fix(iwooos): bound security source concurrency

apps/api/src/services/iwooos_security_asset_control_plane.py

@@ -15,8 +15,9 @@ from src.db.base import get_db_context
 logger = structlog.get_logger(__name__)
 
 _SCHEMA_VERSION = "iwooos_security_asset_control_plane_v1"
-_QUERY_TIMEOUT_SECONDS = 20.0
-_SOURCE_QUERY_TIMEOUT_SECONDS = 4.0
+_QUERY_TIMEOUT_SECONDS = 12.0
+_SOURCE_QUERY_TIMEOUT_SECONDS = 3.0
+_SOURCE_CONCURRENCY = 3
 _CACHE_TTL_SECONDS = 30.0
 _DISCOVERY_FRESHNESS_SECONDS = 2 * 60 * 60
 _WINDOW_HOURS = 24
@@ -1372,7 +1373,7 @@ class IwoooSSecurityAssetControlPlaneService:
             return payload
 
     async def _load_snapshot(self) -> dict[str, Any]:
-        source_limiter = asyncio.Semaphore(1)
+        source_limiter = asyncio.Semaphore(_SOURCE_CONCURRENCY)
         source_results = await asyncio.gather(
             _read_public_source(
                 project_id="awoooi",

apps/api/tests/test_iwooos_security_asset_control_plane.py

@@ -342,7 +342,7 @@ def test_service_uses_canonical_awoooi_project_scope(monkeypatch) -> None:
     assert payload["summary"]["unavailable_source_count"] == 9
 
 
-def test_service_serializes_sources_for_single_connection_budget(monkeypatch) -> None:
+def test_service_bounds_source_concurrency_for_database_budget(monkeypatch) -> None:
     service = IwoooSSecurityAssetControlPlaneService()
     concurrency = {"active": 0, "maximum": 0}
 
@@ -377,7 +377,7 @@ def test_service_serializes_sources_for_single_connection_budget(monkeypatch) ->
     )
     payload = asyncio.run(service._load_snapshot())
 
-    assert concurrency["maximum"] == 1
+    assert concurrency["maximum"] == 3
     assert payload["summary"]["source_count"] == 9
     assert payload["summary"]["ready_source_count"] == 9
     assert payload["summary"]["unavailable_source_count"] == 0