Problem

While exploring the codebase in preparation for DMP 2026, I identified a critical gap in the backend's external API handling. Neither the Aurora API (aurora_api.py) nor the OSDG API (app.py) have any rate limiting, retry logic, or 429 error handling. This directly impacts the DMP 2026 acceptance criteria which requires testing 100 projects from the DPG registry.

Current State

After auditing the codebase:

• aurora_api.py — calls requests.post with no timeout, no retry, no 429 handling
• app.py (OSDG route) — calls requests.post with a hardcoded timeout=1000 but no retry or 429 handling
• embedding_url.py — calls GitHub API with timeout=30 but no retry logic
• No time.sleep, backoff, or rate limiting exists anywhere in the backend

Impact

The DMP 2026 implementation details explicitly state:

"There are two external APIs called Aurora API and OSDG API integrated into the tool. Both of them have certain rate limit. You can only make 1 request per second, so please maintain the API request logic so that the API server doesn't get overwhelmed and get 'Too many requests' error."

When the DMP intern begins bulk testing 100 DPG registry projects, every batch run will hit 429 errors from the Aurora and OSDG APIs. Since there is no retry or backoff handling, these 429s are currently caught by a generic except block and returned as a 500 error to the frontend — crashing the entire test session with no indication of what went wrong.

This means neither of the two core DMP acceptance criteria are currently achievable:

• 100 test results from the DPG registry
• 85% accuracy

Both require stable, uninterrupted bulk API calls which are impossible without rate limit awareness.

References

• DMP 2026 implementation detail User feedback #4
• backend/aurora_api.py — Aurora API call with no rate limit handling
• backend/app.py lines 177-194 — OSDG API call with no 429 handling
• backend/embedding_url.py — GitHub API call with no retry logic