fix(net): cap coordinator request bodies, bound baseline threads, index hot lookups, throttle rate-limit sweep

[wikithoughts]

Fixes review findings F11, F12, F13, F16 (overnight review of 30ae508, task T9). None of the four had been addressed on main (checked af2e814). PRs #29–#47 touched other findings, and grep on main showed no CREATE INDEX, no body cap outside put_blob, and the per-job pw-baseline thread still in place.

What changed

• F11 – request-size cap (net/coordinator_app.py): a pure-ASGI BodySizeLimit middleware rejects bodies larger than PW_MAX_BODY_BYTES with 413 before any parsing or auth.
  • Default is 4 MiB. That is above the largest legitimate body: a 200k-char /deliver, JSON-escaped by json.dumps, is at most about 2.4 MB.
  • A declared Content-Length over the cap is refused before the app runs.
  • A chunked or no-length body is counted as it streams and cut off at the first message past the cap.
  • Invalid or non-positive settings fall back to the default; there is no unbounded mode.
  • The cap is documented in the module docstring. Blob uploads keep their own 512 KiB cap.
• F12 – bounded baseline (net/coordinator_app.py): at most PW_BASELINE_WORKERS (default 4) pw-baseline threads run at once, gated by a non-blocking semaphore. A job submitted while every slot is busy skips its best-effort baseline and logs a line; nothing queues.
  • These are daemon threads, not a ThreadPoolExecutor, because executor workers are joined at interpreter exit and the 900 s settle-wait would stall coordinator shutdown.
  • A baseline that raises still releases its slot.
• F13 – SQLite indexes (net/store.py): CREATE INDEX IF NOT EXISTS runs on every Store open, so existing DBs get the indexes too. It covers nodes(secret_hash), users(secret_hash), tasks(job_id), tasks(node_id,status), jobs(asker,created) and jobs(status).
• F16 – rate-limiter sweep (net/ratelimit.py):
  • Once over max_keys, the O(n) sweep runs at most once per 10 s instead of on every allow().
  • It drops idle keys first, then evicts the least-recently-hit keys back to max_keys.
  • An evicted key only loses its own history, so it is never more limited than before.
  • One existing assertion in test_sweep_drops_idle_keys_on_overflow was updated for this eviction; its idle-sweep check is unchanged.

Left open (outside this lane's ownership)

• F11 per-field caps (RegisterBody.profile, JobBody.requires/then) were not added; this lane covered the middleware and executor only. The 4 MiB cap now bounds them in aggregate.
• F16's XFF part (key on the right-most trusted hop in _client_key) is not changed.
• New env knobs PW_MAX_BODY_BYTES and PW_BASELINE_WORKERS are documented in code only; docs/network/ was not updated (out of ownership).

Verification

Command	Exit	Result
python -m py_compile $(git ls-files '*.py')	0	—
ruff check . && pytest tests/ -q --cov=passiveworkers --cov-fail-under=75	0	All checks passed!, 782 passed, 1 skipped, coverage 83.49%, no warnings
New/changed tests against origin/main's coordinator_app.py/store.py/ratelimit.py	1	13 failed, 6 passed — every F-item has failing tests on old code. The 6 that pass are the pre-existing ratelimit behaviour tests plus the under-cap pass-through check.

Local env: Python 3.12.3, .venv in the worktree. No browser check because no served UI changed. CI was not watched (lane rule); the required ci-ok result is unverified at PR open.

🤖 Generated with Claude Code