# Architecture

QA Scribe has three runtime layers: a React renderer, a Tauri command bridge, and a Rust core that owns SQLite, managed files, and generation workflows. AI calls are local process executions, not hosted API calls from the app.

## Runtime diagram

```mermaid
graph LR
    User[Tester] -->|edits records| Renderer[React renderer]
    Renderer -->|typed commands| Bridge[Tauri command bridge]
    Bridge -->|locks service| Service[SessionService]
    Service -->|SQL| SQLite[(SQLite app-data DB)]
    Service -->|managed files| Attachments[attachments/session-id]
    Bridge -->|background job| JobStore[JobStore]
    JobStore -->|spawn CLI| Provider[Claude, Codex, or Copilot CLI]
    Provider -->|stream text| JobStore
    JobStore -->|events| Renderer
```

## Layers

The renderer in `frontend/src/app/useAppController.ts` owns view state, autosave timing, active provider choices, generation jobs, and UI notices. `frontend/src/tauriCommands.ts` wraps generated command bindings from `frontend/src/bindings.ts` so view code does not call Tauri directly.

The desktop shell in `src-tauri/src/main.rs` creates the app-data directory, opens `qa-scribe.sqlite`, builds `AppState`, registers `JobStore`, and wires the Specta command handler. Command modules under `src-tauri/src/commands` translate frontend calls into `SessionService` methods and structured `CommandError` values from `src-tauri/src/commands/error.rs`.

The core crate in `crates/qa-scribe-core/src/lib.rs` contains domain DTOs, SQLite storage, attachment management, AI provider command construction, prompt rendering, response repair, and persistence workflows. `crates/qa-scribe-core/src/storage/mod.rs` owns schema version 7 and the tables for Sessions, Entries, Attachments, Findings, Evidence links, Generation contexts, AI runs, Drafts, and App settings.

## Source mix

The codebase is mostly Rust by source file count, with a React/TypeScript renderer and a smaller set of packaging scripts. See [By the numbers](by-the-numbers.md) for the full snapshot.

```mermaid
xychart-beta
    title "Tracked source files by language"
    x-axis ["Rust", "TypeScript", "TSX", "JavaScript", "CSS", "Python"]
    y-axis "Files" 0 --> 90
    bar [82, 35, 21, 16, 7, 5]
```

## Data boundaries

SQLite and attachment files live in the Tauri app-data directory created by `src-tauri/src/main.rs`. Managed attachment import and preview logic in `crates/qa-scribe-core/src/attachments/mod.rs` hashes file content and uses relative paths under `attachments/<session-id>/`. Provider authentication stays outside QA Scribe; provider readiness and model detection are implemented in `src-tauri/src/commands/providers`.

For feature-level flows, see [Session capture](features--session-capture.md), [Managed attachments](features--managed-attachments.md), and [AI-assisted Testware](features--ai-assisted-testware.md).