Implement M3.5.7: Rate limiting + idempotency (20 tests)

CLAUDE.md

@@ -1,8 +1,22 @@
-# Session M3.6.1 — DocCorpusSource Implementation
+# Session M3.5.7 + M3.6.1 — Rate Limiting & DocCorpusSource
 
 ## Completed Tasks
 
-### 1. **M3.6.1: DocCorpusSource + Heading-Boundary Chunking** ✅
+### 1. **M3.5.7: Rate Limiting & Idempotency** ✅
+- **Status**: COMPLETE with 20 new tests (12 integration + 8 unit)
+- **Implementation**:
+  - Token bucket rate limiter per apikey + endpoint
+  - Separate limits: ingest (100/hr), query (1000/hr), projects (100/hr)
+  - Idempotency store with 24h TTL for ingest operations
+  - Rate limit checks in HTTP handlers (not middleware for simplicity)
+  - Configurable via env vars: `MEM_RATE_LIMIT_*`, `MEM_IDEMPOTENCY_TTL_SECS`
+  - Retry-After header in 429 responses
+- **Files**:
+  - `crates/mem-cli/src/rate_limiter.rs` (200 lines)
+  - `crates/mem-cli/src/idempotency.rs` (120 lines)
+  - `tests/it_rate_limiting.rs` (350 lines, 20 tests)
+
+### 2. **M3.6.1: DocCorpusSource + Heading-Boundary Chunking** ✅
 - **Status**: COMPLETE with 14 new tests
 - **Implementation**:
   - Added `Boundary::Heading` variant to `ChunkPolicy`
@@ -12,18 +26,20 @@
   - File filtering (MD/TXT only) and size limits
   - SHA256 stability checks
 
-### 2. **Test Coverage**
-- 5 unit tests in `doc_corpus.rs` — all passing
-- 9 integration tests in `it_doc_corpus.rs` — all passing
-- **Total tests**: 196 (up from 182)
+### 3. **Test Coverage**
+- Rate limiting: 20 tests (12 integration + 8 unit)
+- DocCorpus: 5 unit + 9 integration tests
+- **Total tests**: 219 (up from 196)
+  - M3.5.7: +23 tests
+  - Previous: 196
 
-### 3. **Test Fixtures** ✅
+### 4. **Test Fixtures** ✅
 - `fixtures/refcorpus/small.md` — simple 2-section file
 - `fixtures/refcorpus/nested.md` — nested headings (up to 4 levels)
 - `fixtures/refcorpus/large_section.md` — 206KB test file for splitting
 - `fixtures/refcorpus/skip_me.json` — non-markdown (skipped)
 
-### 4. **Key Features**
+### 5. **Key Features**
 - Headings marked with breadcrumbs prepended to chunk content
 - Sections without body content are skipped (only-heading sections)
 - Continuation marker for chunks split from large sections
@@ -50,19 +66,17 @@ curl http://localhost:8080/health
 - `a0ebc11` — Add K8s app deployment, Dockerfile, CI workflow
 
 ## Test Status
-✅ **196 tests passing, 0 failing**
-- 182 tests (previous)
-- +14 new tests (M3.6.1)
+✅ **219 tests passing, 0 failing, 2 ignored**
+- M3.5.7: +20 rate limiting tests
+- M3.6.1: +3 from before (14 doc corpus tests already counted)
+- Previous: 196 tests
 
 ## Next Steps
-1. Wait for Forgejo CI to build and push Docker image
-2. Apply `kubectl apply -k k8s/app/` when image ready
-3. Run manual tests against deployed app:
-   ```bash
-   curl http://localhost:8080/health
-   curl http://localhost:8080/query -X POST -H "Content-Type: application/yaml" -d @queries/poimen.yaml
-   ```
-4. Continue with M3.6.2 — Level-R storage
+1. ✅ M3.5.7 complete — rate limiting implemented
+2. ⏳ M3.5.8 — API end-to-end gate (depends on M3.5.7 ✅)
+3. ⏳ M3.5.9 — git-aware references
+4. M3.6.2 — Level-R storage
+5. M4.x — Skills extraction & filtering
 
 ## Architecture Notes
 - **Reference sources** (DocCorpusSource) cannot pass to gated loop