fix: address independent review findings

2026-07-30 03:15:06 +02:00
parent bc55924198
commit a2229bc269
9 changed files with 204 additions and 12 deletions
@@ -0,0 +1,44 @@
+# WP-PA-001 Rework Evidence
+
+Date: 2026-07-30
+
+## Review input
+
+- Independent reviewer: Claude Code
+- Reviewed commit: `bc55924198865502203a992b6ea914a38fd9d173`
+- Verdict: `CHANGES_REQUESTED`
+- Findings addressed: M-1, M-2, L-1, L-2
+- Optional observation O-1: no correction required
+
+## Corrections
+
+| Finding | Correction | Regression evidence |
+|---|---|---|
+| M-1 | Added a pre-parse JSON nesting limit and retained `RecursionError` handling. Excessively nested JSON returns JSON-RPC `-32700`. Brackets inside strings are ignored by the nesting scanner. | `test_deeply_nested_json_returns_parse_error`; `test_brackets_inside_json_string_do_not_count_as_nesting` |
+| M-2 | Added a five-second connection/request-body read timeout. Incomplete bodies receive HTTP 408 and the connection is closed. Production ingress requirements now explicitly include connection limits and read deadlines. | `test_incomplete_body_times_out` |
+| L-1 | Corrected the architecture document: post-`CHANGES_REQUESTED` corrections require a new work package in this MVP. | Documentation inspection |
+| L-2 | Enforced object items for `evidence` and `findings`, matching the advertised MCP schemas. | `test_evidence_and_findings_items_must_be_objects` |
+
+## Verification
+
+Runtime: Python 3.12.13
+
+```text
+PYTHONPATH=src python3.12 -m unittest discover -v
+Ran 20 tests in 5.696s
+OK
+
+PYTHONPATH=src python3.12 -m compileall -q src tests
+exit 0
+
+pip install --no-cache-dir --no-deps --target <temporary-directory> .
+PYTHONPATH=<temporary-directory> PROJECT_BUS_MIGRATIONS=<repo>/migrations \
+  python3.12 -m unittest discover -v tests
+Ran 20 tests in 5.394s
+OK
+
+git diff --check
+exit 0
+```
+
+The rework must receive a fresh independent review before PM gate acceptance.