chore(vehicle): land document-parser stack — 3 approved PRs (#16783, #16788, #16790)

[mrveiss]

Thinking Path

The owner's new same-file rule groups #16783, #16788 and #16790 because they touch the document-parsing/knowledge-upload surface together. #16788 is stacked on #16783 (base: issue-16773-zip-format-verify, not main) — content verification has to land before the upload allowlist widens on top of it, so #16783's head is merged first, then #16788's head, exactly as instructed. #16790 is independent (base main) and merges last.

This branch is built entirely through the REST API: created from main, then each approved head merged in with POST /repos/.../merges, in that order.

Named vehicle-v090-2026-09-18-docparser, flat with no slash.

What Changed

Nothing new. Three already-reviewed heads, each merged cleanly with no conflicts:

PR	Head	Delivers	Ledger verdict
#16783	ca95302	#16773 — verify ZIP-based office/ODF formats by content, not extension	approve@ca95302a2
#16788	cfb0d49	#16775 — KB upload accepts .xlsx/.pptx/.odt/.ods/.odp, stacked on #16783	approve@cfb0d4932
#16790	c5f51c0	#16785 — DocumentExtractor handles .csv/.json/.html like the GUI upload path	approve@c5f51c052

No excluded members — all three passed the ledger gate (approve at current head, no STALE, no failing check, open) and merged without conflict, including the deliberate #16783-before-#16788 ordering.

Verification

Each member carries a ledger review verdict pinned to the exact head merged here — the table above, all non-stale at merge time. #16788's closingIssuesReferences comes back empty from the GitHub API only because its declared base is #16783's branch rather than main; its own PR body states Closes #16775 explicitly, which is what this vehicle carries forward.

What this PR's own CI must establish is that the union holds: no conflict between members, no ratchet baseline moved, api/knowledge.py still at its size ceiling.

Model Used

Claude Sonnet 5 (coordinator session, vehicle build only — no new code). Members authored and reviewed by their own PR sessions per the ledger verdicts above.

Closes #16773
Closes #16775
Closes #16785

Lint fix commit

9884eca -- lint-only, produced by black/isort/flake8 at the pinned versions, needs non-author review.

Files touched:

• autobot-backend/api/knowledge.py -- flake8 F401 / autoflake: unused function-local import os in _extract_file_content removed (left unused by KB upload allowlist omits already-supported office/ODF formats #16775)
• repo_tests/python_file_size_ratchet_baseline.py, scripts/python_file_size_known_large.py -- knowledge.py ceiling lowered 3414 -> 3413 in both, to match the removed line (the ratchet only turns down)

[coderabbitai]

Warning

Review limit reached

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 17d8ed61-d958-4c3e-b818-5e58afcd514f

📥 Commits

Reviewing files that changed from the base of the PR and between 0e9b3a8 and 9884eca.

⛔ Files ignored due to path filters (2)

• repo_tests/python_file_size_ratchet_baseline.py is excluded by !repo_tests/python_file_size_ratchet_baseline.py
• scripts/python_file_size_known_large.py is excluded by !scripts/python_file_size_known_large.py

📒 Files selected for processing (13)

• .session/HANDOFF-issue-16784-16785-document-format-gaps.md
• autobot-backend/api/knowledge.py
• autobot-backend/api/knowledge_office_upload.py
• autobot-backend/api/knowledge_office_upload_16775_test.py
• autobot-backend/knowledge/documents.py
• autobot-backend/media/document/extraction.py
• autobot-backend/media/document/zip_formats.py
• autobot-backend/media/document/zip_formats_16773_test.py
• autobot-backend/utils/document_dispatch_16773_test.py
• autobot-backend/utils/document_extractors.py
• autobot-backend/utils/document_extractors_16785_test.py
• autobot-backend/utils/document_parser.py
• changelog/unreleased/16785-document-extractor-csv-json-html.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• security(desktop): authenticate to VNC server-side, close the VITE_* password leak (#16299) #17069 security(desktop): authenticate to VNC server-side, close the VITE_* password leak (security: guessable default credentials ship in templates, ansible defaults and the compose file #16299)
• fix(security): audit the orphan-secret-repair test fixture in .secrets.baseline #17067 fix(security): audit the orphan-secret-repair test fixture in .secrets.baseline
• chore(deps): bump the uv group across 1 directory with 2 updates #17066 chore(deps): bump the uv group across 1 directory with 2 updates
• chore(vehicle): land ChatInterface fixes — 2 approved PRs (#16472, #16911) #17064 chore(vehicle): land ChatInterface fixes — 2 approved PRs (feat(collaboration): surface pending invitations in the collaboration panel (#16470) #16472, fix(chat): the init stops at its first await once the component unmounts (#16274) #16911)
• chore(vehicle): land ansible provisioning fix — 1 approved PR (#17037) #17062 chore(vehicle): land ansible provisioning fix — 1 approved PR (security: guessable-default fixes for #16299 (baseline-reasons guard, generate-on-first-run secrets) #17037)
• fix(auth): attribute approval decisions to the verified human caller (#17042) #17051 fix(auth): attribute approval decisions to the verified human caller (security(approvals): an LLC approval's decided_by comes from the request body — any credential can decide and attribute it to anyone; neither approval system requires a human #17042)
• feat(backend): orphan-storage detector framework + code-source clone detector (#17038, #17039) #17050 feat(backend): orphan-storage detector framework + code-source clone detector (Umbrella: SLM Data hygiene page — detect and safely clean up orphaned data across services #17038, feat(backend): orphan-storage detector framework + code-source clone detector, delete through the owning service (#17038) #17039)
• chore(vehicle): land WebSocket auth stack — 4 approved PRs (#16891, #16939, #17018, #17027) #17048 chore(vehicle): land WebSocket auth stack — 4 approved PRs (security(websocket): auth token travels via Sec-WebSocket-Protocol, not the URL (#16457) #16891, security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (#16457) #16939, fix(security): authenticate nine WebSocket endpoints before accept, owner-scope the overseer and workflow sockets, admin-only /api/long-running (#17009, #17010) #17018, fix(ops): long-running operations — create works and records its creator, creator-or-admin access, the panel reads real data, unimplemented starts answer 501 (#17017) #17027)
• chore(vehicle): land CI & hooks infra — 6 approved PRs (#16938, #17032, #16952, #16958, #16882, #16959) #17047 chore(vehicle): land CI & hooks infra — 6 approved PRs (fix(ci): chain formatter dispatch after the branch guard in pre-commit (#16923) #16938, chore(hooks): track the commit-msg hook, install it, and enforce the subject convention (#17029) #17032, fix(tests): prune SKIP dirs during the walk, not after rglob returns (#16601) #16952, test(security): a delegated subagent runs a write its parent is held from (#16950) #16958, security(infra): stop binding ChromaDB to every interface by default (#15317) #16882, fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (#16934) #16959)
• chore(vehicle): land security & KB hardening — 5 approved PRs (#16930, #16895, #16937, #16954, #16989) #17046 chore(vehicle): land security & KB hardening — 5 approved PRs (security(rag): route the chat's RAG path through the content firewall (#16771) #16930, security(secrets): content-scanning credential redactor -- catches a credential in free text (#13708) #16895, fix(security): match injection patterns against what a model reads, not the raw text (#16354) #16937, fix(multimodal): the response says whether a result was stored, and if not, why (#16926) #16954, feat(auth): SLM API keys only on declared routes, 403 elsewhere, every key request audited; main backend accepts none (#16040, #16294, #16999) #16989)
• fix(hooks): use stdin JSON instead of $TOOL_ARGS in settings.json hooks (#17024) #17044 fix(hooks): use stdin JSON instead of $TOOL_ARGS in settings.json hooks (Suspected dead hooks in .claude/settings.json: $TOOL_ARGS may not be a real env var #17024)
• security: guessable-default fixes for #16299 (baseline-reasons guard, generate-on-first-run secrets) #17037 security: guessable-default fixes for security: guessable default credentials ship in templates, ansible defaults and the compose file #16299 (baseline-reasons guard, generate-on-first-run secrets)
• chore(hooks): track the commit-msg hook, install it, and enforce the subject convention (#17029) #17032 chore(hooks): track the commit-msg hook, install it, and enforce the subject convention (commit-msg hook should reject a subject with no issue reference #17029)
• fix(ops): long-running operations — create works and records its creator, creator-or-admin access, the panel reads real data, unimplemented starts answer 501 (#17017) #17027 fix(ops): long-running operations — create works and records its creator, creator-or-admin access, the panel reads real data, unimplemented starts answer 501 (long-running: the four start routes cannot create an operation — create_operation gets estimated_items/context it does not accept (TypeError → 500) #17017)
• fix(security): authenticate nine WebSocket endpoints before accept, owner-scope the overseer and workflow sockets, admin-only /api/long-running (#17009, #17010) #17018 fix(security): authenticate nine WebSocket endpoints before accept, owner-scope the overseer and workflow sockets, admin-only /api/long-running (security(ws): nine WebSocket endpoints accept without authentication — PTY execution, workflow control and KB writes among them #17009, security: /api/long-running has no authentication — anyone can start test runs, scans and KB population, or cancel any operation #17010)
• security(kb): re-scope #16985 to a guard -- every connector already reaches store_fact #17016 security(kb): re-scope security(secrets): wire credential redaction into the remaining 11 KB connectors (#13708 follow-up) #16985 to a guard -- every connector already reaches store_fact
• feat(agents): one-shot idle notice (#16949) #17015 feat(agents): one-shot idle notice (feat(agents): subscribe once to be told when a peer is next idle #16949)
• feat(ci): add an open-PR cap to the pre-push gate (#17006) #17008 feat(ci): add an open-PR cap to the pre-push gate (Open-PR cap: refuse new-branch pushes at/above AUTOBOT_OPEN_PR_CAP (default 40) #17006)
• security(websocket): authenticate /api/intelligent_agent/stream before processing (#17000) #17003 security(websocket): authenticate /api/intelligent_agent/stream before processing (security(websocket): /api/intelligent_agent/stream runs agent goals with no authentication — an unauthenticated bypass of POST /process #17000)
• fix(agents): the peer channel delivers to the recipient, not the sender; broadcast reaches every other agent (#16986) #17001 fix(agents): the peer channel delivers to the recipient, not the sender; broadcast reaches every other agent (agents: the peer channel never delivers to the recipient — a request lands in the sender's own inbox and the sender answers itself #16986)
• feat(agents): peer-to-peer messaging and idle notice (#16948, #16949) #16996 feat(agents): peer-to-peer messaging and idle notice (feat(agents): deliver peer messages at the recipient's next turn, not mid-task #16948, feat(agents): subscribe once to be told when a peer is next idle #16949)
• fix(test): give result.metadata a real dict in 3 multimodal perf/scalability mocks (#16990) #16995 fix(test): give result.metadata a real dict in 3 multimodal perf/scalability mocks (bug(test): 3 multimodal performance/scalability tests fail — metadata Mock lacks __setitem__ since #15234 #16990)
• feat(auth): SLM API keys only on declared routes, 403 elsewhere, every key request audited; main backend accepts none (#16040, #16294, #16999) #16989 feat(auth): SLM API keys only on declared routes, 403 elsewhere, every key request audited; main backend accepts none (API key scopes are stored and displayed but never enforced — keys inherit full user authority #16040, feat(auth): decide which routes accept API keys, and wire X-API-Key through the #16040 mechanism #16294, docs(api): the public API docs tell integrators to send a user API key to the main backend, which accepts none #16999)
• fix(ci): bump the mcp CI floor mirror to match the backend's declared floor (#16449) #16983 fix(ci): bump the mcp CI floor mirror to match the backend's declared floor (chore(mcp): autobot-backend/mcp/ shadows the real mcp PyPI SDK, making it unreachable by name #16449)
• fix(deploy): enable rendered nginx sites on self-update, not just full provision #16980 fix(deploy): enable rendered nginx sites on self-update, not just full provision
• feat(agents): capture a terminal session's tenant at creation (#16975) #16978 feat(agents): capture a terminal session's tenant at creation (feat(agents): capture a terminal session's tenant at creation — it cannot be recovered afterwards #16975)
• feat(security): bound every Company OS run by its org role, per adapter (#16950) #16974 feat(security): bound every Company OS run by its org role, per adapter (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• fix(deploy): the user-frontend build sites publish through a staged swap (#15603) #16970 fix(deploy): the user-frontend build sites publish through a staged swap (bug(deploy): the user-frontend build sites still publish their own failures, and three SLM build sites sit outside the shared staged publish #15603)
• fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (#16957, #16950) #16969 fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (security(a2a): three of four trust-matrix capabilities are enforced nowhere — a level that denies them denies nothing #16957, security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No new hardcoded values of either class — ssot and other both block.

Known backlog in pipeline-scripts/hardcoded_values_baseline.txt is suppressed and tracked in #14371.

[mrveiss]

Superseded by #17077, a combined vehicle built from current main. It carries this vehicle's approved members at their current approved heads. The same-file rule puts #16895 and #16788 into one PR because both touch api/knowledge.py. The branch is kept, not deleted.