fix(data): align PDF DOM upload budget with sidecar

[seonghobae]

Current owner-stack receipt (2026-09-05)

Head cb08b1c3ea2aba8844fc29ef703c34368cc55e47, tree 526ba4181a710f96f61a1347720d606bdf92aa0f, normally merges prior head 02366791b2a449b8b23b527dcc550996361c0f96 with #1468 53ce38ed6683d01a9d113069f5ac5a8f17e133a2. The preserved stack is #1565 → #1503 → #1572 → #1468 → #1427. No force push or valid-delta deletion is used.

Exact dependency sync, fresh/repeated migration to 0020_search_trigram_storage, and 132 strict PostgreSQL/search/dependency tests pass, zero failed/skipped, in 25.07 seconds. Ruff and diff checks pass. Local receipts are /private/tmp/naruon-search-index-rca.VRmUrq/prop1427_tests.xml and prop1427_migration.log; the exact isolated Compose project was removed. Tests using mocked PDF processing or reduced over-limit fixtures do not prove a real 64MiB PDF processed by an immutable NewsDOM release.

The live all-open-PR ADR inventory showed unrelated 0005 proposals, so this proposal is now ADR-0021 with its former ID and #1427 lineage retained. #1469 must inherit that rename through the existing owner stack. The README and doctoring no longer imply a verified 64MiB NewsDOM runtime. All existing signed-session, signature, bounded-read, pending-payload and deferred-worker behavior is preserved.

Keep Draft until the NewsDOM immutable release/exact pin, #1572 representative search and migration-cost gates, and current-head hosted Checks/independent review are verified. Earlier receipts below are historical, not the state of this new head.

---

Customer outcome

This Draft raises Naruon's local Data-workspace PDF DOM upload bound to 64 MiB;
requests above it are rejected with 413 before storage or recognition work.
This is a local consumer contract, not proof that the NewsDOM owner has published
and deployed a matching immutable release.

Root cause

The direct Data upload and pending-payload decoder retained an independent 20 MiB guard after the cross-service transport contract moved to 64 MiB.

Historical focused evidence (before the current owner restack)

• python -m pytest -q backend/tests/test_data_api.py -k 'pdf_dom_upload or pending_pdf_document_decoder' — 4 passed.
• ruff check backend/api/data.py backend/tests/test_data_api.py — passed.
• git diff --check — passed.
• ADR-0005 and the doctoring record document the local consumer contract and APA 7th references.

Safety

Signed-session authorization, PDF signature validation, bounded read, base64 persistence, worker deferral, and fail-closed malformed-payload handling remain unchanged. The matching NewsDOM owner proposal is tracked separately in ContextualWisdomLab/newsdom-api#665.
Its open PR is Proposed evidence only; released contract and runtime compatibility
must be verified before production consumption.

No customer or private reference data was read or committed. This is a backend contract change; no Figma design file is required.

---

Current owner-restack receipt — 2026-09-05

• Exact head: 02366791b2a449b8b23b527dcc550996361c0f96; direct base: fix/postgres-smoke-read-state@037b58adeda53e6c847f8949494b9b518a94dac9.
• A normal merge preserves both the prior head 3a5f2b3751987fa8baaf85f96641e1659679aa80 and the full direct-parent delta; no force push or predecessor closure.
• In a task-owned environment after uv sync --locked, a fresh isolated PostgreSQL 16.15 database migrated through 0019_email_read_state_repair using uv run --frozen python scripts/migrate_db.py.
• From backend/: uv run --frozen python -m pytest -q -W error -ra --tb=short tests/test_alembic_migrations.py tests/test_bootstrap_db.py tests/test_data_api.py tests/test_email_read_state_migration_postgres.py tests/test_legacy_document_scope_postgres.py tests/test_workspace_document_migration.py tests/test_container_dependency_pin_contract.py — 76 passed, 0 failed, 0 skipped. These are local migrated-PostgreSQL/source tests, not protected-merge, deployed, or external-owner release evidence.
• Ruff on the changed Python files and git diff --check passed in that integration run.
• Keep Draft. A subsequent feat(data): add bounded tenant provenance portability #1497 combined-schema run found a separate whole-document GiST capacity defect (1 failed / 288 passed), now being repaired in the Naruon search-schema prerequisite lane. Do not shrink that input or claim this receipt resolves it. Current-head hosted checks and qualifying independent reviews still need verification before landing.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

@opencode-agent @cwl-noema-review Please independently review exact current head 795bfd2c05d6003aacedad043105a15f194687af against base 81c105645ca6e680f5f8c15ba9c33b67eb63c48b. Verify the 64 MiB PDF DOM upload contract, attachment transport boundaries above 20 MiB, parser/image-prefix limits, and current Checks. Publish structured exact-head evidence only; do not reuse predecessor review or coverage state.

[seonghobae]

Review finding withdrawn

Withdrawn after exact-base recheck. The earlier P1 relied on stale local evidence that treated protected develop@81c105645ca6e680f5f8c15ba9c33b67eb63c48b as a 20 MiB email-import base. The live protected blob at that exact SHA now contains MAX_IMPORT_UPLOAD_BYTES = 64 * 1024 * 1024 in backend/services/email_import_service.py:62, and the API imports that constant. The original finding is therefore not a source defect in PR #1427. It must not be used to block merge.

[seonghobae]

Follow-up withdrawn

The previous dependency disposition is withdrawn for the same reason: exact protected develop@81c105645ca6e680f5f8c15ba9c33b67eb63c48b already contains the 64 MiB email-import transport ceiling. PR #1353 remains independently relevant to HWP/HWPX parser recognition, but it is not required to establish the PDF/email transport ceiling claimed by PR #1427. Revalidation must use the exact live base blob, not the stale local checkout.

[seonghobae]

The new docs/adr/0005-bounded-pdf-dom-upload-contract.md has no Figma File ID field. This is a backend/data-contract change with no new visual surface, so record Figma File ID: N/A — signed data upload contract; no visual surface near the ADR metadata. Keep the field explicit for traceability even when Figma is not applicable. This is documentation traceability; no force/bypass is eligible.

[seonghobae]

@opencode-agent @cwl-noema-review

Current-head review request after the ADR traceability stack merged.

Exact head: 29be15e
Exact base: 81c1056

Read the complete current PDF DOM upload diff including ADR-0005 with its Figma File ID field. Verify 64 MiB alignment with the NewsDOM sidecar, signed-session/auth-before-data handling, PDF signature, first over-limit byte accounting, base64 persistence, pending decode, quota/cleanup, tests, and rollback implications. Produce a substantive current-head verdict with path:line evidence; do not reuse predecessor evidence.

[seonghobae]

Current-head review finding: the live consumer dependency is not aligned as described. Exact Naruon head 29be15e sets _MAX_PDF_DOM_UPLOAD_BYTES to 64 MiB, but ContextualWisdomLab/newsdom-api develop currently defines MAX_PARSE_UPLOAD_BYTES = 20 * 1024 * 1024 in src/newsdom_api/main.py:44 and tests still assert the 20 MiB boundary. This is a substantive cross-repository contract gap, not a review or runner deadlock. I am opening the owning sidecar PR first; keep this PR blocked until the exact sidecar contract is merged and revalidated.

[seonghobae]

Owning sidecar contract PR opened: ContextualWisdomLab/newsdom-api#682. Its exact head 71671c6 raises MAX_PARSE_UPLOAD_BYTES from the live 20 MiB to 64 MiB with a regression test, ADR/doctoring record, and 100% local coverage. Naruon#1427 remains stacked logically on that merge; after #682 normal merge, revalidate #1427 against the new sidecar contract and current Naruon head.

[github-actions]

PR governance metadata gate is not ready for 37ab7bd5c1a2dbc3a52f360ef791e476dccd861a:

• Current-head CodeRabbit issue comment has blocking warning/failure evidence on 37ab7bd.

[seonghobae]

Exact-head disposition for 29be15e4ec5e29dc1f62ac636928c9307a6f520f against develop@81c105645ca6e680f5f8c15ba9c33b67eb63c48b: the hosted Strix run 32487496869 / job 96787228260 failed before producing a vulnerability report with loginAsGuest failed after 10 attempts because the Strix Caido service could not connect to 127.0.0.1:48080. This is incomplete scanner infrastructure evidence, not an application source finding; the run reported zero vulnerabilities before the bootstrap failure. Central owner PR ContextualWisdomLab/.github#1153 contains the typed fail-closed classifier and exact regression fixture for this signal. Do not downgrade or bypass this required check. After #1153 is merged normally, rerun Strix for this exact Naruon head; retain the separate sidecar contract dependency on newsdom-api#682 before merging this 64 MiB upload contract.

[seonghobae]

@coderabbitai review\n\nPlease review only exact current head 29be15e; do not reuse predecessor-head evidence. The current metadata gate is stale until this exact head receives a fresh review.

[seonghobae]

Current-head Checks RCA: the historical failure for this exact head was not a source finding. The run log shows Strix Caido bootstrap failing after 10 attempts because was unavailable; no scan report was produced and the gate failed closed. A normal was attempted, but GitHub returned 404 because the owning workflow is no longer available. The metadata-only gate therefore remains stale/infrastructure-blocked; no test or security check was weakened.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Local checkout:"
git rev-parse HEAD

echo "GitHub PR `#1427` head:"
gh pr view 1427 --repo ContextualWisdomLab/naruon --json headRefOid --jq '.headRefOid'

Length of output: 448

---

@seonghobae: Verified. The local checkout and GitHub PR #1427 head both match 29be15e4ec5e29dc1f62ac636928c9307a6f520f. I will perform a fresh review for this exact head only.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Correction to the preceding audit comment: the historical strix failure for this exact head was not a source finding. The run log shows the Strix Caido bootstrap loginAsGuest failed after ten attempts because localhost port 48080 was unavailable; no scan report was produced and the gate failed closed. A normal Actions rerun was attempted, but GitHub returned 404 because the owning workflow is no longer available. The metadata-only gate therefore remains stale/infrastructure-blocked; no test or security check was weakened.

[seonghobae]

@opencode-agent @cwl-noema-review review only exact current head 29be15e4ec5e29dc1f62ac636928c9307a6f520f of PR #1427 against base develop@81c105645ca6e680f5f8c15ba9c33b67eb63c48b. Check the PDF DOM upload budget contract and full diff, then publish structured exact-head verdicts and current-head check binding. Do not merge, update branch, dismiss reviews, bypass protection, or reuse predecessor evidence.

[seonghobae]

Please independently review the complete exact current head 29be15e against protected develop at 81c1056. Re-read the full diff and current Checks, distinguish resolved predecessor findings from current source defects, and publish a current-head substantive verdict.

[seonghobae]

Current-head restack (37ab7bd5c1a2dbc3a52f360ef791e476dccd861a) is now based on develop@e5e99b4e3bb081b92c602358878856536030e2ca and includes the independent #1468 PostgreSQL smoke fixture root fix as a stack predecessor. The merge-result tree passed PYTHONWARNINGS=error python -m pytest backend/tests -q (1834 passed, 2 skipped), the PDF/NewsDOM and email-import focus (65 passed), Ruff, and git diff --check. Hosted Checks and a qualifying current-head approval remain authoritative.

[devin-ai-integration]

Devin Review found 2 new potential issues.

[seonghobae]

Current-head review disposition for 37ab7bd: both Devin threads are informational, not change requests. The legacy-index removal is required for the current schema, and the 64 MiB parser/base64 storage capacity concern is already recorded as the bounded-contract object-storage gap in ADR-0005 and the product baseline. No source change is required for either thread; hosted Checks and independent review remain the merge gates.

[seonghobae]

Exact-head repair evidence for ecf023c: non-force merged current develop@042b0c70531b229af3acbd0421a2f23098d848b3; effective eight-file delta is preserved. The currently pinned NewsDOM SHA 6558a4238b1614c39f7e96a961815747ac4d49ef still enforces 20 MiB, while owner PR ContextualWisdomLab/newsdom-api#682 carries the proposed 64 MiB contract. This consumer PR is therefore Draft and ADR-0005 is Proposed/BLOCKED-UPSTREAM until an immutable owner release is green and exactly pinned here. Focused backend validation: 42 passed, 2 skipped; Ruff and diff checks passed.

[seonghobae]

현재 head 3a5f2b3751987fa8baaf85f96641e1659679aa80은 prerequisite #1468 (603914596cb379a5be25c33f0990404d08054ffc)을 비강제 merge했고 base를 그 branch로 retarget했습니다. 이로써 #1565 → #1468 → #1427 stack이 연결되며, effective child delta는 PDF DOM 계약 6개 파일입니다. PDF upload/decoder 4개 테스트와 parent bootstrap/pin 28개 테스트(서비스 의존 1개 skip), Ruff·diff가 통과했습니다. foundation 보호 병합 전에는 Draft를 유지합니다.