harness

Cratefield Harness is the open-source MIT-licensed core behind Cratefield, a Rust backend harness you compile your own backend from. The stated premise: every product needs a backend and almost none should be built from scratch, so this is that backend, once. You pick module crates, wire adapters, and ship one stateless Worker with its own database. Composition model. A venture declares a Harness builder with a venture identity, public URL and CORS origins, adds modules, and selects a runtime with its database binding, mailer and captcha providers. Build refuses a module that requires a port the runtime does not provide, two modules claiming the same table or route, or a module built against a different contract version. The venture template runs the composition under cargo test, so misconfiguration fails before deploy. Modules and ports. A module is a crate implementing a Module trait and is mounted at a versioned path per module name. It declares its name, required ports, migrations (SQL embedded via include_str!, in a subset accepted by both SQLite and Postgres) and an axum router. Modules never touch vendor bindings, environment variables or vendor clients; they ask for ports such as Database, Mailer, Captcha, RateLimiter, Signer and KeyValue, and adapters answer. According to the README, that single rule is what makes moving off Cloudflare a change of one runtime crate. Included crates. The cratefield facade; cratefield-core with the Module trait, Harness builder, port traits, problem+json errors, request scope, event bus and templates; cratefield-runtime-cloudflare; adapters for Resend mail, Turnstile captcha and SQLite via rusqlite; modules email-signup with double opt-in, unsubscribe and admin export, and waitlist with confirm, position and referral codes; cratefield-secrets with envelope-encrypted secrets over the Database port; cratefield-kms for wrapping and unwrapping data keys, with a local-file provider that refuses production; cratefield-ui, which renders the module surface as HTML at /ui; cratefield-cli exposing the fz binary with migrations collect, doctor and modules commands; and cratefield-testing, a conformance kit every module must pass. Planned crates are cratefield-adapter-postgres over sqlx and cratefield-runtime-native on tokio. Migrations and requests. Queries go through sea-query so they render for either database. Confirmation and unsubscribe links are HMAC-signed tokens with key rotation, so there is no session store. Request scope travels in axum extensions rather than shared state, and the conformance kit includes a concurrent-request test that checks it. Mounting. A module is either compiled into the Worker, which is the default, or run as a sidecar with its own Worker built and deployed separately and mounted at the same path over a service binding with the same database and secrets. The README states the sidecar option is designed but not built. Observability. One structured span per request carries request_id, method, route, module, status, duration_ms, ip_hash and ua_family, and never an email address. Workers Logs is enabled in the template wrangler.toml and responses echo x-request-id. The error taxonomy is generated from the core registry and drift-checked in CI. Roadmap as stated in the repository. M0 foundation (workspace tooling, core, Cloudflare runtime, Resend and Turnstile adapters, SQLite adapter, fz, testing kit), M1 first modules, M2 first venture live with crates.io publishing, docs and contract versioning, marked in progress, and M3 self-hosted portability with the Postgres adapter, native runtime, parity suite and data move. Three further epics are specified but unscheduled. Toolchain and status. Stable Rust pinned in rust-toolchain.toml, target wasm32-unknown-unknown, worker-build and wrangler; CI runs fmt, clippy with warnings denied, tests, cargo deny, and builds the example venture to wasm so a native-only dependency cannot slip into a module. The crates are not yet published to crates.io, so the README advises depending on the repository by git. Private crates are marked publish = false rather than living in a separate repository. License: MIT.