fix: address independent review findings

docs/ARCHITECTURE.md

@@ -49,8 +49,9 @@ Work packages move through:
 
 `HOLD` leaves a reviewed package in `REVIEWED`. A new review can be requested
 after a completed review. This MVP treats corrections after
-`CHANGES_REQUESTED` as a new work package or a new explicitly governed
-iteration; it does not silently overwrite submitted result evidence.
+`CHANGES_REQUESTED` as a new work package. It does not support replacing the
+result on the reviewed work package and never silently overwrites submitted
+result evidence.
 
 ## Trust boundaries
 
@@ -58,4 +59,3 @@ iteration; it does not silently overwrite submitted result evidence.
 - The database is trusted to enforce integrity and append-only triggers.
 - Artifact URIs and commit hashes are references, not trusted content.
 - Reverse proxy identity headers are not consumed by the built-in adapter.
-

docs/PRODUCTION_PROFILE.md

@@ -13,7 +13,9 @@ hardening work package.
 2. Replace `StaticTokenAuthProvider` with validated OIDC/JWT or mTLS workload
    identity. Bind issuer, audience, subject, expiry, and revocation policy.
 3. Put the service behind TLS and authenticated ingress. Do not trust arbitrary
-   forwarded identity headers.
+   forwarded identity headers. The ingress must enforce connection limits,
+   header/body read deadlines, and request quotas in addition to the
+   application's five-second request-body timeout.
 4. Run multiple stateless instances only after PostgreSQL conformance and
    concurrency tests pass.
 5. Add structured audit export, metrics, tracing correlation, alerts, backup,
@@ -33,4 +35,3 @@ production gate acceptance.
 Chat threads are not push subscribers. A client, automation, or PA invocation
 must call `sync_since(last_cursor)`. The cursor itself belongs in durable client
 state and is advanced only after successful processing.
-

docs/THREAT_MODEL.md

@@ -37,6 +37,8 @@
 | Cross-project reads | project filter plus membership resolution |
 | Browser cross-origin request | exact configurable Origin allowlist |
 | Oversized request | one MiB body limit |
+| Excessive JSON nesting | pre-parse nesting limit plus guarded decoder |
+| Slow/incomplete body | five-second application read timeout |
 | MIME confusion/caching | strict JSON input, nosniff, no-store |
 | SQL injection | parameterized SQL; one controlled placeholder expansion |
 
@@ -57,8 +59,10 @@ fetched or executed by the bus.
 4. The event payload is not cryptographically chained or signed. Add hash
    chaining/signatures only if the agreed threat model requires tamper
    evidence against privileged database operators.
-5. No application rate limiter exists. Apply per-identity limits and request
-   quotas at the trusted edge.
+5. No application rate limiter or bounded worker pool exists. The application
+   closes incomplete request bodies after five seconds, but production ingress
+   must additionally enforce connection limits, header/body read deadlines,
+   per-identity limits, and request quotas.
 6. The server emits access metadata but no security audit sink or metrics.
    Integrate structured logs, alerts, and privacy-aware retention.
 7. Membership deactivation and credential revocation are not exposed as MVP
@@ -80,4 +84,3 @@ fetched or executed by the bus.
 - review log contents for sensitive project data;
 - add abuse limits and operational monitoring;
 - decide whether privileged-operator tamper evidence is required.
-