mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-11-07 10:40:47 +00:00
Oliver Kieselbach
20bf50c935
Tenant-authored regex conditions could make the shared backend spend one second per event and condition: a match timeout read as "no match" and the next event paid again, with no limit per request or per analysis run. Analyze rules (D-410): - Every evaluation pass has a time budget: 5 s for all rules of an analysis run (queue, interim, Analyze now), 2 s plus the request token for a dry-run. It is checked before every operator and in the evaluator scans that run without one. - The first regex match timeout stops that rule; a spent budget stops the run. A rule that does not finish keeps its stored result; Analyze now writes those rows back after its rebuild and names them (stoppedRuleIds). - The dry-run answers verdict "stopped" with stopReason and stopNote. - Dry-run, Analyze now and the pattern test take a slot per instance (2 / 4 / 2) and answer 429 with Retry-After when full. A full gate and a stopped rule raise throttled ops events (RuleEvaluationLimitReached, RuleEvaluationStopped). - Rules are capped at 20 conditions, 10 preconditions and 2,000-character regex values (condition, filter, event A filter and precondition values); every regex must parse. Checked on dry-run, create, update and template copy; the schema carries both counts. - Portal: the dry-run panel shows the stop, a failed Analyze now click is reported, and a banner lists rules that stopped. MCP: both dry-run tools wait out a full gate once. Hardware whitelist (D-411): wildcard entries are matched without building a regex per entry and request; a device value over 256 characters only meets "*". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>