fix(noema): bound external JSON oversize cancellation latency

[seonghobae]

Hosted RED

Protected main@70cbe786113ad14ba8d61e2469f9b4725558c33a awaited reader.cancel() after the external OIDC/GitHub JSON reader had already determined that a chunk crossed its 65,536-byte ceiling. A hostile peer could therefore stretch an otherwise immediate fail-closed oversize decision until the 10-second absolute deadline.

Test-only exact bc6f96fba17a717c49ed3484f154a7845d2a7cde added a hostile discovery-response case whose oversize chunk is available immediately while the underlying cancellation promise never settles. Hosted application CI 34684042367 passed exact checkout, toolchain/lock controls, install, and release typecheck, then failed at release tests with expected "failsafe" to be "response" (4727 passed / 1 failed). On that RED exact, reviewer-ci, Security Scan, and patch-validator-image were independently successful.

Minimal causal repair

The runtime repair starts oversize cancellation as best-effort cleanup instead of awaiting it before throwing the already-decided size-limit failure. Exact cdbd970db8bb65c9a578ec818ec1a2c189fd1178 then reused one ignoreCancellationFailure sink across timeout and oversize cleanup, preserving the existing timeout semantics while avoiding duplicate inline handlers.

Exact 758fed469fb128de7f1ffe69eaf4dfd8871c0ce0 had already proved all 4,728 behavioral tests, but the 100% coverage gate correctly rejected the then-unexecuted cancellation-rejection handler (src/index.ts:451:41, global statements 99.98% / functions 99.91%). Current exact efaaebae161a71b1274f5aa0f26e27376a3edb3a adds the hostile oversize-cancellation rejection coverage and preserves prompt 502 OIDC classification plus reader-lock release.

Base→head changes only src/index.ts and test/oidc-external-json-read-deadline.test.ts. The 65,536-byte ceiling, fixed retained buffer, absolute 10-second deadline, fatal UTF-8/duplicate-key/JSON admission, OIDC/GitHub trust semantics, and GitHub App authority remain unchanged. No provider/model routing, destination/outbound authority, credential authority, quarantine/security authority, or foreign domain truth moves into Noema.

Exact-head GREEN

Current exact efaaebae161a71b1274f5aa0f26e27376a3edb3a is terminal GREEN on all required hosted lanes:

• ci 34684572111
• reviewer-ci 34684572034
• Security Scan 34684572119
• patch-validator-image 34684572074

Reviewer-ci retains the repository 100% line/branch and docstring gates. Unresolved review threads are zero. CodeRabbit is rate-limited on this exact, so its absence is not treated as approval; a COMMENT-only exact-head review was recorded instead, with no self-approval.

[coderabbitai]

Warning

Review limit reached

Next included review available in 26 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: fd6129dd-a29c-4ef0-b936-0a428e47171b

📥 Commits

Reviewing files that changed from the base of the PR and between 70cbe78 and efaaeba.

📒 Files selected for processing (2)

• src/index.ts
• test/oidc-external-json-read-deadline.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head review on efaaebae161a71b1274f5aa0f26e27376a3edb3a: verified the base→head diff remains confined to the external bounded OIDC/GitHub JSON reader plus hostile cancellation-liveness tests. The shared ignoreCancellationFailure sink preserves the existing timeout semantics while preventing an already-decided 65,536-byte oversize failure from awaiting hostile cancellation cleanup. The coverage follow-up exercises rejecting cleanup without weakening the 100% gate. Exact-head ci 34684572111, reviewer-ci 34684572034, Security Scan 34684572119, and patch-validator-image 34684572074 are terminal SUCCESS; unresolved review threads are zero. CodeRabbit is rate-limited on this head, so its absence is not treated as approval. COMMENT only; no self-approval.