Operations

Hosting, configuration, size limits, timeouts, caching and error behaviour of the GovBridge service.

GovBridge runs as a lean, stateless Node service — operated by eNetworkers, strictly EU-hosted.

Hosting

Aspect	Value
Platform	Railway
Region	`europe-west4` (Amsterdam, EU)
Public URL	`https://govbridge.sovrgpt.com`
Health check	`GET /healthz` → `200 {"status":"ok","protocols":["cmis","fit-connect"]}`
Image	private GHCR image, pulled with registry credentials
TLS	Let's Encrypt certificate, issued automatically

The service scales horizontally: because the dispatcher is stateless (every request carries its own resolved tenant context), several instances can run without shared session state.

Configuration (environment variables)

Variable	Default	Purpose
`PORT`	`8080`	HTTP listen port.
`SUPABASE_URL`	— (required)	Supabase project URL (endpoint lookup).
`SUPABASE_SERVICE_ROLE_KEY`	— (required)	Service role key for the endpoint lookup.
`GOVBRIDGE_ENCRYPTION_KEY`	— (required)	32-byte base64 AES key.
`GOVBRIDGE_PROTOCOLS`	`cmis`	Comma-separated list of served protocols.
`BACKEND_TIMEOUT_MS`	`15000`	Hard timeout per DMS HTTP call.
`LOG_LEVEL`	`info`	`error` / `warn` / `info` / `debug`.
`SENTRY_DSN`	— (optional)	Error monitoring (region DE).

Size limits

Several hard limits protect memory and response time:

Limit	Value	Where
JSON-RPC request body	1 MB	transport (single call or batch)
Inline text (`cmis_dokument_holen`)	32 KB	`content.ts` (`MAX_TEXT_BYTES`)
Inline binary (base64)	5 MB	`content.ts` (`MAX_INLINE_BYTES`)
CMIS JSON response	4 MB	`cmis/client.ts` (`MAX_JSON_BYTES`)
FIT-Connect JSON response	1 MB	`fit-connect/client.ts` (`MAX_JSON_BYTES`)
FIT-Connect application data (`fit_antrag_senden`)	5 MB	`fit-connect/index.ts` (`MAX_INLINE_BYTES`)
FIT-Connect attachments	max. 10, 5 MB each	`fit-connect/index.ts` (`MAX_ATTACHMENTS`, `MAX_INLINE_BYTES`)
OAuth token response	64 KB	`backend-auth.ts`

Content policy for `cmis_dokument_holen`

Text ≤ 32 KB → inline as a text resource.
Allowlisted binary type ≤ 5 MB (PDF, DOC/DOCX, XLS/XLSX, PNG, JPEG) → base64 blob.
Anything larger / MIME types not on the list → reference only (cmis://<objectId>) plus metadata, without the bytes.

Timeouts & caching

Hard upstream timeout (BACKEND_TIMEOUT_MS, default 15 s) via AbortController — a hanging backend never blocks the chat turn.
The OAuth backend token is cached per endpoint in process RAM and renewed 30 s before it expires (SAFETY_WINDOW_MS).
The CMIS repository service document is cached for 5 minutes (REPO_TTL_MS) to save one round trip per call.
Business content is never cached — every call pulls live from the DMS.

Error behaviour

Errors are translated into model-visible messages and returned as a tool result with isError: true (not as a protocol abort), so the assistant can react instead of aborting the turn.

⚠️ The messages themselves are emitted in German, because the service is built for German public administration. They are listed here verbatim with their meaning:

Cause	Model-visible message (German, verbatim)	Meaning
Backend timeout	„Das Fachverfahren hat nicht rechtzeitig geantwortet (Timeout)."	The line-of-business system did not answer in time.
Backend HTTP/network error	„Fehler beim Zugriff auf das Fachverfahren: …"	Error while accessing the line-of-business system.
Missing parameter	„Parameter '`name`' fehlt."	Parameter '`name`' is missing.
Write access blocked	„Schreibzugriff ist für diesen Endpoint nicht freigegeben."	Write access is not enabled for this endpoint.
Unknown tool	„Unbekanntes Tool: `name`"	Unknown tool: `name`.

At the transport level: an invalid route or method → 404/405, a failed tenant resolution → a generic 401, pure notifications → 202 without a body.

Availability check

curl -s https://govbridge.sovrgpt.com/healthz
# → {"status":"ok","protocols":["cmis"]}

A complete MCP initialize handshake against a specific endpoint is described in Setup.