Drop FastAPI, uvicorn and httpx for the stdlib

[STRML]

src/hark/ has exactly two third-party runtime imports:

• fastapi in app.py:15
• httpx in whisper.py:8

Those two, plus uvicorn, pull 24 packages and 26 MB into the venv (uv tree: pydantic, pydantic-core, starlette, anyio, httpcore, certifi, h11, click, idna, typing-extensions, and the rest). Everything else the service imports is stdlib: wave, array, re, secrets, asyncio, logging, tomllib.

For one user sending one request at a time to loopback, http.server.ThreadingHTTPServer plus roughly 20 lines of hand-rolled multipart for the whisper-server call would cover it. Async buys nothing at this concurrency.

The catch

This does not remove the need for uv. System python3 on macOS is 3.9.6 with no tomllib, and config.py:16 needs 3.11 or newer. Depending on Apple's deprecated /usr/bin/python3 would be a worse dependency than a managed interpreter, not a better one.

So the win is 24 packages to 0, not "no Python toolchain". Lower priority than #2 and #3 for that reason.

Cost

• hand-rolled multipart encoding, which is exactly the kind of thing a library gets right and a hand roll gets subtly wrong
• losing fastapi.testclient, so tests/test_app.py needs reworking against a real socket or a hand-built request object
• losing automatic 422 handling and the {"detail": ...} body shape that client/init.lua's extractDetail parses

That last one is a compatibility constraint, not just a nicety. Whatever replaces FastAPI has to keep emitting {"detail": "..."} or the client's error alerts go blank.

[drycode]

Leaving this open for discussion rather than ruling on it. Here is what I
measured, so the trade is argued from the actual surface rather than from
impressions.

What the dependencies are actually buying

FastAPI's surface here is thin. app.py imports exactly FastAPI,
HTTPException, Request. Two routes, header reads, JSON out. Notably the
inbound path is not multipart — dictate() does await request.body() on a
raw audio/wav POST, so there is no inbound parsing to hand-roll. A stdlib port
of the server itself is genuinely small.

httpx is the harder one. whisper.py posts multipart to whisper.cpp's
/inference with files= + data=. Dropping httpx means hand-rolling that
body — outbound, not inbound — plus timeouts (separate connect and read
budgets, config.CONNECT_TIMEOUT_S / TRANSCRIBE_TIMEOUT_S) and an async
client. The stdlib equivalent is blocking, so it would go through
asyncio.to_thread the way rms already does, or the whole server drops async.

Two things must be preserved exactly, and neither is enforced by a test today:

• The {"detail": ...} error body. init.lua:111-119 (extractDetail) parses
  parsed.detail and falls back to the raw body; the 401/415/400/503 alerts the
  user reads are all built from it. FastAPI produces that shape for free.
• The 415 behaviour in _authorize. The comment there is load-bearing: requiring
  a non-safelisted Content-Type is half of what forces a CORS preflight and
  defeats the drive-by POST. Any replacement has to reject on content-type
  before reading the body, and no CORS handling can creep in.

Test cost. tests/test_app.py is built on fastapi.testclient, and
tests/test_whisper.py on respx, which mocks httpx specifically. Dropping the
deps rewrites both harnesses — 78 tests currently pass, and that is the safety
net for everything above.

What it saves

.venv total                  26 MB   23 packages
  runtime closure of the 3   16 MB   fastapi starlette pydantic pydantic_core
                                     anyio idna h11 click uvicorn httpx httpcore
                                     certifi annotated_types typing_inspection
                                     annotated_doc typing_extensions
  dev only                  9.4 MB   pytest, respx, and friends

So the ceiling is ~16 MB and ~16 packages, in a venv under a launchd job.

The part worth deciding first

It does not get to zero dependencies. requires-python = ">=3.12", the system
interpreter is 3.9.6, and hark is an installed src-layout package — so uv
stays in the install path either way. Reaching "no toolchain, just run it" would
additionally mean supporting 3.9 and running from source, which is a larger
change than this issue proposes and cuts against #3, where the fix is to install
the package somewhere stable so the clone stops being load-bearing.

So the honest framing is: this is ~16 MB and a smaller supply chain, against
hand-rolled multipart, two rewritten test harnesses, and two behaviours
(detail, the 415 preflight) that currently hold because a framework guarantees
them. Not obviously wrong — it depends on how much the supply-chain reduction is
worth on a single-user localhost service.

@STRML, if you want to argue the other side: is the motivation size, audit
surface, or install friction? Install friction is the one I would take most
seriously, and it is also the one this change does not fix on its own.

[STRML]

I think we rewrite it in zig

[drycode]

Done. hark serve replaced the FastAPI service in #12, and #17 deleted src/hark/ outright.

pyproject.toml now reads dependencies = [] — FastAPI, uvicorn and httpx are gone, along with the wheel packaging. It survives only as a pytest harness that drives install-server.sh and install-client.sh as subprocesses, which is closer to what a user actually runs than the unit tests it replaced.

Before switching, the two servers were compared side by side against the same whisper backend: identical transcripts, identical status codes, and identical detail strings for 401/415/400, with the RMS silence gate intact. The error strings matching verbatim is what let the client's error mapping carry over unchanged.

Three things the port had dropped, fixed in #17 before the Python one was deleted:

• server.bind did nothing. NWListener(using: .tcp, on: port) accepts on every interface regardless of config, while the log printed the requested host — so with bind = "127.0.0.1", lsof showed TCP *:8914 and another machine got a 200.
• No wildcard guard, silently undoing Enforce the 0.0.0.0 bind guard where it runs, not only in tests #6.
• No body cap, and the body is parsed before the key is checked.

The launchd drift guard was ported rather than deleted with the Python tests. One improvement fell out: the server's plist now carries no address at all, because hark serve reads config.toml directly — uvicorn needed --host baked in, which is the two-copies-of-one-fact that guard existed to police.