AkurAI Build
Sign in with AkurAI ID
Menu

AkurAI-Build

public

Latest change 1c2159692a31765cd66ed709791ba11468054873 - Initial commit: bunfork v0.1.0 source tree by Olafur Bui

## Final gate: NO-SHIP

Current Bunfork is a coherent Linux-first Rust/MiniJinja/vector appliance, but it is not release-safe as a deployable framework host. The decisive blocker is destructive `deploy --force`: its forgeable manifest can authorize replacement of an arbitrary direct-child directory, including safety-critical paths. Secret-equivalence and restore TOCTOU issues reinforce the no-ship decision.

### Final product claim

> Bunfork is a Linux-first Rust server that will host immutable prebuilt static web artifacts and explicitly registered Rust server-rendered MPAs, with optional SQLCipher-backed vector services. It does not compile, execute, or emulate JavaScript frameworks or runtimes.

Honest ecosystem relationship:

- Svelte/SvelteKit, Vue/Nuxt, Vite, and Next.js: host admitted static exports only.
- Rari: borrow the artifact-host boundary; do not reproduce its V8/React/Vite runtime.
- Leptos/Dioxus: offer a Rust-native MPA contract, not reactive hydration or WASM.
- Bun/Deno/Andromeda: borrow CLI, process, and operational ideas only; no runtime compatibility.

Default remains `0.0.0.0:3100`.

### P0 implementation slices, in order

1. **Make deployment non-destructive.**

   Replace `bunfork-deployment-v1` ownership checks with a complete digest-bound artifact manifest. Refuse `.git`, `src`, `data`, `target`, `backups`, symlinks, hard links, devices, and all unowned directories regardless of manifest contents.

   Stage with exclusive creation, hash and fsync files/directories, atomically rename, retain exactly one verified previous release, and clean stale releases safely.

2. **Fix filesystem and secret invariants.**

   Use descriptor-based no-follow operations for backup, restore, migration, and publication. Reject hard links consistently. Decode database key and API token before comparing them; compare bytes, not textual hex.

3. **Add real black-box release tests.**

   Start the binary, exercise the listener, deploy from a clean directory, test SIGTERM, concurrent requests, static files, routes, headers, and failure recovery. Existing helper tests and Cargo smoke checks are insufficient.

4. **Classify client errors correctly.**

   Invalid IDs, vectors, dimensions, limits, body sizes, and search-budget violations must return stable 4xx responses rather than 500.

5. **Make release artifacts truthful.**

   Validate templates, pages, public files, manifest contents, and schema before publication. Remove false `database_included`/`secrets_included` claims or derive them from inspected contents.

### P1 implementation slices

6. **Split runtime modes.**

   Implement:

   ```text
   bunfork serve --static DIR --manifest FILE
   bunfork serve --app APP
   bunfork serve --static DIR --manifest FILE --app APP
   ```

   Static mode must start without SQLCipher, migrations, database keys, API tokens, tenant, or model configuration.

7. **Implement `bunfork-static-v1`.**

   Frozen manifest:

   ```json
   {
     "format": "bunfork-static-v1",
     "root": ".",
     "mode": "mpa",
     "base": "/",
     "fallback": null,
     "trailing_slash": "directory",
     "precompressed": true,
     "immutable": true,
     "files": {}
   }
   ```

   Require complete sorted SHA-256 and byte-length records. Serve byte-preserving HTML, CSS, JS, WASM, images, fonts, and JSON. Never execute or rewrite browser code.

8. **Implement static HTTP semantics.**

   Support `GET` and `HEAD`; return `405` with `Allow` otherwise. Define base paths, `/x/index.html`, trailing-slash policy, explicit 404s, SPA fallback exclusions, MIME types, ETags, cache policy, gzip/Brotli negotiation, `Vary: Accept-Encoding`, CSP, and traversal rejection.

9. **Decouple and harden the data service.**

   Keep SQLCipher/vector search opt-in. Strengthen exact schema validation and preserve existing bounded exhaustive search, encrypted backup, migration, and restore capabilities.

10. **Only then add the Rust MPA kernel.**

    Provide explicitly registered Rust routes, loaders, actions, request/query/header/cookie access, redirects, response construction, layouts, error pages, CSRF, authentication, and optional `Store`. Do not add procedural macros, dynamic plugins, embedded JS, or automatic endpoint scripts.

### Required CLI and manifest contracts

```text
bunfork keygen
bunfork build --run PROGRAM --arg ARG... --cwd DIR --output DIR --manifest FILE
bunfork admit --artifact DIR --manifest FILE
bunfork doctor [--json] [--strict]
bunfork readiness [--json]
bunfork dev --static DIR --manifest FILE
bunfork serve --static DIR --manifest FILE
bunfork serve --app APP
bunfork test
bunfork deploy --artifact DIR --manifest FILE [--out DIR] [--force]
bunfork migrate
bunfork backup
bunfork restore BACKUP --yes
bunfork vector put|search|delete
```

`build` must use an argv vector, never a shell, and must use an explicit reduced environment. Precedence is CLI > explicitly selected config > narrow operational environment variables > defaults. No framework autodetection.

### Security invariants

- No destructive replacement without a verified complete ownership manifest.
- Never replace protected or unowned paths.
- No symlink, hard-link, device, traversal, or path-escape acceptance.
- Descriptor-based no-follow reads for restore and publication.
- Database key and API token must differ by decoded secret bytes.
- Static mode has no database or secret dependency.
- Templates cannot access secrets, authorization headers, raw bodies, or keys.
- State changes never use `GET`.
- Rust authorization precedes loaders/actions.
- Mutations require origin/referer checks and CSRF tokens.
- Sessions are opaque, random, revocable server-side identifiers.
- Cookies default to `HttpOnly; Secure; SameSite=Lax; Path=/`.
- Error responses do not expose internals or secrets.
- Default bind remains `0.0.0.0:3100`; TLS remains the reverse proxy’s responsibility.
- No claim of cryptographic, host, root, live-process, or compromised-binary protection.

### Explicit no-go scope

Do not implement:

- Svelte/Vue/SvelteKit/Nuxt/Next source or build compatibility.
- Vite transforms, module graphs, HMR, or plugin APIs.
- React/RSC/Flight, Nitro, Node server bundles, or server adapters.
- Bun/Deno JavaScript/TypeScript/WASM runtimes.
- Leptos/Dioxus hydration, signals, browser WASM, or native targets.
- Runtime JavaScript execution.
- Framework server actions, middleware, streaming, ISR, SSR adapters, or automatic API route interpretation.
- Cloud deployment, DNS/TLS provisioning, remote backups, accounts, roles, rate limiting, or distributed coordination.

### Canonical framework fixture matrix

| Ecosystem | Positive fixture | Negative fixture |
|---|---|---|
| Svelte | Vite-built counter/static export | `.svelte`, compiler, reactive source |
| SvelteKit | `adapter-static` MPA and SPA | `adapter-node`, server loads/actions |
| Next.js | `output: 'export'`, base path, deep links | `.next/server`, standalone, RSC/SSR |
| Vue | Vite-built SFC/static SPA | `.vue` source and runtime compilation |
| Nuxt | `nuxt generate` output | Nitro server, async server routes |
| Vite | official static build | Vite config/plugin execution |
| Rari | static browser artifact only | V8/React/RSC runtime output |
| Leptos | prerendered HTML/static assets | hydration, server functions, WASM |
| Dioxus | prerendered/static output | signals, hydration, full-stack RPC |
| Bun | externally built static output | Bun runtime/package/test semantics |
| Deno | externally built static output | V8 permissions, TS runtime, fetch runtime |
| Andromeda | static artifact hosting | Nova JavaScript runtime semantics |

### Requirement completion checklist

| Requirement | Status |
|---|---|
| Rust HTTP server | Implemented |
| Default `0.0.0.0:3100` | Implemented |
| MiniJinja HTML autoescaping | Implemented |
| File routes, params, groups, catch-alls | Partially implemented |
| Static asset serving | Implemented only under `/assets` |
| SQLCipher migrations | Implemented |
| Bounded exhaustive vector search | Implemented |
| Encrypted backup/restore | Implemented, security hardening incomplete |
| Graceful shutdown | Implemented, black-box proof missing |
| Framework source compatibility | Not implemented; should remain no-go |
| Framework build compatibility | Not implemented; should remain no-go |
| Static artifact hosting | Must still be built |
| Page-only startup | Must still be built |
| Immutable digest manifest | Must still be built |
| Safe deployment ownership | Must still be built; P0 blocker |
| Restore/migration race resistance | Must still be built; P0 |
| Secret byte-equivalence check | Must still be built; P0 |
| Correct 4xx error classification | Must still be built; P1 |
| Exact schema validation | Must still be built; P1 |
| Clean-machine release test | Must still be built |
| Rust loaders/actions/full-stack contract | Must still be built; P1/P2 boundary |
| Doctor/readiness contracts | Must still be built |
| Reconciled systemd install layout/hardening | Must still be built |

Ship only after P0 passes and the static artifact mode passes its listener-level fixture suite.