feat: expose rift 0.22.0 body/journal limits (maxBodySize, bodyMemoryBudget, journalMaxBytes) and RecordedRequest._bodyOmitted

[EtaCassiopeia]

rift 0.22.0 added three engine limits (rift#1439, rift#1441) that the SDK could not set. This PR exposes them on every transport and adds RecordedRequest.bodyOmitted().

Limit	Spawn (SpawnOptions)	Embedded (EmbeddedOptions)	Container (RiftContainer)	Engine default
maxBodySize (larger body → 413)	--max-body-size	maxBodySize serve option	RIFT_MAX_BODY_SIZE	512 MiB
bodyMemoryBudget (bodies buffered at once; past it → 503 + Retry-After: 1; 0 = no budget)	--body-memory-budget	bodyMemoryBudget	RIFT_BODY_MEMORY_BUDGET	1 GiB
journalMaxBytes (recorded-request bytes per imposter)	--journal-max-bytes	journalMaxBytes	RIFT_JOURNAL_MAX_BYTES	768 MiB

All three take a long byte count.

Gating and validation

• Spawn: refused at build() when version is below 0.22.0, because the older CLI has no such flag.

• Embedded: refused with EngineUnavailable unless the engine lists the key in buildInfo().serveOptions. Setting any limit serves the admin plane at engine start, because the engine applies the limits only to imposters created after rift_serve_admin. A mutation that removed this made both embedded ITs fail.

• Container: refused for a version-numbered image tag below 0.22.0. An unversioned tag such as latest can't be checked, so it is accepted.

• Shared checks. The SDK mirrors the engine's own refusals (server.rs, body_limits.rs, rift-ffi):

  • maxBodySize and journalMaxBytes must be at least 1, and bodyMemoryBudget at least 0.
  • A non-zero budget below the body ceiling is refused. When maxBodySize is unset, the comparison uses the engine's 512 MiB default.
  • A ceiling above 1 GiB with no budget set is refused, since it exceeds the engine's default budget.

  Spawn and embedded run these checks at build time; the container runs them at start.

RecordedRequest.bodyOmitted()

When a request is larger than the whole journal budget, the engine records it without the body and sets _bodyOmitted: true. The SDK read that entry as an empty body with no indication why. bodyOmitted() now reports the flag. It is a derived accessor over raw, like status(), so the record's components and constructors are unchanged and the rift-scala bridge is untouched.

Docs

docs/design/sdk-api.md, README.md and docs/testcontainers.md (new "Body and journal limits" section).

Tests

• Unit:
  • SpawnBodyLimitsTest: flags placed before start as plain bytes (values above 2^31), absent when unset, version gate, range and budget/ceiling rules.
  • EmbeddedBodyLimitsTest.
  • ServeOptionsBodyLimitsTest: payload, the per-key advertisement gate, and the eager-plane condition.
  • RiftContainerBodyLimitsTest: env vars, tag gate on every setter with boundary tags, and the start-time cross-check.
  • RecordedRequestBodyOmittedTest.
• Live, rift 0.22.0:
  • SpawnBodyLimitsIT (conformance, spawn) and LaunchOptionsIT (embedded): maxBodySize(1024) returns 413 for a 2 KiB body and 200 for 512 bytes.
  • With journalMaxBytes(4096), a 16 KiB POST is recorded with bodyOmitted() true and an empty body.

Verification

RIFT_IT=1 ./mvnw -B -fae verify on JDK 21, against the rift 0.22.0 corpus, dylib and binary: green.

The code review caught one blocker, which is fixed here: a bodyMemoryBudget set on its own was not checked against the engine's default 512 MiB ceiling.

Closes #309

🤖 Generated with Claude Code