AkurAI-Build

public
Latest change f4593dd5a5507ae3ef33db9fce54925a02186295 - server: bound the accept loop with a header-read timeout and connection cap (closes #2) by Olafur Bui
# Architecture review (2026-07-11)

Ten independent read-only architect passes reviewed the codebase, each with a
distinct lens. The verbatim reports are preserved here:

| Report | Lens |
| --- | --- |
| [01-rust-idioms.md](01-rust-idioms.md) | Rust language usage and idioms |
| [02-dependencies.md](02-dependencies.md) | Dependency and framework choices |
| [03-http-server.md](03-http-server.md) | HTTP server architecture |
| [04-data-layer.md](04-data-layer.md) | Data layer and SQLCipher |
| [05-artifact-pipeline.md](05-artifact-pipeline.md) | Static artifact pipeline |
| [06-security.md](06-security.md) | Security architecture |
| [07-cli-dx.md](07-cli-dx.md) | CLI and developer experience |
| [08-testing.md](08-testing.md) | Testing and verification |
| [09-performance.md](09-performance.md) | Performance and scalability |
| [10-maintainability.md](10-maintainability.md) | Maintainability and positioning |

## Remediation map

Every accepted finding was fixed in its own commit; the messages carry the
full rationale.

| Commit | Findings addressed |
| --- | --- |
| `1c21596` | R10 P0: repository had zero commits |
| `9b8027c` | R1/R3/R9 P0: per-request template recompilation and router clone |
| `4171234` | R2/R3 P1: request timeout and in-flight concurrency cap (post-header-parse; the header-read/idle-connection gap is closed by the bounded accept loop below); R3/R4/R9 P1: ready probe; R3 P2: search permit, shutdown edge |
| `0384e67` | R1/R4/R6: zeroize gap in `load_secret` |
| `05d4230` | R5 P1×3: hot-path revalidation, `.br` mislabel, admit/serve limit skew |
| `98eda3b` | R8 P0: no CI; R2 P1: no RustSec advisory monitoring |
| `c85ea51` | R8 P0: native listener had no end-to-end tests |
| `1b9aacb` | R10 P1: version pinning stranded verified deployments |
| `a6c2fdc` | R2 P1: unmaintained `fs2`; misleading `=` rusqlite pin |
| `034c906` | R10 P1: crate description/about vs. documented positioning |
| `39242b4` | R6 P1: self-referential Origin fallback; R6 P2: secret scrubbing, COOP/CORP |
| `9e37f72` | R3 P2: If-None-Match conformance, page-route 405s; R7 P1: dev asset reload |
| `687d789` | R4 P1: write-time search budget; R4 P2: version stamps, write gate; R9 P2: alloc-free scan |
| `ced5201` | R5 P1: distinct trailing-slash modes; R5 P2: encoded redirects, scan bounds, divergence reporting; R1 P2: `expect` removal |
| `1386d4e` | R7 P1/P2: `--json` consistency, doctor exit codes, hints, scoped commands; R8 P1: smoke-only `test` |
| `5d254c3` | R8 P1: precompressed negotiation tests, property-based fuzzing |
| `57eba57` | R10 P2: sortable previous releases; R1 P2: typed deploy mode, `From` impls |
| `df12d49` | R1 P1/R10 P2: library/binary split, deploy module extraction |
| `81edd4e` | R10 P2: consolidated hardened filesystem helpers (`fsguard`) |
| `3896462` | R2 P2: axum default-feature trim |
| `75b5a12` | R8 P2: subprocess CLI wiring tests |
| _accept-loop follow-up_ | R2/R3 P1 residual: bounded accept loop (`hyper_util` auto builder) adds a per-connection header-read timeout and a 1,024 connection cap, closing the slow-header/idle keep-alive gap; raw-socket regression test |

Findings that were consciously deferred, with rationale and triggers, are in
[backlog.md](backlog.md). Schema-affecting decisions are consolidated in
[../static-schema-evolution.md](../static-schema-evolution.md).