REST Server Subsystem

REST Server Subsystem An architecture diagram generated by Archify. Auth Dependency · bearer + Host · Architecture component · constant-time Auth Dependency bearer + Host constant-time Body Limit · per-route cap · Architecture component Body Limit per-route cap Concurrency Limits · lifespan-owned · Architecture component Concurrency Limits lifespan-owned HTTP Caller · loopback client · Architecture component HTTP Caller loopback client FastAPI App · create_app() · Architecture component · docs disabled FastAPI App create_app() docs disabled /v1 Routes · server/routes/ · Architecture component /v1 Routes server/routes/ Application Cores · _app/ · Architecture component Application Cores _app/ NotebookLMClient · opened at lifespan · Architecture component · ADR-0004 NotebookLMClient opened at lifespan ADR-0004 /healthz · only public route · Architecture component /healthz only public route Error Envelope · category + status · Architecture component Error Envelope category + status Pending Registry · bounded FIFO · Architecture component · poll the resource Pending Registry bounded FIFO poll the resource Full-ID Resolvers · identity functions · Architecture component Full-ID Resolvers identity functions HTTP dispatch typed request live client guards size cap admission classify created ids injected resolver unguarded Legend Frontend Backend Database Security External

Single tenant

  • • One client is opened at ASGI lifespan, inside the server event loop
  • • Workflow routes use _app/ cores; simple operations call public client namespaces
  • • server/ imports no click, rich or cli — pinned by test_server_boundary.py

Guards

  • • Every /v1 request needs a static bearer plus a loopback Host literal
  • • The /docs and /openapi.json schema surface is disabled

Long-running work

  • • Create returns immediately; the matching GET reports pending, 200, 404, 409 or 410
  • • Expensive route groups have lifespan-owned concurrency limiters