Keeping source intake private until a directory release is approved
The public directory already ran as an immutable Rust release. The next problem was accepting source changes without putting unreviewed records or a live database back on the public request path.
4 source adapters · durable review and media queues · default-off quota-bound publishing
Keep intake and serving separate
The observed public release contains immutable pages, redirects, and route outcomes. New source records enter a separate private control plane; the public server does not query that working database.
Accepted changes still have to become a complete versioned build, pass route and content validation, and activate through the same release boundary as the original migration.
Sources fail closed
Four adapters are implemented for AdultSearch, ListCrawler, OnDate, and RubMaps. Only AdultSearch is approved by default. The others remain unavailable until their configuration explicitly enables them.
- Source state and failures remain visible to the operator
- Exact cross-source duplicates are suppressed into a durable decision ledger
- Similarity scores are review hints, not automatic merges
- Review, listings, sources, queues, publishing, and settings remain private routes
Media and publishing stay bounded
Media work uses bounded fetch and validation, creates JPEG and WebP derivatives, checks B2 and Bunny delivery, and can resume its backfill after interruption.
Automatic publishing is disabled by default. When enabled, it is quota-bound and limited to fully qualified new US listings. It still cannot bypass the versioned build, validation, and activation path.
What the implementation proves
- Observed release: 51,098 pages, 409,495 route outcomes, and 321,904 redirects
- Four implemented source adapters with three disabled by default
- Durable duplicate ledger and restart-safe media queues
- Full immutable build and validation gate after acceptance
Limits: The current private control plane is not multi-tenant. · It does not implement user accounts, payments, or messaging. · Source similarity never proves two records are the same person or listing.