feat(cache): add 100MB MaxSize and sets Discard MaxBytes limit to NATS KV cache buckets

[migmartri]

Summary

Improves behavior of Nats Cache implementation to leverage DiscardOld capabilities, to do that we needed to

• Add a 100MB MaxBytes cap to both NATS KV cache buckets (attestation bundles and policy evaluation bundles) to prevent unbounded memory growth. When the limit is reached, NATS evicts the oldest entries automatically.
• Update default behavior to discardOld (discardNew is default in nats upstream configuration for KV)

[cubic-dev-ai]

No issues found across 5 files

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/cache/natskv.go">

<violation number="1" location="pkg/cache/natskv.go:81">
P1: Cache init now hard-fails on backing stream info/update errors when MaxBytes is enabled, introducing a new startup compatibility/availability regression.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

P1: Cache init now hard-fails on backing stream info/update errors when MaxBytes is enabled, introducing a new startup compatibility/availability regression.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/cache/natskv.go, line 81:

<comment>Cache init now hard-fails on backing stream info/update errors when MaxBytes is enabled, introducing a new startup compatibility/availability regression.</comment>

<file context>
@@ -72,6 +73,22 @@ func (c *natsKVCache[T]) initBucket() error {
+	// the oldest entries are evicted automatically to make room for new ones.
+	if c.cfg.maxBytes > 0 {
+		streamName := fmt.Sprintf("KV_%s", c.bucket)
+		stream, err := js.Stream(context.Background(), streamName)
+		if err != nil {
+			return fmt.Errorf("cache: failed to get backing stream %s: %w", streamName, err)
</file context>