# FastAPI source audit (2026-10-27)

This audit is based on the five newly supplied `server_fastapi` Python files, rather than assumptions about `ese774_frame` internals. The reviewed source snapshots are in `source_reference/server_fastapi/` in this archive; they are **not** installed or deployed by the documentation build.

## Verified structure

- `server.py` constructs a `FastApiServer` at import time, using `device_cls=DobotCtrl`, `router_cls=None`, `api_spec=None`, `object_name="dobot"`, and `device_kwargs` derived from `Config`. Calling `server.run()` is guarded by `if __name__ == "__main__"`.
- `SyncDobotClient` and `AsyncDobotClient` inherit `SyncDeviceClient` and `AsyncDeviceClient`, respectively. Their constructors pass `object_name="dobot"` and `api_spec=None` to the base class.
- `server_fastapi/__init__.py` registers `DeviceProxy` with the names `DobotCtrl` and `dobot`, defaulting to asynchronous mode. Registration is performed on import.
- `make_pyi.py` generates `client_async.pyi`, `client_sync.pyi`, and `__init__.pyi` from `DobotCtrl`, using helpers from `ese774_frame`.

## Practical limitations and configuration

- Both client constructors accept `config`, `server_ip`, and `server_port`. If `config` is supplied, its `SERVER_IP` and `SERVER_PORT` override explicit arguments. Without either, the code constructs `http://None:None`; **no working connection defaults are supplied by these constructors**.
- `SERVER_IP` configures the HTTP listener, whereas `DOBOT_IP` is passed to the robot controller. The sample default listener `127.0.0.1` is loopback-only.
- The server module does not call `Config.load_yaml()`. Configuration must be loaded before server construction in the same process, or the server module must be adapted deliberately.
- The supplied sources do not establish transport authentication, authorization, TLS, retries, response schemas, or exception mapping: these require inspection of the installed `ese774_frame` version and runtime testing. No such behavior is claimed here.
- `DeviceProxy` asynchronous mode is about the client call, **not** confirmation that a physical robot move has completed.

## Validation status

AST syntax, class inheritance declarations, constructor arguments, and registration parameters are source-verified. The current archive does not contain a runnable full `src/dobot` tree or the installed framework; Sphinx import-based autodoc, end-to-end HTTP behavior, and hardware motion are **not verified**.