fix(proxy): keep config workers out of binary graph

[kojiwakayama]

Summary

• narrow the proxy control-plane body reader import so the security barrel cannot pull project config evaluation into the runtime graph
• document the runtime boundary that lets the proxy profile omit worker entrypoints
• add a graph-level regression test that follows executable dependencies from the proxy entrypoint

Closes veryfront/veryfront-issue-inbox#382

Verification

• deno fmt --check scripts/build/compile-binary.ts scripts/build/compile-binary.test.ts src/proxy/control-plane-signature.ts
• deno lint --config=scripts/test.deno.json scripts/build/compile-binary.ts scripts/build/compile-binary.test.ts
• deno lint src/proxy/control-plane-signature.ts
• deno check --config=scripts/test.deno.json scripts/build/compile-binary.test.ts
• deno check src/proxy/control-plane-signature.ts
• deno test --config=scripts/test.deno.json --no-check --allow-read --allow-write --allow-run scripts/build/compile-binary.test.ts
• deno test --preload=src/testing/preload.ts --no-check --allow-all src/proxy/control-plane-signature.test.ts src/proxy/control-plane-signature.api-contract.test.ts
• git diff --check

Summary by CodeRabbit

• Bug Fixes
  • Strengthened proxy runtime boundaries to prevent unintended access to configuration evaluation components.
  • Improved request body-size validation by using dedicated security limits.
• Tests
  • Added coverage verifying that the proxy does not load declarative evaluator workers through its dependency graph.
• Documentation
  • Clarified proxy runtime isolation and requirements for future behavior changes.

[coderabbitai]

Warning

Review limit reached

@kojiwakayama, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 26 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1a63a78c-2e8f-480b-bfbe-446b9ad69674

📥 Commits

Reviewing files that changed from the base of the PR and between 9dc3bc9 and 568a711.

📒 Files selected for processing (1)

• scripts/build/compile-binary.test.ts

📝 Walkthrough

Walkthrough

The changes add a proxy dependency-graph test, document the proxy worker boundary, and update control-plane signature imports to use the dedicated input-validation limits module.

Changes

Proxy boundary enforcement

Layer / File(s)	Summary
Proxy graph validation and boundary documentation scripts/build/compile-binary.test.ts, scripts/build/compile-binary.ts	The build test traverses the proxy module graph and rejects reachable declarative evaluator workers. The build documentation describes this runtime boundary and regeneration requirements.
Dedicated body-limit imports src/proxy/control-plane-signature.ts	Body-size validation helpers now come from security/input-validation/limits.ts. Behavior is unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• veryfront/veryfront-code#3338: Modifies the same proxy binary dependency-graph test and boundary enforcement.
• veryfront/veryfront-code#3398: Addresses compiled-binary worker inclusion at the same proxy boundary.
• veryfront/veryfront-code#3399: Extends related compiled-binary worker-boundary changes with tests and documentation.

Suggested reviewers: kwakayama

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing configuration workers from entering the proxy binary graph.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/issue-382-proxy-worker-gate

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/build/compile-binary.test.ts`:
- Around line 200-210: Validate the parsed `info` metadata before constructing
`modules` and `reachable`: require non-empty `roots` and `modules` arrays,
ensure every module has a non-empty `specifier`, and validate each dependency
has the expected object/code/specifier shape. Fail the test immediately for
missing or malformed graph metadata, then preserve the existing graph traversal
and regression assertion for valid data.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4c26d4e1-b270-4ef5-895d-f5a85d07e0e2

📥 Commits

Reviewing files that changed from the base of the PR and between a63ffc0 and 9dc3bc9.

📒 Files selected for processing (3)

• scripts/build/compile-binary.test.ts
• scripts/build/compile-binary.ts
• src/proxy/control-plane-signature.ts