Make the governed RAG evidence path executable end to end

Separate local parsing from model indexing, bind review decisions to immutable manifests, persist vectors behind active profiles, and expose retrieval, chat, evaluation, and document workflows through the React workbench.

Constraint: Live Bailian authentication currently fails for all three configured capabilities

Rejected: Direct upload-to-embedding flow | bypasses local review and manifest binding

Confidence: high

Scope-risk: broad

Directive: Keep private-data deployment blocked until authentication, RBAC, and separate database roles land

Tested: make verify; fresh and replay Docker document smoke; worker recovery smoke; frozen synthetic evaluation; migration 0003-0004 roundtrip

Not-tested: Successful live Bailian calls, OCR, real multi-user authorization

backend/tests/unit/test_gateway.py

@@ -9,7 +9,7 @@ from fastapi import FastAPI
 from starlette.requests import ClientDisconnect
 from starlette.types import Message, Scope
 
-from app.gateway import MAX_REQUEST_BODY_BYTES, create_gateway_app
+from app.gateway import MAX_REQUEST_BODY_BYTES, MAX_UPLOAD_BODY_BYTES, create_gateway_app
 
 type Handler = Callable[[httpx.Request], httpx.Response]
 
@@ -143,6 +143,55 @@ async def test_request_larger_than_one_mib_is_rejected_before_upstream() -> None
     assert upstream_calls == 0
 
 
+@pytest.mark.asyncio
+async def test_document_put_streams_above_json_limit_and_forwards_idempotency_header() -> None:
+    content = b"x" * (MAX_REQUEST_BODY_BYTES + 1)
+    received = b""
+    idempotency_key = "60000000-0000-0000-0000-000000000006"
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        nonlocal received
+        received = await request.aread()
+        assert request.method == "PUT"
+        assert request.headers["idempotency-key"] == idempotency_key
+        return httpx.Response(200, json={"stored": True})
+
+    async with _gateway_client(handler) as client:  # type: ignore[arg-type]
+        response = await client.put(
+            "/api/v1/document-uploads/20000000-0000-0000-0000-000000000002/content",
+            headers={
+                "Content-Type": "application/octet-stream",
+                "Idempotency-Key": idempotency_key,
+            },
+            content=content,
+        )
+
+    assert response.status_code == 200
+    assert received == content
+
+
+@pytest.mark.asyncio
+async def test_document_put_rejects_declared_content_over_upload_cap_before_upstream() -> None:
+    upstream_calls = 0
+
+    def handler(_: httpx.Request) -> httpx.Response:
+        nonlocal upstream_calls
+        upstream_calls += 1
+        return httpx.Response(200)
+
+    async with _gateway_client(handler) as client:
+        response = await client.put(
+            "/api/v1/document-uploads/20000000-0000-0000-0000-000000000002/content",
+            headers={
+                "Content-Type": "application/octet-stream",
+                "Content-Length": str(MAX_UPLOAD_BODY_BYTES + 1),
+            },
+        )
+
+    assert response.status_code == 413
+    assert upstream_calls == 0
+
+
 @pytest.mark.asyncio
 async def test_upstream_transport_error_returns_redacted_502() -> None:
     def handler(request: httpx.Request) -> httpx.Response: