feat(api): phase-2 weave, aspects as data + keystore

[hyperpolymath]

The weave: cross-cutting concerns become aspects — data on the resolution, not code copied into every resolver. aspects.zig runs the five-step pipeline once (cache read -> produce -> envelope -> cache write -> audit); resolvers collapse to producers plus aspect lists, and REST, gRPC and GraphQL all resolve through the same pipelines. Cache hits are audited too; the temporal producer fixes a dangling slice in the as_of default-time path.

Deny-by-default: keystore.zig loads keys from AERIE_API_KEYS / KYAML api_keys (key:name:modules), constant-time compared, no early exit. Missing/unknown key -> 401, unentitled module -> 403; health and meta stay public; every decision is audited. Compose sets open for dev.

/api/v1/meta renders the same route and aspect tables the dispatcher uses — the description cannot drift from the behaviour.

Verified live: 401/403/200 matrix, entitlement scoping, meta output, open-mode fallback. 43/43 tests.

Summary

Changes

RSR Quality Checklist

Required

• Tests pass (just test or equivalent)
• Code is formatted (just fmt or equivalent)
• Linter is clean (no new warnings or errors)
• No banned language patterns (no , no npm/bun, no Go/Python)
• No unsafe blocks without // SAFETY: comments
• No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
• SPDX license headers present on all new/modified source files
• No secrets, credentials, or .env files included

As Applicable

• .machine_readable/descriptiles/STATE.a2ml updated (if project state changed)
• .machine_readable/descriptiles/ECOSYSTEM.a2ml updated (if integrations changed)
• .machine_readable/descriptiles/META.a2ml updated (if architectural decisions changed)
• Documentation updated for user-facing changes
• TOPOLOGY.md updated (if architecture changed)
• CHANGELOG or release notes updated
• New dependencies reviewed for license compatibility (MPL-2.0 / MPL-2.0)
• ABI/FFI changes validated (src/interface/abi/ and src/interface/ffi/ consistent)

Testing

Screenshots

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 98ef118f-fe48-4c6a-8ade-607af63fc538

📥 Commits

Reviewing files that changed from the base of the PR and between 00816ec and a6bf63f.

📒 Files selected for processing (13)

• CHANGELOG.adoc
• compose.yml
• configs/aerie.kyaml
• src/api/zig/aspects.zig
• src/api/zig/config.zig
• src/api/zig/ctx.zig
• src/api/zig/keystore.zig
• src/api/zig/main.zig
• src/api/zig/policy.zig
• src/api/zig/proof.zig
• src/api/zig/resolvers.zig
• src/api/zig/router.zig
• src/api/zig/types.zig

 __________________________________________
< Dollars to donuts, you didn't test this. >
 ------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}