Deployment

Qualification status: functional validation is on Windows 11 x64, not a clean Windows Server host. Follow production release gates before treating this release as production-qualified.

Build machine versus server

The build machine needs Rust, Cargo, C++ Build Tools and Windows SDK. Build using ryft build main.rz -o server; retain the source revision, Ryft version, both Cargo.lock files and artifact hash. A built server needs no compiler, Rust toolchain, source files or SQLite DLL. The inspected catalog binary imports VCRUNTIME140.dll and Universal CRT APIs. Provision a compatible x64 Microsoft Visual C++ runtime and validate it on the actual server; this release does not supply a Windows installer or redistributable package.

Use a dedicated service account and an absolute writable data directory. Keep source/build tooling separate from runtime data. Do not run the service as an administrator to compensate for an incorrectly provisioned data directory.

Runtime configuration

The handler deadline starts after body collection. Permit acquisition is immediate; overloaded requests receive 503. App limits default to 100 or the declared connections budget. Both budgets count active requests rather than TCP connections. Body-limit failures receive 413; body-read deadlines 408; handler deadlines 504. Unknown routes receive 404, unsupported methods 405 with Allow, and unwinding handler failures 500 without internal panic details.

Loop/function ticks and SQLite progress callbacks cooperate with deadlines. Timeouts do not provide arbitrary native-code preemption. Tasks retain permits until their computation stops, preventing timed-out work from opening unlimited new compute slots. Per-handler call depth is 128 and ticks are capped at ten million. Tier 0 ignores declared memory budgets; Windows Tier 1 enforces them.

Isolated Windows workers

Run with --isolate to launch one worker process per app from the same binary. Each worker receives a Windows Job Object committed-memory cap (256 MiB default, or the app’s declared memory budget) and an active-process limit of one. This limits committed allocation, not resident set size. Job assignment failures abort startup; the runtime never silently falls back to Tier 0. Validate nested Job Object compatibility if your external service host already uses a job.

Workers bind private loopback ports and require an OS-random supervisor token. Only their own declared environment secrets and OS startup variables are inherited. Worker exits trigger restart with backoff; a failed app may return 502/503 while other apps continue. /_ryft/health reports overall readiness, worker PIDs, memory caps, CPU percentages and restart counts. Restrict this endpoint at ingress. Closing the parent Job Object handles kills workers, including when the parent is forcefully terminated. Recovery and memory containment are tested locally; Windows Server lifecycle/soak qualification remains open.

budget cpu 25%; enables a Job Object hard cap; valid values are 1..100. Omitting it leaves CPU uncapped. Tier 0 treats CPU budgets as metadata. Startup verifies the configured cap through Windows API readback. Under a CPU-capped parent job, the percentage is relative to that parent’s allocation. Remote Desktop Services Dynamic Fair Share Scheduling is incompatible with this API; configuration failures abort startup. Actual CPU rate under sustained load remains unqualified. See Microsoft’s CPU rate control documentation.

Network and shutdown

The HTTP stack is Axum/Hyper with Tokio. It supports concurrent connections, keep-alive, chunked request framing, exact/dynamic routes and HEAD fallback. The runtime does not terminate TLS. Bind to loopback behind an independently configured reverse proxy for HTTPS, header-read/connection limits, ingress rate limits and access logging. Only expose nonlocal bindings deliberately.

Ctrl+C requests graceful shutdown, stops acceptance and allows outstanding requests to finish. A 30-second fallback terminates the process. Forceful termination from an external process manager does not use that graceful path. Native Windows Service Control Manager entry is implemented with --service NAME. The backend provides installation scripts for a LocalService account and protected environment files. Actual service installation, stop/recovery behavior and permissions still require qualification on Windows Server.

SQLite lifecycle

Files are <data-dir>/<app>/<declared-path>, using WAL and foreign keys. Startup checks directories/aliases and refuses storage initialization failures. Each database has its own mutex and a five-second busy timeout. Do not provision cross-app symlinks/hardlinks or run code that modifies these directories under the same account while serving. Logical ownership is not filesystem sandboxing.

Back up with SQLite-aware snapshots/backup tooling, or stop the service and capture the database and relevant WAL state consistently. Do not copy only the main .db during live WAL writes and assume it includes every commit. Restore to a staging instance and verify records and constraints before using the backup. Bounded db_transaction batches are implemented. General migration tracking and automatic backup are not implemented. Plan data compatibility separately from binary rollback.

Secrets and recovery

App environment capabilities must exist and be nonempty before the listener starts. Provide secrets through the service account’s process environment; avoid committing them to source. The catalog example uses one bearer API token and constant-time content comparison; it is not a user authentication system. Use HTTPS, rotation and ingress controls appropriate to the deployment.

Startup failures exit nonzero and write to stderr. Route panics are caught where Rust can unwind; OOM and process aborts can terminate every app. There is no internal worker restart in Tier 0; Tier 1 restarts failed workers. The external process manager must capture logs, handle restarts with backoff, probe health and keep persistent data intact. JSON access logs and Prometheus counters are implemented; operational qualification remains open. Native --service NAME, environment/log files and authenticated graceful shutdown are described in the 0.3 reference. Windows Server SCM qualification remains pending.