automaton/tasks/complete/wire-dashboard-config/SPEC.md

Wire DashboardConfig + Add Caching + Add Size Limits

Goal

Activate the dead DashboardConfig module, add basic server-side caching to eliminate redundant disk I/O on every API request, and add input size limits to the review POST endpoint.

Requirements

R1. Wire DashboardConfig into the frontend

dashboard/config.py defines 5 settings but none are consumed by the server or client. self.config is loaded at ui/app.py:323 and immediately abandoned.

Fix:

• Add GET /api/config endpoint returning config.to_dict()
• Add PUT /api/config endpoint accepting body: dict and calling config.save()
• On dashboard init (dashboard.js:466), fetch /api/config and apply:
  • auto_refresh_interval → set polling interval (default 2s)
  • default_view → switch to board/stats/timeline on load
  • theme → set CSS data-theme attribute
  • show_timelines → show/hide timeline elements
  • column_width → set CSS --col-min-width variable
• Remove hardcoded setInterval(refreshData, 2000) on line 462 and use config value

R2. Add server-side caching for task scans

Currently every /api/tasks, /api/task/{name}, and /api/review-summary call does a full discover_tasks() — reading all artifact files from disk. At 2s polling, this is thousands of file reads per minute for ~84KB of data.

Fix:

• Add a module-level cache with TTL (e.g., 1 second or triggered by review writes)
• /api/tasks returns cached data within TTL window
• /api/task/{name} looks up task by name from cached list instead of re-scanning
• Writing a review (/api/task/{name}/review POST) invalidates the cache
• Cache stores the list of Task objects, not the serialized JSON

R3. Add input size limits to review POST

ui/app.py:250-263 reads content_length from the header and reads the full body with no bounds check. A malicious client can:

• Send Content-Length: 999999999 and never send the body → blocks single-threaded server (DoS)
• Send a 10MB comment → writes 10MB to REVIEW.md (disk abuse)

Fix:

• Add MAX_POST_BODY = 65536 (64KB) constant
• If content_length > MAX_POST_BODY, return 413 Payload Too Large
• If content_length <= 0, return 400 Bad Request
• Cap comment to 4096 characters before writing to disk

R4. Add /api/task/{name} to use cache

_serve_task() at ui/app.py:170-195 calls discover_tasks() to find one task. Use the cache from R2 for O(1) lookup.

Acceptance Criteria

• GET /api/config returns current config as JSON
• PUT /api/config with {"theme": "dark"} persists to dashboard-config.json
• Dashboard JS reads config on init and applies theme, default_view, auto_refresh_interval
• Changing config via dashboard-config.json and restarting dashboard applies the settings
• /api/tasks within TTL returns cached data (no disk reads on second poll)
• Writing a review via POST invalidates cache; next /api/tasks re-reads from disk
• POST with Content-Length: 1000000 returns 413
• POST with comment > 4096 chars truncates to 4096 before writing
• test_config.py tests still pass
• test_app.py tests still pass

Non-Goals

• Not implementing persistent caching (disk/memcached) — in-memory TTL is sufficient
• Not adding authentication to config endpoints (config changes require local access by design)
• Not optimizing discover_tasks() itself — the cache removes the hot path