code wiki / apistack
topic: apistack
41 modules sharing the apistack name family (derived from the tree's prefix discipline).
The apistack topic family provides foundational capabilities for building robust, scalable, and secure API systems within the Nishi sovereign ecosystem. Modules like nx_apistack_audit ensure traceability of privileged actions, nx_apistack_breaker manages resilience through circuit-breaking, and nx_apistack_bulkhead enforces concurrency limits. Together, these modules support deterministic traffic management, configuration updates, and content negotiation, forming a cohesive layer for reliable API operations.
auto-narrated by the local model from this topic's module headers; links verified against the wiki index.
narrated overview -- maintained by the narration lane, module links verified against this wiki.
| module | description | lines | funcs |
|---|---|---|---|
| nx_apistack_audit.nx | CAP-API-AUDIT: the control-plane must-have -- a who/what/when trail for every privileged | 104 | 7 |
| nx_apistack_audit_gate.nx | 43 | 4 | |
| nx_apistack_breaker.nx | CAP-API-BREAKER: per-dependency circuit-breaker for /api downstream calls. Pure state | 34 | 2 |
| nx_apistack_breaker_gate.nx | hermetic gate for CAP-API-BREAKER. Proves the CLOSED->OPEN->HALF->CLOSED/OPEN | 47 | 3 |
| nx_apistack_bulkhead.nx | CAP-API-BULKHEAD: concurrency isolation for /api. A bulkhead caps concurrent in-flight | 16 | 2 |
| nx_apistack_bulkhead_gate.nx | hermetic gate for CAP-API-BULKHEAD. Proves the concurrency cap: acquire up to max, | 40 | 3 |
| nx_apistack_canary.nx | CAP-API-CANARY: canary / blue-green traffic splitting for /api deploys. Deterministic | 24 | 2 |
| nx_apistack_canary_gate.nx | hermetic gate for CAP-API-CANARY. Proves pct=0 all-stable, pct=100 all-canary, an | 47 | 3 |
| nx_apistack_census.nx | the HONEST MEASURED scorecard for making /api THE CONTROL SYSTEM (operate the whole | 136 | 4 |
| nx_apistack_configpush.nx | CAP-API-CONFIGPUSH: declarative config push + hot-reload over /api. A caller POSTs new | 31 | 4 |
| nx_apistack_configpush_gate.nx | hermetic gate for CAP-API-CONFIGPUSH. Proves apply writes + returns a gen, | 45 | 5 |
| nx_apistack_content.nx | CAP-API-CONTENT: content-negotiation for /api. Reads the Accept header and picks the | 23 | 4 |
| nx_apistack_content_gate.nx | hermetic gate for CAP-API-CONTENT. Proves Accept matching, first-supported choice, | 46 | 4 |
| nx_apistack_cors.nx | CAP-API-CORS: cross-origin control for /api. DENY-BY-DEFAULT: an Origin is allowed only if | 44 | 3 |
| nx_apistack_cors_gate.nx | hermetic gate for CAP-API-CORS. Proves deny-by-default: allowlisted origin allowed, | 43 | 6 |
| nx_apistack_idempotency.nx | CAP-API-IDEMPOTENCY: exactly-once writes over /api. A control plane's write actions | 67 | 4 |
| nx_apistack_idempotency_gate.nx | 43 | 4 | |
| nx_apistack_metrics.nx | CAP-API-METRICS: request/action counters for /api observability, emitted to the | 26 | 4 |
| nx_apistack_metrics_gate.nx | hermetic gate for CAP-API-METRICS. Proves integer counters increment/add, stay | 51 | 5 |
| nx_apistack_migrate.nx | CAP-API-MIGRATE: wire /api/migrate (was 501) = ingest external HTML into a sovereign | 17 | 1 |
| nx_apistack_migrate_gate.nx | hermetic gate for CAP-API-MIGRATE. Proves HTML tags stripped, '|' sanitized, text | 41 | 5 |
| nx_apistack_mtls.nx | CAP-API-MTLS: mutual-TLS client authentication for /api via certificate-fingerprint | 29 | 2 |
| nx_apistack_mtls_gate.nx | hermetic gate for CAP-API-MTLS. Proves pinned fingerprint allowed, unknown denied, | 39 | 5 |
| nx_apistack_oidc.nx | CAP-API-OIDC: OAuth2/OIDC bridge for /api -- parse a JWT (header.payload.signature), | 64 | 6 |
| nx_apistack_oidc_gate.nx | 46 | 5 | |
| nx_apistack_paginate.nx | CAP-API-PAGINATE: deterministic cursor pagination for /api list endpoints (shards, | 20 | 2 |
| nx_apistack_paginate_gate.nx | hermetic gate for CAP-API-PAGINATE. Proves page counts, the walk to the last | 38 | 3 |
| nx_apistack_problem.nx | CAP-API-PROBLEM: RFC 7807 / RFC 9457 error contract (application/problem+json) for /api. | 38 | 4 |
| nx_apistack_problem_gate.nx | 41 | 4 | |
| nx_apistack_ratelimit.nx | CAP-API-RATELIMIT: request quotas over /api (429 on exhaustion). Deterministic | 55 | 3 |
| nx_apistack_ratelimit_gate.nx | 53 | 3 | |
| nx_apistack_schema.nx | CAP-API-SCHEMA: machine-readable request validation for /api (OpenAPI/JSON-Schema role). | 45 | 2 |
| nx_apistack_schema_gate.nx | 40 | 4 | |
| nx_apistack_slo.nx | CAP-API-SLO: service-level objective + error budget for /api, computed from the deterministic | 24 | 4 |
| nx_apistack_slo_gate.nx | hermetic gate for CAP-API-SLO. Proves allowed-errors, budget, breach detection, and | 40 | 1 |
| nx_apistack_svctoken.nx | CAP-API-SVCTOKEN: scoped machine-to-machine tokens for /api (service accounts that | 48 | 4 |
| nx_apistack_svctoken_gate.nx | 42 | 6 | |
| nx_apistack_trace.nx | CAP-API-TRACE: distributed tracing for /api via W3C traceparent | 35 | 4 |
| nx_apistack_trace_gate.nx | hermetic gate for CAP-API-TRACE. Proves the W3C traceparent is well-formed, the right | 48 | 4 |
| nx_apistack_version.nx | CAP-API-VERSION: API version negotiation for /api. Reads the requested version from a | 31 | 2 |
| nx_apistack_version_gate.nx | hermetic gate for CAP-API-VERSION. Proves version extraction from media-type + URL, | 39 | 4 |