feat: add OIDC browser sessions with live access enforcement

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e747-8f27-7242-8df8-8bc44f88c929

tests/test_access_boundary.py

@@ -227,3 +227,24 @@ def test_fact_strings_cannot_be_truthy_grants_and_denials_retain_actor():
     assert owners.records[-1]['subject'] == 'ordinary'
     assert owners.records[-1]['action']
     assert owners.records[-1]['request_digest']
+
+
+def test_slow_request_body_times_out_before_authority_or_handler():
+    from hub_core.security.boundary import AccessBoundary
+    owners = Owners()
+    host = runtime(owners)
+    called = []
+    messages = []
+    async def handler(scope, receive, send):
+        called.append(True)
+    boundary = AccessBoundary(handler, host=host, controller=owners.controller(), body_timeout=0.01)
+    scope = {'type':'http','method':'POST','path':'/ports/messaging/messages',
+             'headers':[(b'authorization',b'Bearer verified-root')], 'query_string':b''}
+    async def receive():
+        await asyncio.Future()
+    async def send(message):
+        messages.append(message)
+    asyncio.run(boundary(scope,receive,send))
+    assert messages[0]['status'] == 408
+    assert not called and not owners.requests
+    assert owners.records[-1]['reason'] == 'request_body_timeout'