/ ENGINEERING SYSTEMS

ARCHITECTURE EXPLORER

A production request is a controlled journey.

Inspect each stage, replay the request path, then switch to the security overlay to see trust boundaries and control points.

REFERENCE ARCHITECTURE · SYNTHETIC
ACTIVE STAGE · 03

Hybrid retrieval

Combine semantic and keyword search with query expansion, metadata policy filters, freshness checks, and document-level authorization.

CONTROLACL-aware retrieval
PRIMARY RISKStale or unauthorized context
See implementation pattern

DECISION RECORDS

Why this shape?

ADR-01

Hybrid retrieval

Semantic recall plus exact-match resilience for acronyms, identifiers, and policy language.

ADR-02

Rerank before generation

Spend model context on the strongest evidence, not the nearest embeddings.

ADR-03

Deterministic validation

Use code for enforceable policies, schemas, citations, and authorization boundaries.

ADR-04

Workflow before agent

Expand autonomy only when a bounded graph cannot express the task safely.

ARCHITECTURE IN PERSONAL PRODUCTS

The same discipline, in native software.

Two concrete applications of boundaries, local state and recovery. These are separate products from the GenAI reference architecture above.

StreamSetu

Separate catalog state from playback.

Source adapters feed a local searchable catalog. AVPlayer, ExoPlayer and mpv own playback through platform-specific capabilities. An engine fallback retries the same stream; choosing a different provider stays with the user.

Source adapters · Local search · Playback recoveryExplore the engineering
BrowserSetu

Keep the engine behind a contract.

A SwiftUI shell talks to system WebKit through an engine boundary and to Rust policy and per-profile SQLite through UniFFI. Resource profiles release eligible tabs; session checkpoints preserve a path back after failure.

Engine boundary · Profile isolation · Session recoveryExplore the engineering
VayuSetu

Separate protection from proof.

VPN, encrypted DNS, Safari blockers and the Mac network filter use platform extensions with explicit boundaries. Checks report observations and limits instead of turning a connected state into an absolute security claim.

Network Extension · WireGuard · Evidence checksExplore the engineering