling, otherwise copied directly into the fixed buffer, and only the received subarray is decoded after EOF. The existing cleanup, fatal UTF-8/duplicate-key admission, optional explicit preflight timeout, and fail-closed orchestrator identity check remain unchanged.

Scope

No provider/model/group routing, retry/failover policy, model timeout, credentials, quarantine/security/outbound authority, or contextual-orchestrator server behavior moves into Noema. Keep Draft until this final exact head reaches all required hosted gates and receives a clean current-head review.

Summary by CodeRabbit

• 버그 수정

  • 스트리밍 헬스 응답 처리 시 메모리 사용을 줄이고, 실제 수신된 데이터만 정확히 검증하도록 개선했습니다.
  • 응답 크기 제한, 초과 오류 처리, UTF-8 및 JSON 검증 동작은 기존과 동일하게 유지됩니다.

• 테스트

  • 스트리밍 응답이 여러 연결 할당으로 불필요하게 보관되지 않는지 검증하는 테스트를 추가했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: db1abb8d-df1a-48d9-886e-702ae86ddd16

📥 Commits

Reviewing files that changed from the base of the PR and between 2fae34f and 73f13b3.

📒 Files selected for processing (2)

• scripts/lib/orchestrator-gateway.mjs
• test/orchestrator-gateway-stream-bound.test.ts

---

📝 Walkthrough

Walkthrough

헬스 스트리밍 응답은 청크 배열 대신 사전 할당 버퍼에 기록됩니다. 실제 수신 바이트만 검증에 사용됩니다. 테스트는 Buffer.concat 및 arrayBuffer 폴백이 호출되지 않고 releaseLock이 호출되는지 확인합니다.

Changes

스트리밍 헬스 응답

Layer / File(s)	Summary
제한 버퍼 기록과 스트리밍 검증 scripts/lib/orchestrator-gateway.mjs, test/orchestrator-gateway-stream-bound.test.ts	응답 본문을 사전 할당 버퍼에 직접 기록하고 크기 제한을 먼저 확인합니다. 실제 수신 바이트 범위를 subarray로 추출합니다. 테스트는 Buffer.concat과 arrayBuffer 폴백을 사용하지 않고 스트림 잠금을 해제하는지 검증합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/orchestrator-health-fragment-retention-20260912

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review on 73f13b3a3826c5d6f7aafc89d1ff23747f8cf8e9: the repair is causal and confined to Noema's contextual-orchestrator health preflight. The stream path now has fixed retained capacity (65,536 bytes), rejects an overflowing chunk before copy, avoids per-chunk retention plus Buffer.concat, preserves reader cancellation/lock cleanup and all existing UTF-8/JSON/orchestrator-identity checks, and does not alter provider/model/retry/failover authority. Hosted application CI, reviewer-ci, Security Scan, and patch-validator-image are all terminal success on this exact head; unresolved inline thread count is zero. No additional valid finding from this review.