Web & app server
A competent HTTP server with a built-in SLA, auth and identity provider, and a fake-refusing service-virtualization plane.
4 Strong · 5 Solid · 2 Partial · 1 Emerging
Measured against: Express · FastAPI · WireMock · Folders: base/appserver(opens in a new tab) · base/service(opens in a new tab) · For programmers: this area's reference
Rethought from first principles
What Softanza kept from what works, and what it rethought, as the library wrote it down in its design documents and narrations.
The Softanza wayThe server is a host, not a per-request library: the engine is already loaded and warm, and the server only moves requests onto it and results back.
Kept from the best practice
- Routing stays plain: a table of method, path and handler, with path parameters like /user/:id and a trailing wildcard. Exact routes are tried first. source(opens in a new tab)
- Login uses published standards: OpenID Connect, passkeys, SAML and one-time codes. A session's token is replaced whenever it gains privilege, which defeats session fixation. source(opens in a new tab)
- A data back-end is plain REST over the embedded SQLite database: Expose(db, table) gives list, read, create, update and delete, safe from injection, with honest 404s. source(opens in a new tab)
Rethought
- The engine is resident, so there are no cold starts and no clustering for warmth. Workers scale only for concurrency and load isolation, specialised by competence, not by module. source(opens in a new tab)
- One host, four shapes: web routes, a data back-end, raw device streams, and hosted agents. Agents share the server's own event loop instead of a separate runtime. source(opens in a new tab)
- A login does not set a flag or return a role string. It returns an actor carrying capabilities and a trust level, which the rest of the program already understands. source(opens in a new tab)
- Code the whole app against faithful sandboxes, then switch to real services at deploy. The registry refuses to let a sandbox ship to production. source(opens in a new tab)
Two things live here, and the distinctive one isn't the web server. The HTTP server is real and competent -- reactor-driven HTTP/1.1, Express-like routing, built-in HTTPS/mTLS, auto-CRUD sqlite, and ahead of Express and FastAPI a built-in per-request SLA bracket plus an auth router that is also an OIDC provider -- but middleware is registered-but-never-invoked, with no JSON body parsing, streaming or WebSocket. The standout is the service-virtualization plane: stateful doubles under a governance gate where Deploy(:Production) structurally refuses a fake dependency, even for a fully-entitled human.
What a crafter does with it, and what stands out
- A built-in per-request SLA bracket with Prometheus /metrics and distributed tracing, ahead of Express and FastAPI
- A mounted auth router that is also an OIDC provider (discovery, JWKS, authorize, PKCE token)
- Stateful service doubles that enforce the real service's rules -- WireMock-and-beyond
- Deploy(:Production) structurally refuses a fake dependency, even for a fully-entitled human
What is owed
- Execute the middleware pipeline (registered but never invoked)
- JSON request bodies and streaming responses
- Serve static files; WebSocket serving; latency injection and a status-aware live adapter in the sandbox
- OpenAPI/schema and content negotiation; server-side HTTP/2; deeper MBaaS
The Softanza way, run
What Softanza does differently in this area, shown by code taken from its narrations and guards, and run for this page.
A login returns an actor with capabilities and a trust level, not a role string.
NOW = 1700000000 # a fixed clock, as in the guard
a = new stzAuth()
a.Register("dana", "pw")
a.GrantRole("dana", "admin")
tok = a.LoginAt("dana", "pw", NOW)
act = a.ActorOfAt(tok, NOW)
? "user : " + act.Name()
? "capabilities: " + @@(act.Kinds())
? "posture : " + act.Posture()user : dana capabilities: [ "effectful", "compute", "sensing" ] posture : trusted
run on 2026-10-01 21:18 inside the library at commit 0e72e2e2c; taken from base/doc/narrations/stz-auth-the-front-door-narration.md(opens in a new tab)
The identity-provider sandbox holds a real key and can issue a forged token, so the refusal path is tested before any real provider is involved.
NOW = 1700000000 # a fixed clock, as in the guard
idp = new stzOidcSandbox("https://idp.local", "my-app")
rp = new stzOidcClient("https://idp.local", "my-app")
rp.SetJwks( idp.JwksJson() ) # the provider's public keys
b = new stzAuth()
b.SetOidcClient(rp)
? "forged token : [" + b.LoginWithOidcAt(idp.IssueForgedIdTokenAt("dana","n-1",NOW), "n-1", NOW) + "]"
? " why : " + b.OidcWhy()forged token : [] why : the signature does not verify against the provider's key
run on 2026-10-01 21:18 inside the library at commit 0e72e2e2c; taken from base/doc/narrations/stz-auth-the-front-door-narration.md(opens in a new tab)
The articles of this area (4)
- Mastering URL Manipulation with stzUrl: A Complete Guide 2025
- stzAppServer: The Persistent Computational Web Engine Revolution 2025
- Your First App with stzApp: A World That Lives, and Wants 2026
- Getting Paid and Paying 2026
The lanes, one by one
Lanes and their notes are quoted as they were read at the source, on Read from the source on 2026-09-16, from a read-only main worktree.