feat(trogon-nats): implement Claim Check pattern for oversized payloads

devops/docker/compose/.env.example

@@ -8,7 +8,6 @@
 # GITHUB_STREAM_NAME=GITHUB
 # GITHUB_STREAM_MAX_AGE_SECS=604800
 # GITHUB_NATS_ACK_TIMEOUT_SECS=10
-# GITHUB_MAX_BODY_SIZE=26214400
 
 # --- GitLab Source ---
 # GITLAB_WEBHOOK_SECRET=
@@ -17,7 +16,6 @@
 # GITLAB_STREAM_NAME=GITLAB
 # GITLAB_STREAM_MAX_AGE_SECS=604800
 # GITLAB_NATS_ACK_TIMEOUT_MS=10000
-# GITLAB_MAX_BODY_SIZE=26214400
 
 # --- Linear Source ---
 # LINEAR_WEBHOOK_SECRET=
@@ -57,7 +55,6 @@
 # SLACK_STREAM_NAME=SLACK
 # SLACK_STREAM_MAX_AGE_SECS=604800
 # SLACK_NATS_ACK_TIMEOUT_SECS=10
-# SLACK_MAX_BODY_SIZE=1048576
 # SLACK_TIMESTAMP_MAX_DRIFT_SECS=300
 
 # --- Logging ---

devops/docker/compose/compose.yml

@@ -29,7 +29,6 @@ services:
       GITHUB_STREAM_NAME: "${GITHUB_STREAM_NAME:-GITHUB}"
       GITHUB_STREAM_MAX_AGE_SECS: "${GITHUB_STREAM_MAX_AGE_SECS:-604800}"
       GITHUB_NATS_ACK_TIMEOUT_SECS: "${GITHUB_NATS_ACK_TIMEOUT_SECS:-10}"
-      GITHUB_MAX_BODY_SIZE: "${GITHUB_MAX_BODY_SIZE:-26214400}"
       RUST_LOG: "${RUST_LOG:-info}"
     depends_on:
       nats:
@@ -110,7 +109,6 @@ services:
       GITLAB_STREAM_NAME: "${GITLAB_STREAM_NAME:-GITLAB}"
       GITLAB_STREAM_MAX_AGE_SECS: "${GITLAB_STREAM_MAX_AGE_SECS:-604800}"
       GITLAB_NATS_ACK_TIMEOUT_MS: "${GITLAB_NATS_ACK_TIMEOUT_MS:-10000}"
-      GITLAB_MAX_BODY_SIZE: "${GITLAB_MAX_BODY_SIZE:-26214400}"
       RUST_LOG: "${RUST_LOG:-info}"
     depends_on:
       nats:
@@ -160,7 +158,6 @@ services:
       SLACK_STREAM_NAME: "${SLACK_STREAM_NAME:-SLACK}"
       SLACK_STREAM_MAX_AGE_SECS: "${SLACK_STREAM_MAX_AGE_SECS:-604800}"
       SLACK_NATS_ACK_TIMEOUT_SECS: "${SLACK_NATS_ACK_TIMEOUT_SECS:-10}"
-      SLACK_MAX_BODY_SIZE: "${SLACK_MAX_BODY_SIZE:-1048576}"
       SLACK_TIMESTAMP_MAX_DRIFT_SECS: "${SLACK_TIMESTAMP_MAX_DRIFT_SECS:-300}"
       RUST_LOG: "${RUST_LOG:-info}"
     depends_on:

rsworkspace/crates/AGENTS.md

@@ -7,6 +7,8 @@ Errors must be typed—use structs or enums, never `String` or `format!()`. Ever
 You must use the `test-support` feature to share test helpers between crates.
 Prefer one trait per operation over a single trait with multiple operations.
 
+Production implementations of infrastructure traits must be zero-cost passthroughs to the underlying SDK. No error wrapping (use the SDK's error types directly via associated `type Error`), no return type conversion (add associated types like `type Info` to match the SDK's return), no `map_err`, no `map(|_| ())`. The impl body should be `self.sdk_field.method(args).await` — nothing else. Conversion logic (e.g. `Cursor::new`, `read_to_end`) belongs in the caller, not the passthrough.
+
 For NATS infrastructure and testing, use the `trogon-nats` crate which provides:
 - `NatsClient` trait for testability
 - Connection management with auto-reconnect

rsworkspace/crates/acp-nats-ws/src/main.rs

@@ -115,12 +115,15 @@ fn run_connection_thread<N, J>(
     let local = tokio::task::LocalSet::new();
     rt.block_on(local.run_until(process_connections(conn_rx, nats_client, js_client, config)));
 
-    // run_until returns once its future completes, but sub-tasks
-    // spawned by connection handlers (pumps, AgentSideConnection
-    // internals) may still be live on the LocalSet. Drive them to
-    // completion so WebSocket close frames are sent and per-connection
-    // cleanup finishes.
-    rt.block_on(local);
+    // run_until returns once process_connections completes, but
+    // sub-tasks spawned by connection handlers (pumps,
+    // AgentSideConnection internals) may still be live on the
+    // LocalSet. Drive them for a bounded window so WebSocket close
+    // frames are sent and per-connection cleanup finishes, without
+    // blocking forever on stuck sub-tasks (e.g. a hanging NATS
+    // request that never resolves).
+    let drain = std::time::Duration::from_secs(5);
+    rt.block_on(local.run_until(async { tokio::time::sleep(drain).await }));
     info!("Local thread exiting");
 }
 
@@ -374,6 +377,8 @@ mod tests {
             .await
             .expect("server task did not shut down");
 
+        drop(ws_stream);
+
         conn_thread.join().unwrap();
     }
 }

rsworkspace/crates/trogon-nats/Cargo.toml

@@ -7,13 +7,13 @@ edition = "2024"
 workspace = true
 
 [dependencies]
-async-nats = { workspace = true, features = ["ring", "nkeys", "jetstream"] }
+async-nats = { workspace = true, features = ["ring", "nkeys", "jetstream", "object-store"] }
 bytes = { workspace = true }
 futures = { workspace = true }
 opentelemetry = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-tokio = { workspace = true, features = ["time"] }
+tokio = { workspace = true, features = ["time", "io-util"] }
 tracing = { workspace = true }
 tracing-opentelemetry = { workspace = true }
 trogon-std = { workspace = true }