Feat/natural language goal creation

apps/api/go.mod

@@ -1,6 +1,6 @@
 module github.com/suncrestlabs/nester/apps/api
 
-go 1.25.11
+go 1.25.12
 
 require (
 	github.com/DATA-DOG/go-sqlmock v1.5.2
@@ -39,8 +39,8 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	golang.org/x/crypto v0.46.0 // indirect
 	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
-	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
 	golang.org/x/sys v0.39.0 // indirect
-	golang.org/x/text v0.32.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

apps/api/go.sum

@@ -155,12 +155,12 @@ golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
 golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
 golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

apps/intelligence/app/main.py

@@ -1,5 +1,7 @@
 import logging
+import re
 import time
+import uuid
 from collections.abc import AsyncIterator, Awaitable, Callable
 from contextlib import asynccontextmanager
 
@@ -15,6 +17,13 @@
 
 limiter = Limiter(key_func=get_remote_address)
 
+# Bounded, safe charset for a client-supplied request ID (typical UUID/ULID/
+# opaque-token shape). Anything else — oversized, containing control
+# characters, etc. — is rejected in favour of a freshly minted UUID so an
+# untrusted header can't smuggle log/header injection or unbounded values
+# into request.state.request_id, response headers, or guardrail audit logs.
+_REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9._-]{1,128}$")
+
 
 @asynccontextmanager
 async def lifespan(app: FastAPI) -> AsyncIterator[None]:
@@ -27,6 +36,25 @@ async def lifespan(app: FastAPI) -> AsyncIterator[None]:
 app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)  # type: ignore[arg-type]
 
 
+@app.middleware("http")
+async def add_request_id(
+    request: Request, call_next: Callable[[Request], Awaitable[Response]]
+) -> Response:
+    """Attach a request ID to every request for correlating guardrail logs.
+
+    Reuses an inbound X-Request-Id if present and well-formed (e.g. from an
+    upstream gateway), otherwise mints a fresh one, and always echoes it
+    back. A malformed or oversized inbound value is replaced rather than
+    trusted, since it flows into response headers and log lines.
+    """
+    inbound = request.headers.get("X-Request-Id", "")
+    request_id = inbound if _REQUEST_ID_RE.match(inbound) else str(uuid.uuid4())
+    request.state.request_id = request_id
+    response = await call_next(request)
+    response.headers["X-Request-Id"] = request_id
+    return response
+
+
 @app.middleware("http")
 async def add_process_time_header(
     request: Request, call_next: Callable[[Request], Awaitable[Response]]
@@ -38,7 +66,8 @@ async def add_process_time_header(
         f"Endpoint: {request.url.path} | "
         f"Method: {request.method} | "
         f"Status: {response.status_code} | "
-        f"Duration: {process_time:.4f}s"
+        f"Duration: {process_time:.4f}s | "
+        f"RequestId: {getattr(request.state, 'request_id', '-')}"
     )
     return response
 

apps/intelligence/app/models/coaching.py

@@ -4,13 +4,15 @@
 
 from pydantic import BaseModel, Field
 
+from app.services.guardrails import MAX_USER_MESSAGE_CHARS
+
 
 class SavingsGoalContext(BaseModel):
     id: str | None = None
     target_amount: float
     currency: str = "USDC"
     deadline: str
-    description: str | None = None
+    description: str | None = Field(default=None, max_length=MAX_USER_MESSAGE_CHARS)
     current_amount: float = 0
     progress_pct: float = 0
 

apps/intelligence/app/models/recommendation.py

@@ -2,9 +2,15 @@
 
 from pydantic import BaseModel, Field
 
+from app.services.guardrails import MAX_USER_MESSAGE_CHARS
+
 ConfidenceLevel = Literal["high", "medium", "low"]
 
 
+class AnalyzeRequest(BaseModel):
+    prompt: str = Field(..., min_length=1, max_length=MAX_USER_MESSAGE_CHARS)
+
+
 class Recommendation(BaseModel):
     action: str
     rationale: str
@@ -24,7 +30,7 @@ class VaultRecommendationRequest(BaseModel):
     risk_tolerance: Literal["conservative", "moderate", "aggressive"]
     time_horizon_months: int = Field(gt=0, le=120)
     initial_deposit_usdc: float = Field(gt=0)
-    savings_goal: str | None = None
+    savings_goal: str | None = Field(default=None, max_length=MAX_USER_MESSAGE_CHARS)
 
 
 class VaultRecommendationResponse(BaseModel):