Menu
AkurAI-Build
public
Clarify approval field behavior
51bcbe1
README.md
Architecture review (2026-07-11)
Ten independent read-only architect passes reviewed the codebase, each with a distinct lens. The verbatim reports are preserved here:
| Report | Lens |
|---|---|
| 01-rust-idioms.md | Rust language usage and idioms |
| 02-dependencies.md | Dependency and framework choices |
| 03-http-server.md | HTTP server architecture |
| 04-data-layer.md | Data layer and SQLCipher |
| 05-artifact-pipeline.md | Static artifact pipeline |
| 06-security.md | Security architecture |
| 07-cli-dx.md | CLI and developer experience |
| 08-testing.md | Testing and verification |
| 09-performance.md | Performance and scalability |
| 10-maintainability.md | Maintainability and positioning |
Remediation map
Every accepted finding was fixed in its own commit; the messages carry the full rationale.
| Commit | Findings addressed |
|---|---|
1c21596 | R10 P0: repository had zero commits |
9b8027c | R1/R3/R9 P0: per-request template recompilation and router clone |
4171234 | R2/R3 P1: request timeout and in-flight concurrency cap (post-header-parse; the header-read/idle-connection gap is closed by the bounded accept loop below); R3/R4/R9 P1: ready probe; R3 P2: search permit, shutdown edge |
0384e67 | R1/R4/R6: zeroize gap in load_secret |
05d4230 | R5 P1×3: hot-path revalidation, .br mislabel, admit/serve limit skew |
98eda3b | R8 P0: no CI; R2 P1: no RustSec advisory monitoring |
c85ea51 | R8 P0: native listener had no end-to-end tests |
1b9aacb | R10 P1: version pinning stranded verified deployments |
a6c2fdc | R2 P1: unmaintained fs2; misleading = rusqlite pin |
034c906 | R10 P1: crate description/about vs. documented positioning |
39242b4 | R6 P1: self-referential Origin fallback; R6 P2: secret scrubbing, COOP/CORP |
9e37f72 | R3 P2: If-None-Match conformance, page-route 405s; R7 P1: dev asset reload |
687d789 | R4 P1: write-time search budget; R4 P2: version stamps, write gate; R9 P2: alloc-free scan |
ced5201 | R5 P1: distinct trailing-slash modes; R5 P2: encoded redirects, scan bounds, divergence reporting; R1 P2: expect removal |
1386d4e | R7 P1/P2: --json consistency, doctor exit codes, hints, scoped commands; R8 P1: smoke-only test |
5d254c3 | R8 P1: precompressed negotiation tests, property-based fuzzing |
57eba57 | R10 P2: sortable previous releases; R1 P2: typed deploy mode, From impls |
df12d49 | R1 P1/R10 P2: library/binary split, deploy module extraction |
81edd4e | R10 P2: consolidated hardened filesystem helpers (fsguard) |
3896462 | R2 P2: axum default-feature trim |
75b5a12 | R8 P2: subprocess CLI wiring tests |
| accept-loop follow-up | R2/R3 P1 residual: bounded accept loop (hyper_util auto builder) adds a per-connection header-read timeout and a 1,024 connection cap, closing the slow-header/idle keep-alive gap; raw-socket regression test |
Findings that were consciously deferred, with rationale and triggers, are in backlog.md. Schema-affecting decisions are consolidated in ../static-schema-evolution.md.