fix(job-analysis): bound pre-authentication request metadata

[seonghobae]

Current authority — 2026-09-06

This PR bounds attacker-controlled Job Analysis request metadata before bearer authentication: route paths are capped at 256 characters, ASGI header frames at 64, and aggregate header-name/value bytes at 16 KiB. Oversized metadata fails closed before UUID parsing, identity lookup, authorization, body reads, or persistence.

The exact head is 866bf868c227f88d93a4fb611fb48f27e079d373 on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. The successor is an ordinary two-parent, non-force adoption of the validated 0dc4f09... delta and protected #161. The protected-parent tree was inspected before the write: .github/workflows contains only canonical foundation-ci.yml and path-scoped recovery-rehearsal-quality.yml; no retired Job Analysis/package-local workflow was resurrected.

Retained security contract

The successor preserves the reviewed source delta only: services/job-analysis-api/src/orgmetra_job_analysis_api/http.py, its request-budget regression, and the service README contract. The resolved Devin finding about _typed_headers running twice remains accepted as bounded redundancy because authorization failure ordering and full request-metadata budgeting are separate fail-closed obligations. No review thread is currently unresolved.

Exact-head acceptance

Fresh exact-head repository/security gates on 866bf868... are now terminal:

• Foundation CI 34034845036 — SUCCESS.
• Security Scan 34034845082 — SUCCESS.
• SAST Semgrep 34034845007 — SUCCESS.
• CodeQL PR 34034845035 — FAILURE at the central verdict handoff, not a demonstrated Job Analysis source/SARIF defect. Language detection succeeds. Both compatibility jobs successfully execute Request current-head CodeQL scan dispatch; Actions job 101496809698 and Python job 101496809727 then fail only at Release runner or enforce current-head CodeQL verdict.

Historical GREEN from 0dc4f09... remains predecessor evidence only. No leaf fallback, synthetic CodeQL verdict, gate weakening, or no-op retrigger is introduced.

Formal submitted reviews remain COMMENTED-only; there is no qualifying independent APPROVED review. Keep Draft until an authoritative current-head CodeQL verdict exists and the live approval requirement is satisfied.

Live protection

Inherited ruleset 18156473 remains the merge authority: one approval, stale-review dismissal after pushes, review-thread resolution, extra approval for unattributed changes, merge/squash only, the seven central required workflows, and deletion/non-fast-forward protection. OrganizationAdmin/always bypass is not an ordinary acceptance path and is not used here.

If another RED appears, repair its causal owner and reacquire evidence on the resulting exact head. Do not transfer predecessor checks, self-approve, synthesize reviewer identity or verdicts, weaken a required workflow, use routine administrator bypass, force-push/destructively rebase, or Close the valid request-budget delta.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.

[seonghobae]

Lifecycle correction: this branch is still based on develop@9e3e4847510e1e612b48474ba42b177b8ed824df, while current protected truth is eb9757f8649aaad026a9865508d9aad50c1a7a4f. #88 is therefore returned to Draft. Keep the pre-authentication request-budget hardening and historical exact-head evidence, but do not present the old-base GREEN snapshot as a current merge canary. Before Ready, non-force adopt the current protected branch, verify the request-budget changes remain causal and non-duplicative, reconcile current central workflow/provenance contracts, then rerun fresh exact-head gates and reviews. The body’s older non-draft and owner-plane snapshots are superseded by live refs/comments.