AkurAI Build
Sign in with AkurAI ID
Menu

AkurAI-Build

public

Latest change 1c2159692a31765cd66ed709791ba11468054873 - Initial commit: bunfork v0.1.0 source tree by Olafur Bui

## Recommendation

Adopt a **Rust-first “artifact host + optional Rust application kernel”** architecture.

Do not pursue source, build, or server-runtime compatibility with SvelteKit, Next.js, Nuxt, Vue, Vite, Bun, Deno, Leptos, or Dioxus. That claim is contradicted by the current product boundary in [README.md](/home/olafurbui/bunfork/README.md:3) and by the actual dependencies in [Cargo.toml](/home/olafurbui/bunfork/Cargo.toml:8).

The product should have three explicit layers:

1. **Static artifact host**

   Serve framework-generated static output—HTML, CSS, JavaScript, WASM, images—from a validated, immutable bundle. Frameworks build elsewhere. Bunfork supplies routing, compression, headers, caching, fallback rules, and a small deployment format.

2. **Rust MPA kernel**

   For Bunfork-native applications, provide Rust-defined loaders, actions, middleware, redirects, cookies, headers, and response construction. Keep MiniJinja as an optional HTML renderer. This creates an honest Rust full-stack model without pretending that templates are Svelte/Vue/React components. The current template contract is only `params`, `pathname`, `tenant`, and `model` ([src/server.rs](/home/olafurbui/bunfork/src/server.rs:376)).

3. **Optional data service**

   Keep SQLCipher and exact-vector search as an opt-in service, not a startup requirement for every site. Current startup requires the database, key, and API token before even serving pages ([src/main.rs](/home/olafurbui/bunfork/src/main.rs:213)); that coupling blocks credible static hosting.

This architecture can get operationally close to the *deployment experience* of the named ecosystems—one CLI, deterministic builds outside the runtime, filesystem routes, static assets, production serving, health checks, and graceful shutdown—without claiming their source semantics or server runtimes.

## Clean-room inspiration versus copying risk

Clean-room behavioral inspiration is acceptable:

- File-route conventions and precedence.
- Static export layouts.
- Development/build/serve command shapes.
- Observable HTTP behavior: status codes, redirects, headers, asset handling, deep links, and error pages.
- Progressive-enhancement form behavior as a general web design pattern.
- Artifact manifests and immutable deployment directories.

Copying risk begins when implementation reproduces protected expression or proprietary structure:

- Porting source, algorithms, tests, fixtures, generated code, documentation text, or distinctive configuration from reference repositories.
- Reimplementing React Server Components, Flight, Vite transforms, Svelte/Vue compilers, Nitro, Node APIs, or framework-specific internal protocols.
- Using reference tests as shipped conformance tests without verifying license and provenance.
- Copying names, branding, compatibility language, or distinctive APIs.
- Embedding a JS engine or native component without separately auditing its license and relinking obligations. Bun’s local license documentation, for example, identifies statically linked LGPL WebKit/JavaScriptCore and object/relinking requirements ([.refrepos/bun/docs/project/license.mdx](/home/olafurbui/bunfork/.refrepos/bun/docs/project/license.mdx:8)).

The existing notice is directionally correct: reference repositories are “research and design inspiration only” and are excluded from compilation and deployment ([THIRD_PARTY_NOTICES.md](/home/olafurbui/bunfork/THIRD_PARTY_NOTICES.md:74)). Preserve that boundary, but add provenance records for newly designed behavior and ensure no reference implementation is used as a coding template.

Rari demonstrates why “Rust runtime” is not enough: its architecture combines Rust HTTP/routing with embedded V8, React, RSC, and Vite ([.refrepos/rari/README.md](/home/olafurbui/bunfork/.refrepos/rari/README.md:13)). Leptos similarly spans reactive state, DOM rendering, macros, SSR, CSR, and hydration ([.refrepos/leptos/ARCHITECTURE.md](/home/olafurbui/bunfork/.refrepos/leptos/ARCHITECTURE.md:15)). Those behaviors are product boundaries, not incidental features to recreate cheaply.

## Non-negotiable blockers

- **Unsafe deployment:** `deploy --force` can replace or delete unowned directories such as `src`, `data`, or `.git` ([src/main.rs](/home/olafurbui/bunfork/src/main.rs:334), [src/main.rs](/home/olafurbui/bunfork/src/main.rs:431)). No compatibility work should proceed until replacement requires a verified Bunfork ownership manifest.
- **No page-only mode:** static serving must work without SQLCipher, migrations, or secrets.
- **No truthful artifact contract:** define manifest schema, root paths, SPA/MPA fallback, MIME behavior, `HEAD`, caching, compression, CSP, and 404 semantics.
- **No application server extension point:** add Rust loaders/actions before calling the system “full-stack.”
- **Insufficient evidence:** helper tests do not prove listener, deployment, concurrency, or clean-machine behavior ([src/main.rs](/home/olafurbui/bunfork/src/main.rs:296)).
- **Security/licensing audit gap:** produce SBOM, dependency/license inventory, provenance records, and binary inspection for every release.

## Product boundary

The strongest honest positioning is:

> A Linux-first Rust artifact host and server-rendered MPA runtime, with optional SQLCipher-backed exact-vector services.

Allowed claims:

- “Next/Rari-inspired file-route syntax.”
- “Rust server-rendered MiniJinja MPA.”
- “Serves validated static exports produced by documented framework configurations.”
- “Single CLI and immutable local deployment artifact.”

Forbidden claims:

- Drop-in, adapter-compatible, or source-compatible with SvelteKit, Next.js, Nuxt, Vue, Vite, Bun, Deno, Leptos, or Dioxus.
- Executes `.next`, Nitro, Svelte server adapters, Rari output, npm packages, or framework server code.
- Provides hydration, RSC, Vite HMR, reactive components, or JS server actions.

## Acceptance evidence

Release acceptance should require:

- A sentinel directory test proving `deploy --force` cannot delete or replace unowned data.
- Clean-machine execution from the artifact with no Cargo checkout.
- Static export tests for deep links, assets, MIME, `HEAD`, cache headers, compression, CSP, 404s, and browser console errors.
- Page-only startup with no database or secrets.
- Rust MPA tests covering query/body parsing, cookies, redirects, loaders, actions, middleware, and custom errors.
- Concurrent requests proving request isolation and HTML escaping.
- SBOM, license notices, source provenance, and reproducible manifest output.
- Explicit negative tests showing official Svelte/Next/Vue/Nuxt source and server artifacts are rejected rather than silently misinterpreted.

Hard recommendation: **build the artifact host and Rust MPA kernel; keep the vector appliance optional; stop at that boundary.** This is novel enough to be a coherent product and honest enough to survive technical and licensing scrutiny.