Update: I have noticed the observability stack, like GlitchTip, SonarQube, Pyroscope, Faro, Tempo, Loki, isn't quite enterprise-grade for what I'm trying to do. But still, that's the good about computer science. You go on and test ideas and continue testing your hypotheses until the science marinates itself, and you start to feel like you are the final boss.
Right now, I'm building a Deterministic Code Validation Engine for AI-Assisted Vibe Coding. To prove it works, I’m putting together a crucible experiment.
The setup is to use a local development XenForo monolith with a hell tonne of bugs. I’m making custom-made mutations and reverse-engineering them so that they survive a prolonged test. These aren't simple syntax errors; they are deep, stealthy logic flaws and state corruptions. I want to see if my scanner can spot these issues in sub-milliseconds.
The Architectural Realization:
Initially, I was thinking about dropping down to C or doing a Rust/C hybrid to get bare-metal speed for the low-level stuff. But I quickly realized that if my engine actually tries to run the mutated XenForo code to test it, I will never hit sub-milliseconds. Bootstrapping a massive PHP monolith, establishing local TCP connections to MySQL, and dealing with kernel context switches physically takes 10 to 50 milliseconds minimum. You simply cannot dynamically execute stateful web code faster than the speed of network sockets and standard I/O.
To beat physics and catch these "survivor" bugs instantly, I skipped C entirely. I'm going 100% bare-metal Rust and cheating standard I/O bottlenecks by analyzing the code purely in-memory as mathematical data before it hits a runtime.
The "Final Boss" Architecture:
1. Hot RAM AST Graphs:
I'm using tree-sitter natively in Rust to parse the entire XenForo dev into an Abstract Syntax Tree (AST). I am keeping that massive graph piping hot in active RAM. Zero disk reads during validation.
2. Delta Scanning:
When I inject a mutation (or when an AI generates new code), the engine does not rescan the monolith. It purely parses the code diff and dynamically patches the AST entirely in memory.
3. Deterministic Taint Tracking:
Since my survivor bugs are complex and usually involve passing bad data through multiple files (like an altered variable in a Controller quietly corrupting a DB Model later), the Rust engine traverses the memory graph to track the data flow. Because this happens strictly inside Rust's memory and the CPU's L3 cache, I can mathematically flag the payload in roughly 200–500 microseconds.
The Ultimate Benchmark:
This is how I'll know the science has fully marinated. I’m going to use that standard observability stack I mentioned earlier as my baseline control group.
I’ll let XenForo run normally with the injected bug, and let GlitchTip, Loki, and Tempo do their thing—taking 2.5 seconds to hit the network stack, gather traces, and report the crash.
Then, I'll feed that same mutation diff into my Rust engine and watch the terminal light up red, tracing the taint and rejecting the untrusted code with mathematical certainty in ~0.4 milliseconds -- before the PHP server even has time to finish booting.
Curious if anyone else here is messing around with keeping massive monolithic ASTs hot in RAM for real-time AI code validation, or if you're still relying on dynamic sandboxing?
Right now, I'm building a Deterministic Code Validation Engine for AI-Assisted Vibe Coding. To prove it works, I’m putting together a crucible experiment.
The setup is to use a local development XenForo monolith with a hell tonne of bugs. I’m making custom-made mutations and reverse-engineering them so that they survive a prolonged test. These aren't simple syntax errors; they are deep, stealthy logic flaws and state corruptions. I want to see if my scanner can spot these issues in sub-milliseconds.
The Architectural Realization:
Initially, I was thinking about dropping down to C or doing a Rust/C hybrid to get bare-metal speed for the low-level stuff. But I quickly realized that if my engine actually tries to run the mutated XenForo code to test it, I will never hit sub-milliseconds. Bootstrapping a massive PHP monolith, establishing local TCP connections to MySQL, and dealing with kernel context switches physically takes 10 to 50 milliseconds minimum. You simply cannot dynamically execute stateful web code faster than the speed of network sockets and standard I/O.
To beat physics and catch these "survivor" bugs instantly, I skipped C entirely. I'm going 100% bare-metal Rust and cheating standard I/O bottlenecks by analyzing the code purely in-memory as mathematical data before it hits a runtime.
The "Final Boss" Architecture:
1. Hot RAM AST Graphs:
I'm using tree-sitter natively in Rust to parse the entire XenForo dev into an Abstract Syntax Tree (AST). I am keeping that massive graph piping hot in active RAM. Zero disk reads during validation.
2. Delta Scanning:
When I inject a mutation (or when an AI generates new code), the engine does not rescan the monolith. It purely parses the code diff and dynamically patches the AST entirely in memory.
3. Deterministic Taint Tracking:
Since my survivor bugs are complex and usually involve passing bad data through multiple files (like an altered variable in a Controller quietly corrupting a DB Model later), the Rust engine traverses the memory graph to track the data flow. Because this happens strictly inside Rust's memory and the CPU's L3 cache, I can mathematically flag the payload in roughly 200–500 microseconds.
The Ultimate Benchmark:
This is how I'll know the science has fully marinated. I’m going to use that standard observability stack I mentioned earlier as my baseline control group.
I’ll let XenForo run normally with the injected bug, and let GlitchTip, Loki, and Tempo do their thing—taking 2.5 seconds to hit the network stack, gather traces, and report the crash.
Then, I'll feed that same mutation diff into my Rust engine and watch the terminal light up red, tracing the taint and rejecting the untrusted code with mathematical certainty in ~0.4 milliseconds -- before the PHP server even has time to finish booting.
Curious if anyone else here is messing around with keeping massive monolithic ASTs hot in RAM for real-time AI code validation, or if you're still relying on dynamic sandboxing?