v0.25.0

docs/ARCHITECTURE.md

@@ -23,6 +23,7 @@ committed document at startup; this is not one cross-memory/SQLite transaction.
 | `server` | Bounded listeners, TLS acceptance, HTTP/1.1/HTTP/2 selection, connection leases and shutdown |
 | `proxy` | Host/authority routing, ACL sequencing, forwarding and streaming instrumentation |
 | `proxy::websocket` | Handshake validation, upgrade tasks and bounded bidirectional byte transport |
+| `web_server` | Reusable static-file services, safe document-root traversal, validators/ranges and streamed local file bodies |
 | `upstream` | Per-backend pools, guarded resolver, connection deadlines and verified HTTPS clients |
 | `tls` | Local PEM files, generation/import, validation, SNI and loaded certificate snapshots |
 | `config` | Desired models, normalization, validation and compiled snapshots |
@@ -52,9 +53,11 @@ response bodies. HTTP/2 connections share the public TCP cap with HTTP/1.1 and T
 Upgraded WebSocket tasks retain both the Exchange and TCP lease after Hyper stops
 managing the HTTP connection, preventing upgrades from escaping limits or counters.
 
-Routing captures one snapshot. Socket peer identity, host and route ACLs are checked
-before DNS or upstream connection reuse. Forwarding uses a URI built from a stored
-backend origin; the public client never supplies an arbitrary destination. Header
+Routing captures one snapshot. Socket peer identity, host and route ACLs plus configured
+authentication are checked before source dispatch, DNS or upstream connection reuse. A selected
+Web Server source opens only its compiled Web Service root and returns through the shared response
+pipeline; a Reverse Proxy source continues to a stored backend origin. The public client never
+supplies an arbitrary upstream destination or filesystem root. Header
 rules cannot change the identity already used by ACL. Ordinary bodies pass through
 without full aggregation. For an explicitly transform-enabled vhost, eligible bounded
 static responses use the logical pipeline `origin -> decode supported Content-Encoding
@@ -131,8 +134,7 @@ probes outside the data path. DNS and configured-origin policies are shared with
 normal forwarding; HTTP checks use a dedicated connection and discard the body.
 Traffic sampling and status snapshots operate on these observations, not SQLite.
 
-Forwarding order is actual frontend selection -> host/vhost/path ACL -> eligible
-member selection -> member-isolated cache lookup -> guarded upstream request.
+Request order is actual frontend selection -> host/vhost/path ACL/auth -> location/source selection. Web Server then performs confined local filesystem handling; Reverse Proxy continues through eligible member selection -> member-isolated cache lookup -> guarded upstream request.
 Cookie affinity bypasses cache. Cache hits release the selection without recording
 an actual upstream request. Response protection is applied after cache selection,
 and per-vhost HSTS is removed on plaintext, including synthetic responses.