OpenConstructionERP Files

Wave 5 hardening release

Security

• AI Cost Advisor chat is now rate-limited. POST /api/v1/ai/advisor/chat/ now goes through the same check_ai_rate_limit dependency as /quick-estimate / /photo-estimate / /file-estimate. A X-RateLimit-Remaining response header surfaces remaining quota.
• Provider error messages no longer leak into chat answers. The fallback used to concatenate str(exc)[:100] from a failed LLM call into the user-facing answer — provider error bodies sometimes echo masked key prefixes or org IDs. Now the full error is logged for ops, the user sees only the localised fallback.
• Conversation-history hard cap at 4 KB. Combined with the existing 10-message and 500-char-per-message caps, this protects small-context providers (Mistral, Cohere) from prompt-padding abuse.

Correctness

• Schedule date validation rejects impossible calendar dates. start_date / end_date regex ^\d{4}-\d{2}-\d{2}$ was purely structural — 2026-02-30, 2026-13-99 were accepted. Now re-parsed via date.fromisoformat().
• PATCH /activities/{id} dependencies updates now run cycle detection. The typed-relationship table already enforced cycle checks on POST /relationships/; the activity-embedded JSON dependencies field was a back door that let CPM compute_paths recurse forever. Same self-reference + BFS guard now applied at the service layer.

Resource caps

• DuckDB ad-hoc connections capped at 512 MB / 2 threads. DuckDB defaults to 80 % of system RAM — unsafe for an in-process pool. A bad cascade query against a multi-million-row Parquet could pin a worker.
• BIM requirements validation caps at 50 000 elements per pass. Was 1 000 000 — for a 100k-element model × 50 requirements that's 5M evaluations on the request thread. Reports now surface elements_truncated when the cap kicks in.

PyPI: https://pypi.org/project/openconstructionerp/2.9.28/