fix: address independent review findings

tests/test_mcp_http.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import json
+import http.client
+import socket
 import tempfile
 import threading
 import unittest
@@ -24,7 +26,11 @@ class MCPHTTPTestCase(unittest.TestCase):
             {"bootstrap-secret-at-least-24": TokenIdentity("system", "system", "System")}
         )
         self.server = ProjectBusHTTPServer(
-            ("127.0.0.1", 0), MCPApplication(service), auth, {"https://chat.example"}
+            ("127.0.0.1", 0),
+            MCPApplication(service),
+            auth,
+            {"https://chat.example"},
+            request_read_timeout_seconds=0.2,
         )
         self.thread = threading.Thread(target=self.server.serve_forever, daemon=True)
         self.thread.start()
@@ -115,6 +121,60 @@ class MCPHTTPTestCase(unittest.TestCase):
         self.assertEqual(status, 403)
         self.assertEqual(response["error"], "origin_not_allowed")
 
+    def test_deeply_nested_json_returns_parse_error(self) -> None:
+        body = b"[" * 200_000 + b"]" * 200_000
+        connection = http.client.HTTPConnection(
+            "127.0.0.1", self.server.server_port, timeout=2
+        )
+        connection.request(
+            "POST",
+            "/mcp",
+            body=body,
+            headers={"Content-Type": "application/json"},
+        )
+        response = connection.getresponse()
+        payload = json.loads(response.read())
+        connection.close()
+
+        self.assertEqual(response.status, 200)
+        self.assertEqual(payload["error"]["code"], -32700)
+
+    def test_brackets_inside_json_string_do_not_count_as_nesting(self) -> None:
+        status, response = self.request(
+            {
+                "jsonrpc": "2.0",
+                "id": 1,
+                "method": "initialize",
+                "params": {"text": "[{" * 500 + "}]" * 500},
+            }
+        )
+        self.assertEqual(status, 200)
+        self.assertIn("result", response)
+
+    def test_incomplete_body_times_out(self) -> None:
+        connection = socket.create_connection(
+            ("127.0.0.1", self.server.server_port), timeout=2
+        )
+        connection.settimeout(2)
+        connection.sendall(
+            b"POST /mcp HTTP/1.1\r\n"
+            b"Host: 127.0.0.1\r\n"
+            b"Content-Type: application/json\r\n"
+            b"Content-Length: 100\r\n"
+            b"Connection: close\r\n\r\n"
+            b'{"jsonrpc":'
+        )
+        response = b""
+        while True:
+            chunk = connection.recv(4_096)
+            if not chunk:
+                break
+            response += chunk
+        connection.close()
+
+        self.assertIn(b"HTTP/1.1 408 Request Timeout", response)
+        self.assertIn(b'"error":"request_body_timeout"', response)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_service.py

@@ -256,6 +256,34 @@ class ServiceTestCase(unittest.TestCase):
                 idempotency_key="premature-gate",
             )
 
+    def test_evidence_and_findings_items_must_be_objects(self) -> None:
+        self.issue()
+        self.service.claim_work_package(
+            self.principals["lead"],
+            project_id="sandbox",
+            work_package_id="WP-001",
+            idempotency_key="claim",
+        )
+        with self.assertRaises(ValidationError):
+            self.service.submit_result(
+                self.principals["lead"],
+                project_id="sandbox",
+                work_package_id="WP-001",
+                summary="Invalid evidence.",
+                evidence=["not-an-object"],  # type: ignore[list-item]
+                idempotency_key="invalid-evidence",
+            )
+        with self.assertRaises(ValidationError):
+            self.service.submit_review(
+                self.principals["reviewer"],
+                project_id="sandbox",
+                review_id="rev-does-not-matter",
+                verdict="APPROVE",
+                findings=[42],  # type: ignore[list-item]
+                summary="Invalid findings.",
+                idempotency_key="invalid-findings",
+            )
+
     def test_idempotent_replay_and_key_mismatch(self) -> None:
         first = self.service.issue_work_package(
             self.principals["pm"],