mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 17:45:53 +01:00
Priya RamanandPaperclip
0d728d0f45
The provider controls the duplex transport directly, so each request frame is untrusted. The broker now enforces two finite, fail-closed limits before it adds the id to the seen set, allocates the pending record, or calls the forward handler: - an in-flight limit that bounds the controllers, the timers, and the concurrent authenticated forwards. - a lifetime limit that bounds the retained request-id memory. On a limit the broker answers the refused request with one bounded terminal 503 response and forwards nothing. An in-flight refusal is retryable and keeps the id out of the seen set, so a resend passes after a slot frees. A lifetime refusal is terminal. The refusal preserves the no-replay and no-double-dispatch rules and records no telemetry, so the fixed observability surface stays unchanged. Co-authored-by: Paperclip <noreply@paperclip.ing>