REST Server Subsystem

REST Server Subsystem An architecture diagram generated by Archify. Auth Dependency · bearer + peer + Host · Architecture component · constant-time Auth Dependency bearer + peer + Host constant-time Body Limit · per-route cap · Architecture component Body Limit per-route cap Concurrency Limits · lifespan-owned · Architecture component Concurrency Limits lifespan-owned HTTP Caller · loopback client · Architecture component HTTP Caller loopback client FastAPI App · create_app() · Architecture component · docs disabled FastAPI App create_app() docs disabled /v1 Routes · HTTP models · projection · Architecture component /v1 Routes HTTP models · projection Neutral Contracts · requests · events · outcomes · Architecture component Neutral Contracts requests · events · outcomes NotebookLMClient · process singleton · Architecture component · ADR-0004 NotebookLMClient process singleton ADR-0004 /healthz · only public route · Architecture component /healthz only public route REST Projection · HTTP status · safe detail · Architecture component REST Projection HTTP status · safe detail Pending Registry · bounded FIFO · Architecture component · poll the resource Pending Registry bounded FIFO poll the resource Full-ID Resolvers · identity functions · Architecture component Full-ID Resolvers identity functions HTTP dispatch typed request live client guards size cap admission classify created ids injected resolver unguarded Legend Frontend Backend Database Security External

Single tenant

  • • One client is attempted at ASGI lifespan and lazy-retried after a stale-auth startup
  • • Routes own Pydantic input, HTTP responses, safe errors, and status codes
  • • Neutral cores expose typed contracts; server/ imports no click, rich, or cli

Guards

  • • Every /v1 request needs a static bearer plus loopback peer and Host checks by default
  • • The /docs and /openapi.json schema surface is disabled

Long-running work

  • • Create returns immediately; the matching GET reports pending, 200, 404, 409 or 410
  • • One table validates generation; source batches preserve ordered four-state evidence
  • • URLs and titles are redacted; expensive route groups have concurrency limiters