Milestone 1.2.3: Proxy Input Validation and Stable Error Envelope

Status: Complete
Goal: 1.2 Proxy platform integration
Phase: 1 — Core Platform

Summary

Body size and Content-Type middleware on chat, semantic validation with field_errors, extended stable error envelope, response headers on all proxy HTTP responses, path org_id UUID validation. Completes Goal 1.2 validation envelope criteria; rate limiting → 1.2.4.

Branch

feature/m1-2-3-input-validation

PR title

feat(proxy): input validation and stable error envelope (m1.2.3)

Prerequisites

• 1.2.2 merged (ADR-0012, internal/llm/)

Tasks

• ADR-0013
• services/proxy/internal/validation/ — limits, chat, headers, uuid + tests
• Extend services/proxy/internal/errors/ — FieldError, Write, 413/415/validation codes
• services/proxy/internal/http/middleware.go — request context, response headers, body limit, content-type
• Refactor auth middleware to reuse request ID from context
• Router wiring + fix WithChatRequest context assignment
• Config: IBEX_MAX_REQUEST_BODY_BYTES, request/trace header names
• Integration tests: 413/415/validation/headers matrix
• Docs: API, SECURITY §8.1, TESTING_STRATEGY §6.2.3, FILE_STRUCTURE, proxy README, DEVELOPMENT_GUIDE post-merge
• Contributor execution materials prepared

Files affected

Testing requirements

go test ./services/proxy/...
go test -tags=integration ./services/proxy/...
golangci-lint run ./services/proxy/...

Definition of done

• Body limit before parse; 413 / 415 documented and tested
• Semantic validation → 400 VALIDATION_ERROR with field_errors
• All proxy JSON errors use extended envelope
• X-Request-ID, X-Trace-ID, X-Response-Time on responses
• X-IBEX-Agent-ID enforced on chat (UUID)
• Auth error codes unchanged
• Goal 1.2 validation items satisfied on proxy
• proxy-auth-smoke (CI)
• PR merge with --delete-branch (maintainer)

Deferred (1.2.4+)

• Redis rate limit middleware
• OTel trace propagation
• Multimodal content arrays
• Full envelope migration for non-proxy services

Risks

Verification

See .