Backend extraction
What AxiomCore reads, what it executes, and how to review an extracted contract.
Backend extraction converts a supported service surface into declarations that Acore can amend. The important boundary is source-specific: an extractor may parse source, load framework metadata, or import an application module. Do not assume that extraction is universally static or side-effect free.
Current inputs
| Capability | Status | Current scope |
|---|---|---|
| FastAPI | Available | Loads the selected Python module, locates the FastAPI application, and extracts routes and models. The service environment must be importable. |
| Go services | Alpha | Extracts supported route and type patterns. Review output for framework-specific constructs. |
| OpenAPI JSON | Experimental | Bootstraps bounded domain suggestions for review; it is not a complete import of every vendor extension or Acore behavior. |
| SQL DDL | Experimental | Bootstraps bounded domain suggestions from an exported schema; it does not connect to or manage a live database. |
FastAPI execution boundary
The FastAPI extractor installs import shims for some dependencies and also uses AST analysis for security evidence. It nevertheless imports and executes the selected module's top-level initialization to obtain the FastAPI instance. That means the extraction environment needs the application's relevant Python dependencies, and import-time code must not require production credentials or a live database.
Prefer an application factory or module whose import performs declaration only. Move migrations, worker startup, external connections, and destructive setup behind explicit process entry points.
from fastapi import FastAPI
app = FastAPI()
@app.get("/health")
def health() -> dict[str, str]:
return {"status": "ok"}Then initialize Acore against that module using the CLI workflow supported by your checkout:
axiom install axiom-fastapi --module
axiom init ./src/main.py:app --module axiom-fastapi
axiom build axiom.acoreReview is part of extraction
An extractor reports what it can observe; it cannot prove the business meaning of every handler. Before release:
- inspect the generated or amended endpoints and models;
- confirm authentication, permissions, validation, and error declarations;
- add policies or explicit Acore declarations where source evidence is incomplete;
- run contract tests against a controlled service or mock; and
- inspect the semantic diff against the current consumer version.