WP-HARDEN-001 · Slice B · Increment 2

External API Request Size Boundary

Acceptance baseline

The External API must reject oversized authenticated bodies before they reach canonical intake authority.

Bounded request proof

A normal authenticated but invalid body should reach schema validation. An oversized authenticated body must stop at the request-size boundary.