Combined ROSS adaptation batch

backend/src/index.ts

@@ -24,6 +24,10 @@ const runtime = loadRuntimeConfig();
 const PORT = runtime.port;
 const isProduction = process.env.NODE_ENV === "production";
 
+// Ceiling for JSON request bodies. Chat and tabular routes may post document
+// text inline; file uploads use multer and are not governed by this parser.
+const JSON_BODY_LIMIT = "50mb";
+
 function envInt(name: string, fallback: number): number {
   const raw = process.env[name];
   if (!raw) return fallback;
@@ -90,10 +94,6 @@ const dataDeleteLimiter = makeLimiter({
   message: "Too many data deletion requests. Please try again later.",
 });
 
-function jsonLimitForPath(path: string): string {
-  return "50mb";
-}
-
 app.disable("x-powered-by");
 app.set("trust proxy", envInt("TRUST_PROXY_HOPS", 1));
 
@@ -144,9 +144,7 @@ app.delete("/user/chats", dataDeleteLimiter);
 app.delete("/user/projects", dataDeleteLimiter);
 app.delete("/user/tabular-reviews", dataDeleteLimiter);
 
-app.use((req, res, next) =>
-  express.json({ limit: jsonLimitForPath(req.path) })(req, res, next),
-);
+app.use(express.json({ limit: JSON_BODY_LIMIT }));
 
 app.use("/chat", chatRouter);
 app.use("/projects", projectsRouter);

docs/upstream-mike-escalation-state.json

@@ -247,6 +247,42 @@
       "risk": "defer",
       "reason": "Safely adaptable, but high risk because it changes production build validation for Supabase configuration and deployment behavior. The ROSS adaptation reuses its existing production flag and retains all ROSS-specific safeguards. Generated patch was malformed or did not apply cleanly to current ROSS main; no code was applied.",
       "processed_at": "2026-07-31T17:04:17.826412Z"
+    },
+    {
+      "number": 242,
+      "risk": "defer",
+      "reason": "High-risk SSRF/OAuth security-boundary change. ROSS has divergent MCP egress code and lacks the supplied Vitest harness, so the complete adaptation cannot be validated safely.",
+      "processed_at": "2026-08-04T21:16:33.885666Z"
+    },
+    {
+      "number": 273,
+      "risk": "medium",
+      "reason": "Bounded backend cleanup: replaces a path-insensitive wrapper with one equivalent static JSON parser while preserving ROSS\u2019s 50 MB limit.",
+      "processed_at": "2026-08-04T21:16:33.885666Z"
+    },
+    {
+      "number": 253,
+      "risk": "defer",
+      "reason": "ROSS lacks the upstream backend Vitest/coverage harness, and several Mike-specific assertions require speculative adaptation.",
+      "processed_at": "2026-08-04T21:16:33.885666Z"
+    },
+    {
+      "number": 255,
+      "risk": "defer",
+      "reason": "Depends on an absent frontend test harness and includes prohibited workflow changes; a reliable partial adaptation is unclear.",
+      "processed_at": "2026-08-04T21:16:33.885666Z"
+    },
+    {
+      "number": 279,
+      "risk": "defer",
+      "reason": "High-risk schema migration, cryptographic signing-key, export, and production-data-boundary change with too broad a blast radius for this batch.",
+      "processed_at": "2026-08-04T21:16:33.885666Z"
+    },
+    {
+      "number": 280,
+      "risk": "defer",
+      "reason": "The cross-stack UI/API feature is not adequately testable because ROSS lacks the supplied frontend test harness.",
+      "processed_at": "2026-08-04T21:16:33.885666Z"
     }
   ]
 }

reports/release-manifest-v1.json

@@ -87,8 +87,8 @@
     },
     {
       "path": "backend/src/index.ts",
-      "sha256": "0b031efbfb400166c4e2864713fc8b80803feb5e0d96cc7ddfb7ee0968a1e7d7",
-      "sizeBytes": 5791
+      "sha256": "d613269b4effee8ecc0797db562a90dacbecf1b43a2a8d9af9c8cf66b5237b82",
+      "sizeBytes": 5858
     },
     {
       "path": "backend/src/lib/documentScanDispatcher.ts",