Module validate 

Field-level input validation for HTTP request bodies.

Issue 56: oversized or malformed fields used to flow all the way to signal::pipeline before being rejected. These checks fail fast at the adapter boundary with a 400 so the pipeline only ever sees bounded input.

Length budgets are looser than the 1 MiB body cap on /v1/* so the body limit stays the outer wall and these are the inner shape checks.

Constants

MAX_CONTENT_BYTES

Max byte length of SignalRequest.content. Tuned to leave headroom for metadata + transport framing inside the 1 MiB per-request body limit.

MAX_IDENT_BYTES

Max byte length of short identifier-ish fields (namespace, agent, session_id, sender, channel).

MAX_QUERY_BYTES

Max byte length of SearchRequest.query. Search queries that exceed this are almost certainly accidental dumps.

MAX_TOP_K

Hard ceiling on top_k. The recall layer ignores anything above its own configured max anyway; this just prevents a client from forcing the adapter to round-trip absurd values.

Functions

check_content

Reject empty / oversized free-text payloads.

check_query

Reject empty / oversized search queries.

check_short_ident

Reject empty / oversized short identifier fields. Also rejects ASCII control characters which have no place in any identifier and would otherwise turn into junk in logs.

check_top_k

Bound top_k to a sane window. None means caller will fall back to a pipeline-internal default and is fine.