02 / Technology
Explore Mentaview's Rust architecture, direct and authenticated HTTP access, API lifecycle, security boundaries, deployment profiles and measured performance.
The Rust core, unpublished in-process SDK v1 and injected host-owned network-transport contract are implemented as a controlled pilot. The HTTP server is also a controlled pilot. The SDK contract has no qualified real network execution; registry distribution, compatibility history, language SDKs and streaming clients remain roadmap work.
System architecture
Mentaview separates how a host reaches the system from how a request is authorized, planned, executed, verified and observed. That keeps interface transports replaceable and prevents a chat client from becoming the policy engine.
Access surfaces
The same domain and application contracts sit behind each qualified access path. Status labels describe current maturity, not a promise that every distribution is ready today.
The shortest path for native servers, appliances and performance-sensitive hosts. An unpublished bounded v1 facade reaches injected application and kernel contracts directly, and a separate synchronous transport contract lets the host compose bounded network exchanges without making the SDK an HTTP client.
Remote products use versioned JSON operations, tenant-aware credentials, normalized errors, correlation IDs, health probes and Prometheus-compatible metrics.
Operators can run explicit local profiles, inspect capability availability and add separately installed inference or retrieval packs without automatic discovery or download.
Future language and network clients may expose token and lifecycle events over streaming transports. They will present the existing contract, not own cognition, memory, authorization or evidence policy.
Request lifecycle
Inference is one optional step in a larger lifecycle. Core state, control and data capabilities remain valid when no external provider is configured.
Resolve the tenant-aware principal, request ID and authorized scope before application work begins.
Turn content and requested profile into provider-neutral intent, answer obligations and resource budgets.
Intersect possible capabilities with data, egress, provider and deployment policy.
Use direct handling or the minimum justified combination of memory, retrieval, research and inference.
Check requested-facet coverage, evidence admissibility, citation fidelity and remaining gaps.
Store authorized state through journaled required effects, expose bounded recovery state, emit audit, metrics and normalized non-invoice usage evidence, and return an explicit outcome or error.
HTTP surface
The current network surface uses authenticated JSON operations with caller-supplied or generated request IDs, input validation and normalized error responses. It is a controlled-pilot interface, not yet a general-availability SDK commitment.
/v1/conversations/{conversation_id}/turnsRun a governed conversational turn.
/v1/conversations/{conversation_id}/retrievalRetrieve authorized private evidence for a conversation.
/v1/conversations/{conversation_id}/executions/{execution_id}/recoveryRead bounded tenant-scoped reconciliation state; manual recovery remains explicit for indeterminate dispatch.
/v1/conversations/{conversation_id}/executions/{execution_id}/commercial-usageRead tenant-scoped normalized provider usage evidence; the response is explicitly non-invoice and non-billing-authoritative.
/v1/conversations/{conversation_id}/stateRead the scoped conversation state.
/v1/conversations/{conversation_id}/memoriesList memories visible in the active scope.
/v1/knowledge/sourcesRegister a knowledge source under explicit policy.
/v1/knowledge/filesIngest an authorized file through the document boundary.
/v1/conversations/{conversation_id}/executions/{execution_id}/feedbackAttach feedback to one resolved execution.
/health/liveReport process liveness.
/health/readyReport dependency and readiness state.
/metricsExpose operational metrics for the deployment.
Protected operations require a tenant-aware API credential. Health and metrics routes support deployment operations.
Turns accept content plus bounded cognitive, task and research preferences. Server policy remains authoritative.
Failures use normalized envelopes. A request ID is propagated or generated so the execution can be traced without relying on raw prompt logs.
Rust runtime boundaries
The workspace isolates stable contracts, cognitive decisions, capability modules, adapters and application surfaces. A module can be tested or packaged without requiring the entire system to become one opaque service.
Stable identifiers, requests, outcomes and normalized failures. No provider transport or storage detail belongs here.
Intent, planning, capability budgets, policy and publication decisions. This is the provider-neutral cognitive control plane.
Question contract, memory, retrieval, research, evidence firewall and ingestion own separate, testable responsibilities.
Inference, embeddings, stores and external transports implement contracts without becoming product policy.
Direct Rust calls, HTTP server, CLI and edge compositions expose the same underlying behavior for different hosts.
Frozen holdouts, replay inputs, promotion gates and failure tests decide whether a capability can move between maturity levels.
Security and sovereignty
Core operation does not require an automatically loaded model or an undeclared external service. When generative inference is necessary but unavailable or unauthorized, the system reports that boundary explicitly.
Tenant-aware API keys and scoped conversation state. PostgreSQL row-level security supports tenant isolation on the network profile.
No provider is a valid configuration. Generative work returns an explicit inference-required outcome when no authorized endpoint exists.
No automatic model download, discovery or invocation. Local packs are separately installed, verified and selected by the host.
Deployment-aware pseudonymization can protect recognized values before remote inference, then validate and restore them inside the originating scope.
Budgets, bounded repair, normalized errors and abstention prevent retry loops or silent fallback from becoming policy.
Correlation IDs, health, metrics and aggregate traces expose route behavior without making raw private content the default telemetry surface.
Deployment profiles
Each distribution profile has its own readiness boundary. Existing contracts can be shared while installers, Rust SDK distribution, compatibility evidence, language bindings, commercial controls and device qualification advance independently.
Add governed cognition through authenticated APIs while keeping inference pools explicit and replaceable.
A turnkey service for teams that want Mentaview-operated lifecycle, quotas, support and control plane.
Keep data, credentials and inference inside the customer's server, LAN or VPC boundary.
Run state, ingestion, retrieval and policy locally; add verified on-device inference only when the host chooses it.
Embed a policy-governed cognitive layer behind host callbacks, selected accelerators and product-specific constraints.
Consume cognition in-process for performance or through HTTP for remote clients without importing provider policy into the UI.
Performance discipline
Latency alone is incomplete, and quality without resource or failure accounting is equally incomplete. Evaluations compare correctness, coverage, p95 latency, calls, abstention, restart behavior, isolation and target-hardware constraints.
Sealed multilingual Wave 11 machine holdout; zero orphan claims, critical false-completes or extra model calls; 40 blind human reviews remain pending
Completed with three recorded restarts on the tested path
Semantic, provenance and citations; zero orphan citations or research budget failures
Sealed synthetic BM25 holdout; zero wrong-document top-1 results and zero scope leaks
Three separately executed prospective suites on frozen profiles
Measurement boundary: these figures describe historical internal or canary profiles on named workloads. They do not constitute a production SLA, capacity commitment or claim that orchestration always outperforms direct inference.
Read the evidence record and negative resultIntegration path
A useful technical evaluation is staged so identity, errors, observability and deletion can be verified before adding private corpora or model providers.
Choose direct Rust or the HTTP pilot and define the exact deployment profile.
Validate identity, conversation state, health, metrics, normalized errors and an inference-required outcome with no provider.
Ingest a bounded corpus, test retrieval provenance and verify scope, export and deletion behavior.
Register a local, controlled-private or public endpoint with explicit egress and confidentiality policy.
Compare the complete path with the simplest valid baseline on representative held-out work.
A bounded next step
Bring the host application, data topology, provider class, target hardware and acceptance envelope. The first output should be an explicit integration and evidence contract.