← Driving RustL5 · The Boundary
Score 0
1/7 Two designs — pick one

In-process, or sidecar?

Chatboting’s chunker is now a 300-line Rust crate. The Python ingest worker on the same box must call it thousands of times a minute. Two ways to connect them.

the designL5·1
A · PyO3 extension: import chunker inside the Python workerPythoningest workerchunker.so(Rust)callcost per crossingB · sidecar: a Rust service on the same box, called over HTTPPythoningest workerchunkerservice (Rust)HTTP + JSONcost per crossing
2/7 Find the flaw

The boundary is too small

The Python loop calls the Rust extension once per token, a million times per document. It is slower than before. Tap the flaw.

the designL5·2
Python: for tokenin documentRust: score_token(t)×1,000,000 callsconvert result backtime in actual worktime crossing the boundary

Tap the part that will not survive contact with reality — or press 1…4.

3/7 Find the flaw

The boundary is too large

Six months in, the “chunker extension” has grown. Tap the box that should never have crossed into Rust.

the designL5·3
crate: chunker_ext (Rust) — six months inchunker (pure)tokeniser (pure)Postgres writes (sqlx)config loadingOpenAI HTTP clientretry / backoff policyPython: import chunker_ext; chunker_ext.run_everything()

Tap the part that will not survive contact with reality — or press 1…5.

4/7 Judge the agent

“It’s just one unsafe block”

Your agent wants to skip a copy at the Python boundary. Judge the proposal.

the designL5·4
numpy array(owned by Python)unsafe { slice::from_raw_parts(ptr, n) }reviewer,foreverraw pointerarr.resize()
The agent says

I’ll pass the numpy buffer to Rust as a raw pointer and read it with an unsafe slice::from_raw_parts. Zero-copy, and it’s just one unsafe block, well commented.

5/7 Two designs — pick one

WASM, or a sidecar?

VoiceKit’s voice-activity detector must run on the server and in a browser demo. Same 20 ms frame budget. Two designs.

the designL5·5
A · one Rust crate, compiled twice: native on the server, WASM in the browservad crateserver: nativebrowser: WASMlatency per 20 ms frameB · sidecar on the server; the browser streams frames over a WebSocketbrowserVAD sidecar(server)frame ↑verdict ↓latency per 20 ms frame
6/7 Put it in order

Sizing a boundary

Order the steps for carving a Rust element out of a Python system, first to last. Then run a carve through them.

the pipelineL5·6
carve123456
    Level 5 cleared

    What survives this level

    pure function flat data in → flat data out no IO · no config · no policy ≤ 1,000 lines · one named owner PyO3 · same process~25 ns per call + conversion WASM · browsercopies at the edge, no network CLI · shipped binaryargs in, bytes out, ms to spawn sidecar · socketown lifecycle, ~ms per round trip cheaper to crossmore isolated cross as rarely as possible · measure with the crossing included
    You can now say to a coding agent“Give Rust one pure function with a flat data contract, pick the thinnest boundary that fits its lifecycle, and measure with the crossing included.”
    Added to your ledger
    unsafe — meaning, legitimacy, and its real costunsafe is a promise the compiler cannot check; its real cost is that a human must review it forever.
    FFI: PyO3, WASM, CLI, sidecar — sizing the boundaryGive Rust a pure function with a flat data contract and cross the boundary as rarely as possible.

    Back to the map Next: L6 Accounts, Not Objects →

    What clearing this level buys you
    “Give Rust one pure function with a flat data contract, pick the thinnest boundary that fits its lifecycle, and measure with the crossing included.”