BobSong-dev opened a new issue, #7951: URL: https://github.com/apache/shenyu/issues/7951
## Background P1-07 in the mentor-approved OSPP plan; parent #7949. Per-request byte/deadline bounds and an individual transport cap do not bound total work across local providers and remote servers. ## Existing capabilities and reuse At master `87c22dde7`, RequestScopedMcpClient has MAX_IN_FLIGHT=64 and bounded requests; RemoteCatalogLifecycle already supports bounded parallel discovery. Retain existing deadline/response-byte protection and the legacy server response-capture guard. Reuse existing resource/fault-tolerance facilities where their semantics fit; do not replace transport pools. ## Implementation scope - Add local-provider, gateway-wide and per-remote-server in-flight admission limits with bounded, deadline-aware queueing and explicit overload outcomes. - Make only necessary fixed limits configurable through trusted configuration, validating defaults, hard maxima and invalid updates in Admin and runtime. - Release permits exactly once on every terminal path; bound queued work, concurrent discovery/connection exposure and aggregate retained response memory. Define fair-enough isolation so one failing/slow server cannot consume all capacity. - Keep tools/call non-replaying by default. Reuse circuit breaking only with an explicit side-effect-safe contract; HTTP GET retries do not authorize tool retries. ## Non-goals Distributed business quotas (P1-13), a new connection pool, automatic tool replay, or latency-adaptive concurrency (separately tracked by #7930). This task owns deterministic resource caps and bounded queues, not that adaptive controller. ## Acceptance criteria - [ ] Local and remote load cannot exceed configured global/per-server in-flight or queue limits; queue deadlines include time already spent waiting. - [ ] Error, cancellation, timeout, configuration removal and shutdown release permits and queued references without double release. - [ ] Invalid configuration is rejected consistently; runtime updates cannot bypass hard bounds. - [ ] Slow/failing-server and parallel-refresh fixtures demonstrate bounded connections/memory and unaffected independent targets within documented shared-capacity limits. - [ ] Rejections and in-flight state use P1-05 bounded metrics, with operational defaults and sizing guidance. ## Tests Deterministic concurrent admission/cancellation/update tests; actual HTTP MCP fixtures for slow, large and failing upstreams; multi-request memory/connection measurements with stated limits rather than unsupported performance claims; legacy response-bound and no-replay regressions. ## Dependencies P0-03 and P1-05 contracts (#7860/#7921 integration baseline). P1-08/09/10/13 build on these bounds. Coordinate with #7930 without duplicating its algorithm or rollout. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
