add ai gateway

.cargo/audit.toml

@@ -0,0 +1,32 @@
+# cargo-audit configuration.
+#
+# The advisories ignored below are ALL transitively pinned by dependencies we cannot bump from this
+# repo, and each has been assessed for actual exposure. They are listed individually (not blanket
+# `informational` suppression) so a NEW advisory still fails the audit. Re-evaluate when the upstream
+# pins move — chiefly when `pingora` publishes past 0.8 (it is the latest published release as of
+# this writing) and when `beyond-slipstream` relaxes its `async-nats ^0.46` requirement.
+[advisories]
+ignore = [
+  # rustls-webpki 0.102.8: reachable panic in CRL parsing; name-constraint acceptance bugs (URI /
+  # wildcard); CRL distribution-point matching. Pulled ONLY by async-nats 0.46 (pinned by
+  # beyond-slipstream `^0.46`), used for the NATS/slipstream control-channel TLS — NOT the client-
+  # or provider-facing TLS, which already resolve the patched rustls-webpki 0.103.13. Blast radius
+  # is limited to MITM of the deny-set channel, which is fail-open and carries only deny entries.
+  # Fix path: a beyond-slipstream release on async-nats >= 0.47 (uses rustls-webpki 0.103+).
+  "RUSTSEC-2026-0104",
+  "RUSTSEC-2026-0098",
+  "RUSTSEC-2026-0099",
+  "RUSTSEC-2026-0049",
+
+  # protobuf 2.28.0: DoS via uncontrolled recursion when PARSING protobuf. Pulled by prometheus
+  # 0.13 (both our direct dep — kept at 0.13 to share pingora-core's default registry — and
+  # pingora-core 0.8 itself). We never parse untrusted protobuf: metrics are exposed in the text
+  # exposition format via pingora's prometheus_http_service. Fix path: pingora past 0.8 (drops the
+  # prometheus 0.13 / protobuf 2.x chain).
+  "RUSTSEC-2024-0437",
+
+  # Unmaintained-crate warnings (no known vulnerability), all transitive via pingora 0.8:
+  "RUSTSEC-2025-0134", # rustls-pemfile (via rustls-native-certs <- pingora-rustls / async-nats)
+  "RUSTSEC-2025-0069", # daemonize (via pingora-core)
+  "RUSTSEC-2024-0388", # derivative (via a pingora dependency)
+]

.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: CI
+on:
+  pull_request:
+    branches: [main]
+env:
+  CARGO_TERM_COLOR: always
+  # Belt-and-suspenders: the panic-surface + `unused_must_use` denies live in `[lints]` (Cargo.toml)
+  # so they bind locally too, but escalate *every* warning to an error in CI in case a lint isn't
+  # expressible there (build scripts, future targets).
+  RUSTFLAGS: -D warnings
+jobs:
+  check:
+    name: Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: jdx/mise-action@v2
+      - uses: Swatinem/rust-cache@v2
+      # Formatting: dprint (config/json/etc) + rustfmt.
+      - run: mise check:fmt
+      - run: cargo fmt --all --check
+      # Lints: clippy `-D warnings` across all targets. With `[lints.clippy]` denying the panic
+      # surface (unwrap/expect/panic/todo/unimplemented), a new `.unwrap()` in production code
+      # fails the build here.
+      - run: mise check:rs
+      - run: mise test:unit:rs
+      - run: mise test:integration:rs
+      - run: mise build:rs:release

.gitignore

@@ -0,0 +1,14 @@
+target/
+dist/
+**/*.rs.bk
+.env
+.env.*
+!.env.example
+.claude/settings.local.json
+.sqlx
+.wiki
+node_modules/
+bench/out/
+.mcp.json
+.claude
+.env

CLAUDE.md

@@ -51,24 +51,3 @@ Apply the **Theory of Constraints**: a system's throughput is limited by its sin
 5. **Repeat.** The bottleneck has shifted. Go back to step 1.
 
 The corollary: if you can't name the current constraint, you aren't ready to optimize.
-
-<!-- wiki-managed:start (managed by `wiki claude install`; edits inside this block will be overwritten) -->
-
-## Wiki
-
-This repo uses [agent-wiki](.wiki/): `.wiki/` indexes repo markdown docs and code symbols into a queryable knowledge graph.
-
-**Read the wiki before grepping the codebase or reading ARCHITECTURE.md.** Pages are pre-indexed — searching them is faster and ~5–10× cheaper than re-deriving from raw files.
-
-Wiki tools — pick based on what you need:
-
-- `wiki_query "<term>"` — first move for any specific question. BM25++ over repo docs and code symbols; returns ranked hits with paths, scores, and inline snippets.
-- `wiki_answer "<question>"` — returns top-ranked pages with query-relevant passage extracts in one round-trip. Best when you expect the answer exists and want it immediately.
-- `wiki_read "path/to/page.md"` (optionally `section: "..."` or `paths: [...]`) — full page, one section, or multiple pages in one call.
-- `wiki_search_code "<query>"` — search exported symbols, signatures, and doc comments when you need to locate a declaration or understand an API.
-- `wiki_usage_examples "<symbol>"` — real call sites with surrounding source code. Use before changing a function (to see every calling convention you must preserve) or when learning how an unfamiliar API is actually used.
-- `wiki_impact "<symbol>"` — blast radius: every symbol that transitively calls this one, ranked by hop distance. Use before refactoring or renaming to know what breaks.
-- `wiki_callees "<symbol>"` — outgoing call hierarchy (rust-analyzer equivalent): every function this symbol transitively calls, ranked by hop distance. Use when you need to understand what a function depends on before touching it — its DB calls, service calls, and abstractions.
-- `wiki_implementors "<symbol>"` — go-to-implementations (rust-analyzer equivalent): every concrete type that implements a trait or interface. Use when you need to know what's behind a trait object, or how many types a trait change will affect.
-
-<!-- wiki-managed:end -->