Decision records

ADR-0001: Rust + Tokio + hyper for the data plane

• Status: Accepted (2026-10-05)

Context

Handoff §1/§3 require Rust to own listeners, HTTP, TLS, routing, proxying and static serving, using mature libraries and no hand-written HTTP parsers.

Decision

• Tokio multi-threaded runtime (work-stealing) as the only async runtime.
• hyper 1.x for HTTP/1.1 and HTTP/2 framing; hyper-util auto builder to serve both protocols on one listener (ALPN for TLS, preface sniffing for cleartext h2c).
• No tower middleware stack initially: the pipeline is a single explicit async function, which keeps the hot path readable and allocation-light. Revisit if middleware count grows.
• HTTP/3 (Quinn/h3) deferred to M10.

Consequences

• Mature, fuzzed parsers; strict h1 parsing by default.
• hyper has no built-in idle timeout for HTTP/2 or write timeout; we implement connection idle tracking ourselves (scalws-http::conn). Write timeouts remain open (THREAT_MODEL).
• SO_REUSEPORT sharding / io_uring are explicitly out of scope until benchmarks justify them.