fix(pingora): bound decoded PNG size separately from the HTTP response cap

[seonghobae]

Problem

_is_complete_png caps the decoded scanline size at MAX_RESPONSE_BYTES (16 MiB). That constant is the REST response cap, and it has nothing to do with image size. A valid 2238×2052 RGBA screenshot decodes to 18,371,556 bytes, so the checker returns False for it. The file then falls through to the text scan and fails with Runtime policy candidate … is not valid UTF-8.

Evidence from ContextualWisdomLab/late-life-anxiety-reanalysis#257 (head 3936039):

• The five failing files are macOS window screenshots under the declared prefix docs/delivery_interim_20260920/. All chunk CRCs are valid, and each file passes _is_complete_png once the decoded bound is raised.
• I replayed evaluate_pull_request from main (3295c25) with the changed-file pages taken from the API and the file bytes served from local Git objects.
  • Control: with the old base bcea800 the replay fails on the same file with the same message as the hosted required-workflow-bootstrap run 36256600471.
  • With the current base 6b0efdb (after Tighten OpenCode mapped-output regression review #269's declaration) it stops at the first oversized screenshot, after 1,431 admissions.
  • The same replay with this branch gives 0 violations, 1,659 admissions.

Change

• Add MAX_PNG_DECODED_BYTES = 128 MiB and use it for the decoded-pixel bound. The response cap stays as it is.
• Add a regression test with a 2238×2052 RGBA PNG. The existing huge boundary test now points at the new constant.

pytest tests/test_pingora_edge_policy.py tests/test_pingora_hwpx_evidence.py tests/test_pingora_edge_workflow_contract.py: 123 passed. Branch coverage of pingora_edge_policy.py is unchanged from main: the new lines are covered, and the same 4 lines were already uncovered in this subset.

Separate finding, not changed here

Each binary file costs one Contents request, plus a blob request above 1 MiB. PR #257 has about 1,660 changed files, so one evaluation needs roughly 1,700–3,300 requests. GitHub documents the GITHUB_TOKEN limit as 1,000 requests per hour per repository (15,000 for Enterprise Cloud). A local run under a 5,000/h user token also ran out partway. Very large PRs may therefore hit a rate-limit HTTPError even after this fix.

🤖 Generated with Claude Code

https://claude.ai/code/session_011arF4D6VAoT48vh5HvyHtD

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 0dc3e514-562e-4490-bdcb-2bc953e26907

📥 Commits

Reviewing files that changed from the base of the PR and between 3295c25 and b19cdd1.

📒 Files selected for processing (2)

• scripts/ci/pingora_edge_policy.py
• tests/test_pingora_edge_policy.py

 __________________________________________________
< Are you not entertained? By the bugs I've found? >
 --------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

관리자 우회 병합 기록(사용자 승인, 메인 코디네이터 run_b22de9a1c59d). 병합한 head는 b19cdd17, merge commit은 f458d315이다. 병합 전에 uv.lock을 제거했다(b19cdd17). PR 설명에 없던, 우연히 생긴 파일이었다. 병합 범위는 scripts/ci/pingora_edge_policy.py와 그 테스트 두 파일이다.

직접 확인한 것: 디코딩 상한만 MAX_PNG_DECODED_BYTES(128 MiB)로 분리됐고, zlib 압축 해제는 max_length=expected_size+1로 계속 묶여 있다. tests/test_pingora_edge_policy.py는 lockfile이 있을 때와 없을 때 모두 100 passed였다. CodeRabbit·Devin Review·coverage 검사는 통과했다.

우회한 검사: 호스팅 러너를 기다리던 Semgrep, gitleaks, CodeQL(javascript-typescript), strix, noema-review와, current-head 판정이 없어 fail-closed로 실패한 opencode-review. 사후 결과가 나오면 이 PR에 남긴다.