1. End-to-End Request & Data Flow
Authenticates users via PostgreSQL credentials, Magic Link, or GitHub OAuth. Proxies requests through /api/platform-core/* to the Rust monolith.
Evaluates zero-trust tenant & NDA rules via lock-free ArcSwap snapshots, normalizes raw MPN suffixes, and coordinates distributor enrichment.
Spawns a bounded goroutine pool to query DigiKey v4, Mouser v1, and the verified catalog concurrently, solving best price-break tiers at target batch qty.
Computes calibrated GBDT stock-out probability with feature attributions and ranks pin-compatible replacements via 32-D cosine similarity.
2. Architecture Decision Records (ADRs) & Explicit Trade-Offs
Rust (actix-web) Monolith as the Authoritative Domain & Policy Core
Electronics supply chain workflows combine strict multi-tenant authorization (OEMs, EMS contract manufacturers, and component brokers sharing partial BOM views under NDAs), CPU-bound BOM parsing (50,000+ line spreadsheets), and deterministic pricing/risk calculations.
Keep domain modeling, ABAC policy evaluation, BOM normalization, and ML risk inference inside a single modular Rust workspace (crates/platform-core) using actix-web 4.9 and ArcSwap.
- Pro: Zero network serialization hops between authorization checks, BOM line parsing, and ML stock-out scoring.
- Pro: Compile-time memory safety and fearless concurrency; policy snapshots hot-reload atomically via ArcSwap in < 2 microseconds without RwLock reader contention.
- Trade-off: Longer cold compile times in CI (~3–5 min without caching), mitigated via cargo-chef Docker layers and Swatinem/rust-cache.
Polyglot Boundary: Why Go Owns External Distributor Fan-Out (services/ingest)
Enriching a 400-line BOM requires fanning out concurrent HTTP/OAuth2 requests across DigiKey Product Information v4, Mouser Search API v1, and Nexar/Octopart GraphQL. Each upstream vendor enforces distinct rate limits, retry semantics, and burst quotas.
Isolate external distributor I/O into a dedicated Go ingestion service (services/ingest) using a bounded worker pool, while keeping Rust as the authoritative domain core.
- Pro: Fault isolation — upstream distributor timeouts or rate-limit backpressure never starve actix-web worker threads serving interactive UI and ABAC requests.
- Pro: Go goroutines, context cancellation, and standard-library net/http make high-concurrency fan-out and per-vendor rate limiters concise and easy to audit.
- Counter-argument considered: A Tokio task pool inside the Rust monolith works well too; we separated Go specifically to draw a clean process boundary between untrusted third-party API latency and core domain state.
In-Process Rust ML Inference & 32-D Parametric Vector Search (No Python in Request Path)
Procurement teams need quantitative stock-out probabilities and pin-compatible drop-in alternate recommendations during interactive BOM quoting, where a 300ms Python microservice round-trip or GIL contention degrades UX.
Execute calibrated gradient-boosted log-odds inference (MlRiskEngine) and 32-dimensional L2-normalized parametric + trigram cosine similarity search directly in Rust (crates/platform-core/src/ml_engine), reserving LLMs (Gemini 2.5 Flash) strictly for unstructured synthesis with deterministic fallback.
- Pro: Sub-millisecond inference with explicit per-feature attribution (lead-time hinge, stock-to-demand ratio, distributor diversity, lifecycle stage).
- Pro: Deterministic behavior in CI and offline environments — every AI/ML feature has a verified non-LLM baseline so a third-party LLM outage never breaks quoting.
- Trade-off: Model weights and feature projections must be versioned alongside Rust code or loaded from serialized artifacts.
Developer Experience (DX) & Agent Guardrails via Rust Agent Bridge
As engineers rely more heavily on AI coding agents (Cursor, Claude, internal bots), the highest-severity risk in a multi-tenant B2B platform is an agent generating a SQL query without a tenant_id predicate or authoring a wildcard ABAC rule.
Expose first-class verification endpoints (/api/v1/agent/validate-rule and /api/v1/agent/profile-query) and a companion Rust CLI (platform-cli) so both humans and coding agents validate rules and SQL queries before merge.
- Pro: Turns platform engineering standards into executable checks callable from CI, CLI, or MCP agent tools.
- Pro: Catches missing WHERE tenant_id predicates, unbounded SELECT *, and missing NDA constraints automatically.
3. Developer Experience (DX) & Rust CLI Usage
The workspace ships with crates/platform-cli so engineers and AI coding agents can evaluate ABAC policies, lint SQL queries for multi-tenant isolation, and parse BOMs directly from the terminal or CI pipelines:
# 1. Verify platform health & active policy version cargo run --bin platform-cli -- health # 2. Simulate an ABAC policy decision across tenant boundaries cargo run --bin platform-cli -- test-perm \ --role design_engineer --action read --resource-type bom \ --subject-tenant acme-oem --resource-tenant globex-oem # 3. Lint a SQL query for multi-tenancy leaks & unbounded result sets cargo run --bin platform-cli -- profile-sql \ --query "SELECT * FROM bom_items WHERE quantity > 10" # 4. Stream-parse a PCBA BOM CSV and normalize MPN packaging suffixes cargo run --bin platform-cli -- parse-bom --file sample.csv