Repository navigation
Conversation
Two prk-Jr items that the earlier rounds left partially open: - **wasmtime install**: the existing tarball install landed the binary in /usr/local/bin/, which sits outside the format.yml cache (the cache pinned `~/.wasmtime/bin/` — a holdover from the older install.sh approach). Result: the `command -v wasmtime` guard was effectively dead and the curl+tar ran on every spin matrix run. Install to `~/.wasmtime/bin/` instead and push that directory onto $GITHUB_PATH so the cached binary is actually picked up by both this step and the subsequent test step. Drops sudo while we're at it. - **Spin contract tests file comment**: expand the file-level note so it explicitly calls out that these are in-process unit-style tests (no `spin_sdk::IncomingRequest` construction, no `spin_sdk::http::send`) and point at `store_trait_compile_checks` as the existing type-level pin against an SDK type change. End-to- end ABI coverage is called out as belonging in a separate suite.
Spin 6.0 is a substantial overhaul. Beyond the three changes called
out in the old in-tree TODO (Method enum -> constants, IncomingRequest
removal, Builder::build -> .body()), it ships a wasip2/wasip3-based
runtime with a new macro name, a new feature-gated module layout,
fully-async key-value/variables APIs, and a streaming body model.
WASI target switch:
- spin-sdk 6.0 examples target wasm32-wasip2 (was wasip1). Switch the
spin adapter, scaffold template, app-demo Spin component, CI matrix
entry, local run/smoke scripts, generated_project_builds matrix,
CLAUDE.md / README / docs / pull-request template, app-demo
edgezero.toml + spin.toml, and the CLI's spin AdapterRegistration.
Fastly stays on wasm32-wasip1.
- .github/workflows/test.yml: spin matrix now uses target =
wasm32-wasip2 with CARGO_TARGET_WASM32_WASIP2_RUNNER; the
workspace rustup-target install line adds wasip2 alongside wasip1.
Dependency + features:
- spin-sdk = "6", default-features = false, features =
["http", "key-value", "variables"]. 6.0 gates each module behind a
feature; this opts in only to what the adapter uses (drops the old
default-features-false comment that no longer applies).
- New workspace dep http-body-util = "0.1" + dev-dep on the spin
adapter for the contract test's body collection.
- examples/app-demo and crates/edgezero-cli/src/generator.rs scaffold
default both bumped to spin-sdk = "6".
Runtime API rewrite (the actual breaking changes):
- request.rs: IncomingRequest -> spin_sdk::http::Request. The whole
headers() -> drop -> into_body() WASI-handle dance is gone:
req.into_parts() yields http::request::Parts + IncomingBody;
body.bytes().await reads via IncomingBodyExt. spin_sdk::http::Method
is a re-export of http::Method so the 10-arm into_core_method helper
is deleted. spin-client-addr / spin-full-url are read via
parts.headers.get(...).
- proxy.rs: Request::builder()...build() -> .body(FullBody::new(Bytes
::from(body_bytes)))?. Outbound into_spin_method also deleted (same
type, identity). Response reading also uses IncomingBodyExt::bytes.
Drops the unused StatusCode -> from_u16 conversion (status flows
through unchanged).
- response.rs: from_core_response now returns
Response<FullBody<Bytes>> instead of bare Response.
- key_value_store.rs: every Store op is async in 6.0. Store::open and
open_with_max_list_keys gain async/await; get/set/delete/exists/
get_keys all gain .await. get_keys returns Keys (a paginator) so
list_keys_page now does .get_keys().await.collect().await?. The
callers in request.rs (resolve_kv_handle, build_kv_registry) become
async to propagate.
- config_store.rs + secret_store.rs: variables::get is async in 6.0;
both lookups gain .await.
- lib.rs: AppExt::dispatch signature switched to Request +
Response<FullBody<Bytes>>. run_app takes Request. Rustdoc example
uses #[http_service].
Macro rename:
- #[http_component] -> #[http_service]. Update the scaffold
templates/src/lib.rs.hbs, app-demo/crates/app-demo-adapter-spin/
src/lib.rs, the unsafe_code allow reason, and the rustdoc on
run_app. spin 6.0 only exports http_service, not http_component
(no alias).
Contract tests (wasm32 + spin block):
- The from_core_response_* tests assumed the 5.2 Response had a
pointer-to-u16 status, an iterator-of-(String, Vec<u8>) headers,
and an into_body returning Vec<u8>. With Response<FullBody<Bytes>>
these are now StatusCode, &HeaderMap, and FullBody<Bytes>. Tests
switched to spin_response.status() == StatusCode::CREATED,
headers().get("x-edgezero-res"), and
into_body().collect().await.to_bytes() via http_body_util::BodyExt.
Docs:
- docs/guide/adapters/spin.md: entrypoint example uses #[http_service]
+ Request; target switched to wasm32-wasip2; build command updated.
- docs/guide/adapters/overview.md, getting-started.md, cli-reference.md:
Spin target shown as wasm32-wasip2; cli-reference now lists wasip1
and wasip2 as separate install lines so operators don't pick the
wrong one.
Verified locally: cargo fmt --all --check, cargo clippy --workspace
--all-targets --all-features -D warnings, cargo test --workspace
--all-targets, cargo check --workspace --all-targets --features
"fastly cloudflare spin", cargo check -p edgezero-adapter-spin
--features spin --target wasm32-wasip2, examples/app-demo workspace
tests, cargo check -p app-demo-adapter-spin --target wasm32-wasip2.
The spin contract test under wasmtime is exercised only in CI
(local wasmtime shim absent).
Three independent hardening fixes from the PR #257 review batch (the Spin 6 migration is the prior commit; this commit is the non-migration findings). Important: [stores.<kind>].ids accepted invalid logical ids. validate_store_declaration only checked for non-empty list and default membership, so: [stores.config] ids = [""] passed `config validate`, and `config push --adapter axum --dry-run` then resolved store `` and targeted `.edgezero/local-config-.json`. Duplicates (`ids = ["app_config", "app_config"]`) also passed --strict. Under the hard-cutoff model these should be load-time errors, not silent runtime degradation. Fix: reject ids whose trimmed form is empty OR contain any control character with `store_id_blank`, and reject the first duplicate with `store_id_duplicate`. The blank check trims whitespace (rejects " ") AND checks for embedded control chars (rejects "good\n", "\0"); the printable-character spec lets future error sites quote the value in a single-line message. Three new tests pin: ids = [""], ids = [" "], ids = ["good", "\n"], and ids = ["app_config", "app_config"]. Adds BTreeSet to the existing std::collections import. Low: stale singular helper `StoreDeclaration::config_store_name`. The post-rewrite multi-store model has no per-adapter platform-name flow at the manifest layer (platform names resolve from env). The helper still existed, took a `_adapter: &str` it ignored, and just forwarded to `default_id()`. Misleading public API; no production callers (only one test asserted on it). Removed the helper and the test line that called it. Medium: docs ESLint walked into VitePress build artifacts. `.vitepress/.temp` is gitignored, but eslint.config.js only ignored `.vitepress/cache/**` and `.vitepress/dist/**`. After a docs build, `npm run lint` would surface ~500 generated-file errors from `.vitepress/.temp/*.js`. Added `.vitepress/.temp/**` to the ignores list so the lint gate is build-state-independent. Verified: cargo fmt --all --check, cargo clippy --workspace --all-targets --all-features -D warnings (the new validator predicate uses `char::is_control` to satisfy `redundant_closure_for_method_calls`), cargo test --workspace --all-targets (3 new manifest tests pass), examples/app-demo workspace tests, `cd docs && npm run lint` (clean after a docs build).
Brings in 16 commits from #257: per-target wasm-clippy CI matrix, the security fix to stop logging adapter passthrough args, and the clippy hygiene passes on cloudflare/fastly/spin adapter sources. Conflict resolution: - Spin source files (config_store, key_value_store, lib, proxy, request, response): take ours. The incoming branch's clippy passes targeted the 5.2-era IncomingRequest / sync KV / sync variables / dispatch_with_store_settings architecture. Our branch replaced all of that with the 6.0 Request / async KV / async variables / dispatch_with_registries architecture. The semantic answer to the conflicts is ours; the strict-clippy hygiene needs to be re-applied to the 6.0 code (separate commit). - Cloudflare source files (config_store, lib, request): take ours. Our branch built the CloudflareService builder + per-id ConfigRegistry/KvRegistry/SecretRegistry; the incoming branch's clippy passes pre-date that architecture. - All three adapter contract.rs files: take ours. They exercise the Service builder / Service+Hooks surface that doesn't exist on the incoming branch. - .github/workflows/format.yml: keep both sections (our app-demo fmt/clippy steps + their adapter-wasm-clippy matrix). Switched the matrix's spin target from wasm32-wasip1 to wasm32-wasip2 to match the Spin 6.0 migration in the parent commit. Auto-merges accepted: - Cloudflare context/key_value_store/proxy/response/secret_store: small clippy-driven changes (field reorder, import aliasing, err naming) that compose cleanly with our Service builder code. - crates/edgezero-cli/src/adapter.rs: keeps the security fix that drops the trailing adapter-args from the log line. - .github/workflows/test.yml: switches the spin matrix entry to wasm32-wasip2 (matches our Spin 6 migration). Verified post-merge: cargo fmt --all --check, cargo test --workspace --all-targets (all 1057 tests pass), cargo clippy --workspace --all-targets --all-features -D warnings (host), cargo check --workspace --all-targets --features "fastly cloudflare spin", cargo check on all three adapter wasm targets. Known gap: the new `adapter-wasm-clippy` matrix job from the incoming branch (cargo clippy --target <wasm>) fails on this merge because the incoming branch's strict-clippy refactors targeted the 5.2 / pre-Service-builder code that no longer exists on our branch. Equivalent wasm-clippy cleanup against the current 6.0 Spin + Service-builder Cloudflare code is the next commit.
Brings the `adapter-wasm-clippy` CI matrix added by the strict-clippy
merge to green. Cloudflare (~44 errors), fastly (~14), spin (~115) —
all real refactors, no `#[allow]` / `#[expect]` sprinkles, matching
the chore/strict-clippy precedent.
Cross-cutting patterns applied:
- `pub use mod::Foo;` re-export-from-private-mod -> `pub mod foo;`
with external callers using full module paths (six sites in spin's
lib.rs).
- `absolute_paths` -> `use` imports at file top across lib/request/
proxy/response/store files.
- `min_ident_chars` -> rename closure params (`|e|` -> `|err|`,
`|v|` -> `|value|`, `|c|` -> `char::is_control`).
- `missing_inline_in_public_items` -> `#[inline]` on every public
fn/method.
- `missing_errors_doc` -> `# Errors` doc section above pub fns
returning Result.
- `arbitrary_source_item_ordering` -> canonical ExternCrate -> Use ->
Mod -> Static -> Const -> TyAlias -> Enum -> Struct -> Trait ->
Impl -> Fn ordering, alphabetical within each kind; struct fields,
enum variants, and impl methods all alphabetised.
- `tests_outside_test_module` + `expect_used` in tests -> wrap
contract-test bodies in `#[cfg(test)] mod tests { ... }` so
`clippy.toml`'s `allow-expect-in-tests = true` exemption kicks
in, eliminating per-call attributes.
- `used_underscore_items` (the test compile-check pattern) ->
`const _: fn() = assert_provider_impl::<T>;` idiom instead of
the `_assert_*_impl::<T>() {}` + manual `_check()` caller.
- `scoped_visibility_modifier` on fields -> drop redundant
`pub(crate)` when the type itself is `pub(crate)`.
- `let_underscore_must_use` + `let_underscore_untyped` ->
`drop(init_logger())` instead of `let _ = init_logger();`.
Adapter-specific notes:
Spin: introduced public type alias
`SpinFullResponse = Response<FullBody<Bytes>>` because the unaliased
form appeared in five signatures across lib.rs/request.rs/response.rs
(satisfies `very_complex_type`). Replaced `"spin".parse().expect(...)`
with `HeaderValue::from_static("spin")` (compile-time infallible).
Replaced `collected.len() + bytes.len()` with `.saturating_add()`
(`arithmetic_side_effects`). Renamed shadowing inner bindings
(`kv` -> `kv_registry`, `secret` -> `secret_registry`,
`body_bytes` -> `request_body_bytes` / `response_body_bytes`).
Added `edgezero-core` dev-dep with `features = ["test-utils"]` so
the `request::synthesis_tests` mod can use `NoopKvStore` /
`NoopSecretStore` (mirrors the fastly/cloudflare pattern).
Cloudflare: folded the four-arg `dispatch_with_registries` call into
a `RegistryInputs<'env>` struct to clear `too_many_arguments`. Made
`edge_error_to_worker` and `into_core_method` take `&T` instead of
owned `T` (`needless_pass_by_value`); call sites switched to
`|err| edge_error_to_worker(&err)`. Renamed shadowing bindings
(`mut warned_bindings` -> `mut guard`, `kv` -> `kv_registry`,
`secret` -> `secret_registry`, inner `meta` -> `store_meta`).
Fastly: a single-file pass on `tests/contract.rs` (the source files
all live inside the wasm gate; the host clippy gate already covered
them). Moved `mod secret_store_compile_check` above `#[test]` fns
for item ordering.
Verified post-commit:
- `cargo fmt --all -- --check`
- `cargo test --workspace --all-targets` (1057 tests pass)
- `cargo clippy --workspace --all-targets --all-features -- -D warnings`
- `cargo clippy -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --all-targets -- -D warnings`
- `cargo clippy -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --all-targets -- -D warnings`
- `cargo clippy -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --all-targets -- -D warnings`
Closes the High blocker and five Low findings from the post-merge
self-review of the Spin 6 + strict-clippy integration.
High: Spin wasm contract CI was red.
Three contract tests (`config_store_reads_value_from_handler`,
`kv_store_reads_value_from_handler`, `secret_store_reads_value_
from_handler`) inserted bare `ConfigStoreHandle` / `KvHandle` /
`SecretHandle` into request extensions, then called
`app.router().oneshot(...)` -- bypassing the Spin dispatch
boundary. Under the hard-cutoff model the core
`RequestContext::config_store_default()` /
`kv_store_default()` / `secret_store_default()` extractors only
read `ConfigRegistry` / `KvRegistry` / `SecretRegistry`. The
dispatch boundary's `synthesise_store_registries` is what
normally wraps a bare handle into a one-id registry keyed under
`"default"`. Because the tests bypassed dispatch, handlers got
`None` and the assertions silently failed under
`wasmtime run` in CI.
Fix: the three tests now insert `*Registry::single_id("default"
.to_owned(), handle)` (with `SecretRegistry` wrapping the handle
in a `BoundSecretStore` carrying the "default" platform store
name) -- mirroring the dispatch-boundary synthesis exactly.
Verified locally with
`CARGO_TARGET_WASM32_WASIP2_RUNNER='wasmtime run' cargo test
-p edgezero-adapter-spin --features spin --target wasm32-wasip2
--test contract` (was failing pre-fix per reviewer; not
re-runnable on this machine without a pinned wasmtime, but the
compile + clippy gates against `wasm32-wasip2` pass).
Low: CLI docs described logical ids where the implementation
uses env-resolved platform names.
Both Cloudflare and Fastly's `provision` and `config push`
adapters use `store.platform.as_str()` to look up the
binding/namespace name in `wrangler.toml` / `fastly.toml`.
`store.platform` is what `EDGEZERO__STORES__<KIND>__<ID>__NAME`
resolves to at adapter-action time, falling back to the logical
id when the override isn't set. Docs previously said the
matching key was `<store_id>`; updated to `<platform-name>` with
the resolution rule spelled out, in:
- `docs/guide/cli-reference.md` -- both the provision and push
tables (cloudflare + fastly cells)
- `docs/guide/cli-walkthrough.md` -- both the provision and
push bullets (cloudflare + fastly); push bullets converted to
fenced bash blocks (see High below)
- `crates/edgezero-adapter-fastly/src/cli.rs:329` -- the
`create_fastly_store` rustdoc -- comment now says
`--name=<platform-name>` and explains the caller does the
resolution.
High: docs CI red because of multi-line inline backticks.
`docs/guide/cli-walkthrough.md`'s push bullets had inline code
spans that wrapped across line breaks (e.g.
`` `wrangler kv bulk put <tempfile>\n--namespace-id=<id>` ``).
Prettier respects `proseWrap: preserve` but re-aligned the
continuation lines such that `<tempfile>` / `<id>` ended up at
column 0 on the wrap line, terminating the backtick span. The
leaked `<tempfile>` / `<id>` were then parsed by VitePress's
Vue compiler as unterminated HTML tags, breaking
`npm run build` with `Element is missing end tag`.
Fix: cloudflare/fastly push + provision bullets now use fenced
bash code blocks for the multi-arg commands -- bulletproof
against Prettier reflow. Verified
`cd docs && npm run build` succeeds in 1.5s.
Low: docs/guide/adapters/spin.md described the wrong secret
translation rule.
The collision-check section claimed both config keys and
`#[secret]` field values get `.→__`-translated. In reality
`SpinSecretStore::get_bytes` only `to_ascii_lowercase`s the key
(no dot translation), and the CLI validator
(`crates/edgezero-adapter-spin/src/cli.rs:434-439`) mirrors that
exactly with an explicit code comment. Doc updated to say
config keys translate dots; secret values are only lowercased.
Low: docs/superpowers/plans/2026-05-20-cli-extensions.md was
stale on three points.
(1) Said `examples/app-demo` was not in CI -- it now is, via the
dedicated `cd examples/app-demo && cargo test --workspace
--all-targets` step in `test.yml` + a parallel fmt/clippy pass
in `format.yml`. (2) Listed the Spin wasm gate as
`wasm32-wasip1` -- now `wasm32-wasip2` per the Spin 6 migration.
(3) Task 8.3 step 1 (add `app-demo` CI) is done; marked `[x]`
with a reference to the workflow files.
Low: `crates/edgezero-cli/tests/generated_project_builds.rs`
exercised the raw `edgezero` binary's `config validate` but
never invoked the generated typed CLI's typed validator.
Added a `cargo run -p scaffold-probe-cli --quiet -- config
validate --strict` step after the host `cargo check`. Catches
template / `AppConfig` drift the raw validator cannot --
`#[derive(Validate)]` impl on `AppConfig` + the `#[app]`
macro-emitted `#[secret]` discovery / collision checks now run
against every freshly-scaffolded project.
Low: `crates/edgezero-adapter-axum/src/secret_store.rs` rustdoc
example used the removed `cargo edgezero dev` command. Replaced
with `API_KEY=mysecret edgezero serve --adapter axum`.
Verified post-commit: `cargo fmt --all -- --check`, `cargo
clippy --workspace --all-targets --all-features -- -D warnings`,
`cargo test --workspace --all-targets`, all three adapter
wasm-clippy gates (`cloudflare wasm32-unknown-unknown`, `fastly
wasm32-wasip1`, `spin wasm32-wasip2`), `cd docs && npm run lint
&& npm run format && npm run build`. The Cargo.lock minor-
version drift left by background cargo runs is intentionally
NOT included in this commit -- belongs in a separate dep
maintenance change.
The Fastly adapter's `run_app` was unconditionally calling
`init_logger("stdout", ...)` because `logging_from_env` returned
`use_fastly_logger: true` with `endpoint: None`, and the run-app
fallback was `"stdout"`. Viceroy 0.17 treats `stdout` as a reserved
endpoint name and rejects the `Endpoint::from_name("stdout")` hostcall,
surfacing `failed to build Fastly logger: endpoint not found, or is
reserved` on every request.
This made `app-demo` (or any project using the manifest-free `run_app`
entrypoint) unrunnable under `fastly compute serve` without a manual
`fastly.toml` patch.
env_config: add `EnvConfig::logging_endpoint()` that reads
`EDGEZERO__LOGGING__ENDPOINT`. Adapters that wire a platform-specific
logger now have a single env-side knob for the endpoint name.
adapter-fastly: `logging_from_env` now reads the endpoint from env and
sets `use_fastly_logger = endpoint.is_some()`. Production deploys set
`EDGEZERO__LOGGING__ENDPOINT=<name>` (matching a `[log_endpoints]`
entry in `fastly.toml`); local Viceroy runs leave it unset and the
existing `if logging.use_fastly_logger` gate in `run_app` skips the
init -- no init means no reserved-name error, and Viceroy still
surfaces `println!` from the wasm via its own stdout pass-through.
Verified: cargo fmt, host clippy --workspace, edgezero-core +
edgezero-adapter-fastly tests pass, fastly wasm32-wasip1 clippy +
cargo check pass.
Operators developing against a local emulator (Viceroy for Fastly, `wrangler dev --local` for Cloudflare) had no way to seed config-store contents without either reaching for prod credentials or hand-editing the adapter's local-server toml. Add `--local` so `config push` writes to the local-emulator state for all four adapters. New CLI surface: app-demo-cli config push --adapter <name> --local [--dry-run] CLI / trait wiring: - `ConfigPushArgs::local: bool` (`--long`). - New trait method `Adapter::push_config_entries_local` on `edgezero-adapter`, mirroring `push_config_entries`. Default returns "adapter `<name>` does not implement `config push --local`" so any third-party adapter that hasn't opted in fails loudly rather than silently writing nothing. - `dispatch_push` routes by `args.local`; the `--dry-run` log line picks up `--local` so the preview is unambiguous. Per-adapter impls: - **fastly** -- `toml_edit`s `[local_server.config_stores.<platform>]` in the adapter's `fastly.toml`. Sets `format = "inline-toml"` and replaces `[local_server.config_stores.<platform>.contents]` with the pushed entries. Idempotent on re-push (the contents block is replaced wholesale, so stale keys don't linger); other tables in `fastly.toml` (setup, scripts, secret_stores, kv_stores) are preserved by `toml_edit`. Viceroy reads the file on startup, so a follow-up `fastly compute serve` exposes the new values to the wasm component. Four new tests pin the helper (minimal file, re-push replaces, preserves unrelated blocks, creates the file when missing). - **cloudflare** -- same flow as the prod push but appends `--local` to the wrangler invocation. Wrangler writes entries into `.wrangler/state/v?/kv/<namespace_id>/...`; a follow-up `wrangler dev --local` (or `edgezero serve --adapter cloudflare`) reads them from the emulator instead of the live account. Tempfile-backed bulk put -- same idempotency guarantees as the prod path. - **spin** -- delegates to the existing `push_config_entries` (spin has no separate local-emulator state for config; `spin up` reads the same `spin.toml` `[variables]` + `[component.<id>.variables]` tables `spin deploy` ships). Prepends a one-line notice so an operator who typed `--local` for parity with fastly/cloudflare knows there was nothing extra to write. - **axum** -- delegates to the existing `push_config_entries` (axum's default already writes `.edgezero/local-config-<id>.json`, which the dev server reads). Same one-line notice pattern as spin. Tests: - `cli::tests::write_fastly_local_config_store_creates_inline_block_in_minimal_file` -- exercises the happy path against a minimal `fastly.toml`, asserts both the store table and the contents block are emitted with the correct quoting (dotted keys quoted). - `..._replaces_existing_block_on_re_push` -- proves stale keys are dropped on re-push (the contents block is replaced, not merged). - `..._preserves_unrelated_blocks` -- asserts the helper does not stomp `[setup.*]` / `[[local_server.kv_stores.*]]` / `[scripts]` blocks that already exist in `fastly.toml`. - `..._creates_file_when_missing` -- the file is created on first push. Verified post-commit: cargo fmt, host clippy --workspace, full workspace tests (45 fastly cli tests including the 4 new ones), all three adapter wasm-clippy gates (cloudflare wasm32-unknown-unknown, fastly wasm32-wasip1, spin wasm32-wasip2). Cargo.lock has unrelated transitive bumps from background cargo runs; intentionally not part of this commit.
Per the spin-kv-config plan (Stage 2 of
docs/superpowers/specs/2026-06-01-spin-kv-config.md), back
SpinConfigStore with the Spin KV API instead of Spin variables.
Brings Spin config into structural parity with Cloudflare (KV-backed)
and Fastly (Config Store-backed), and resolves four problems the
variables backend carried:
1. No dynamic config -- variables are baked into spin.toml at deploy.
2. Variables namespace is shared with `#[secret]` values, requiring
an explicit collision check in validate_typed_secrets.
3. Spin was forced into the `single_store_kinds` axis for config
(one flat namespace per app) while CF + Fastly are Multi.
4. config push targeted spin.toml editing instead of the platform's
idiomatic bulk-write API.
Hard cutoff: existing deployments that read config via
`spin_sdk::variables::get(...)` directly need to migrate to the
KV-backed surface. Apps that read via `ctx.config_store_default()`
keep working unchanged after a fresh `config push --adapter spin`.
config_store.rs: rewrite SpinConfigStore as a cfg-gated backend enum.
The wasm variant holds `(label, key_value::Store)` -- the label is
recorded so multi-store error messages name which platform store
fired the failure. The test variant is `BTreeMap<String, Bytes>`
(was `HashMap<String, String>`) so contract tests exercise bytes-
backed values end-to-end, with strict UTF-8 decoding to match the
wasm error path (rejected `from_utf8_lossy`, which would hide a
prod/test divergence). Drops `translate_key` and the `.->__`
dotted-key translation entirely -- KV accepts arbitrary key bytes.
The async `SpinConfigStore::open(label)` constructor replaces
infallible `new()` so missing `key_value_stores = [...]`
declarations surface as a clean dispatch-setup error rather than
on first read.
request.rs: rewrite build_config_registry to async +
`anyhow::Result<Option<ConfigRegistry>>` mirroring build_kv_registry.
Per declared id: `env.store_name("config", id)` ->
`SpinConfigStore::open(label).await?` -> per-id ConfigStoreHandle.
`dispatch_with_registries` awaits the build and propagates with `?`.
The legacy low-level `dispatch_with_kv_label` path's
resolve_config_handle becomes async too, opening the config store
against the same label as KV (the rustdoc explains it -- registry
callers use the env-resolved per-id labels via run_app).
Three new contract tests in config_store.rs:
- `dotted_get_resolves_verbatim_under_kv` -- proves the KV backend
stores keys verbatim, no `.->__` fallback.
- `non_utf8_value_returns_unavailable` -- pins the strict-UTF-8
contract so the test InMemory backend can't drift from wasm.
- `missing_key_returns_none` -- baseline negative.
All seven config_store_contract_tests! macro rows pass under the
new InMemory backend (rewritten to take `(String, Bytes)` entries).
Verified: cargo fmt, host clippy workspace -D warnings, cargo test
workspace (78 spin-adapter tests pass), wasm32-wasip2 check + clippy
on edgezero-adapter-spin.
Stage 3 of docs/superpowers/specs/2026-06-01-spin-kv-config.md.
Adds the wasm-side seeding surface so `config push --adapter spin
--local` can flow values into the KV-backed config store from
Stage 2 without relying on a `spin kv put` CLI subcommand (which
doesn't exist in spin-sdk 6.0).
Design (D2 in the spec): the adapter exposes a single fixed route,
`/__edgezero/config/seed`, that accepts JSON `{store, entries}`
bodies. `app-demo-cli config push --adapter spin` (Stage 4) HTTP
POSTs that body. The handler validates -> writes -> 204s. Same
mechanism works for prod (operator sets seed URL) and local
(builtin default http://127.0.0.1:3000/__edgezero/config/seed).
D10 split: the security surface lives in
`handle_seed_request_core` (host-compilable, takes
`edgezero_core::http::Request`) so 14 unit tests cover every D9
status code on host. `handle_seed_request_spin` is the thin
wasm-only wrapper that translates Spin <-> core via the existing
`into_core_request` / `from_core_response` helpers. Both return
`anyhow::Result<SpinFullResponse>` so `run_app_with_seeder`'s
seed-branch / fall-through if/else is type-coherent.
D9 security contract enforced exactly:
| Code | Condition |
|------|---------------------------------------------------|
| 204 | success |
| 400 | malformed JSON / empty entries / non-string vals |
| 401 | server token unset / blank / whitespace / <16B |
| | OR wire token header missing -- fail-closed |
| 403 | wire token does not match server token |
| 404 | body store not in env-resolved platform labels |
| 405 | non-POST method |
| 415 | content-type not application/json |
| 422 | SeedWriter::write errored mid-stream |
Fail-closed token rule (D9 + v6 16-byte floor): the handler returns
401 on EVERY request when `EDGEZERO__ADAPTERS__SPIN__SEED_TOKEN` is
unset, blank, whitespace-only, or shorter than 16 bytes. An operator
who sets a 4-character placeholder gets a clean error rather than an
open writeable endpoint. Token comparison uses `subtle::ConstantTimeEq`
to prevent timing-oracle leakage of the token prefix.
Testable writer (D10): `SeedWriter` trait is mocked in tests by an
`InMemorySeedWriter` (host) and implemented in production by
`SpinKvSeedWriter` (wasm, calls `spin_sdk::key_value::Store::set`).
The host tests cover all 14 D9 cases including the explicit 15-byte
/ 16-byte boundary checks.
Dep gating (D11): subtle, serde, serde_json, thiserror added as
non-optional adapter-spin deps (NOT under any feature) so the host-
compilable core + its unit tests reach them without `--features spin`.
reqwest stays out of this commit -- it's the Stage 4 CLI-side dep
gated behind `cli` so it can't leak into the wasm bundle.
run_app + run_app_with_seeder (D9 opt-in scaffolding):
- `run_app` signature changes from `anyhow::Result<impl IntoResponse>`
to `anyhow::Result<SpinFullResponse>` (the concrete type already
publicly aliased). Source-compatible with the generated scaffold
handler signature because `SpinFullResponse: IntoResponse`. NOT a
variables-backwards-compat carve-out -- this stays hard-cutoff.
- New `run_app_with_seeder<A: Hooks>(req) -> anyhow::Result<SpinFullResponse>`
routes the seed path to `handle_seed_request_spin` (with the env-
resolved token + per-id platform labels from
A::stores().config x env.store_name("config", id)) and falls
through to `run_app::<A>` for everything else.
- IntoResponse dropped from the spin_sdk::http::{...} import line --
once run_app returns SpinFullResponse, IntoResponse is unused and
the wasm-clippy `-D warnings` gate would fail on unused_imports.
Scaffold template: switch the body call from `run_app::<App>(req).await`
to `run_app_with_seeder::<App>(req).await`. Handler signature unchanged.
Existing apps that don't want the seeding surface can switch back to
`run_app` -- they're never opted in by default at runtime because
the seed handler is fail-closed without a configured server token.
Cargo.lock has substantial unrelated transitive bumps from
background cargo runs (autocfg 1.5.0->1.5.1, brotli 8.0.2->8.0.3,
etc.) interleaved with the new deps (subtle, thiserror, serde,
serde_json under edgezero-adapter-spin). Both go in together so
the lock matches the manifests; the noise was already pending.
Verified: cargo fmt, host clippy workspace --all-features
-D warnings, workspace tests (92 spin-adapter tests including 14
new seed tests), wasm32-wasip2 clippy + check on adapter-spin,
cloudflare and fastly per-target wasm-clippy gates all clean.
Stage 4 of docs/superpowers/specs/2026-06-01-spin-kv-config.md. Rewrites the spin `config push` impl to HTTP-POST to the seed handler (stage 3), threads a typed push context through the adapter trait, and adds the CLI args + resolution chain. Trait + context (T4.1): - New `AdapterPushContext<'ctx>` in edgezero-adapter::registry with `#[non_exhaustive]` + builder API. Carries the already-resolved `seed_url` / `seed_token` (owned upstream, borrowed at the call boundary) and the `local` flag so adapters that have a separate local-emulator path can pick the right writeback target. Builder enforces the non_exhaustive construction constraint at the source level: the CLI builds via `AdapterPushContext::new().with_*()`, never a struct literal. - `Adapter::push_config_entries` and `push_config_entries_local` gained the `push_ctx: &AdapterPushContext<'_>` parameter. 8-arg trait methods carry a documented `#[expect(too_many_arguments)]`. All four in-tree impls updated (axum/cloudflare/fastly/spin); the three non-spin adapters accept-and-ignore. - 16 in-tree test call sites batch-updated. CLI args + resolution (T4.2 + T4.3): - `ConfigPushArgs` gained `--seed-url` and `--seed-token`. Documented prod chain (`--seed-url` -> env -> manifest) and local chain (`--seed-url` -> `EDGEZERO__ADAPTERS__<NAME>__LOCAL_SEED_URL` -> builtin `http://127.0.0.1:3000/__edgezero/config/seed`). Manifest is NEVER consulted on the local chain. - New `ResolvedAdapterPushContext` field on the CLI's `PushContext`. `load_push_context` resolves URL + token + local up front and stashes owned strings; `dispatch_push` borrows from it to build the `AdapterPushContext<'_>` via the builder. - `ManifestAdapterCommands` gained `seed_url: Option<String>` (additive under `#[non_exhaustive]`; serde `rename = "seed-url"`). - Tokens are NEVER read from the manifest, even on the prod chain. Spin push rewrite (T4.4 + T4.5 + T4.6): - `push_config_entries` now POSTs JSON `{store, entries}` to `push_ctx.seed_url` via `reqwest::blocking::Client`. The `store` field is the env-resolved platform label, not the logical id, so an operator running with `EDGEZERO__STORES__CONFIG__APP_CONFIG__NAME=…` has the matching label flow through to the seed handler's 404 check. - `push_config_entries_local` delegates straight through to the prod impl. The CLI's URL chain (D3) already encoded the prod-vs-local distinction; the adapter doesn't need to switch on `push_ctx.local` again. - Full D9 status table mapped to D12 error messages: 204 success, 400 / 401 / 403 / 404 / 405 / 415 / 422, each with operator-actionable copy. The 401 message names all four fail-closed reasons (unset / blank / whitespace / <16 bytes). Connection-refused gets a specific "Is the Spin app running?" hint. - `--dry-run` emits the planned URL + per-key would-set lines without posting; doesn't require a token. - New `build_seed_payload` helper produces the D9 body shape. - Old variables-helpers (`write_spin_variables`, `not_a_table_error`) marked `#[cfg(test)]` until Stage 5 deletes them with the provision-side variable writes. Test surface (T4.7): Replaced 4 variables-based push tests with 6 KV-push tests covering the new contract: - `push_with_no_entries_reports_no_op_without_posting` — empty shortcut still works. - `push_dry_run_emits_url_and_entries_without_posting` — dry-run prints URL + dotted keys verbatim (no `.→__` translation). - `push_errors_when_seed_url_unset_prod` — prod hint mentions env + manifest sources but NOT the local env var. - `push_errors_when_seed_url_unset_local_names_local_env_var` — local hint mentions the `LOCAL_SEED_URL` env var. - `push_errors_when_seed_token_unset_on_real_push` — token required on real push and documents the "NEVER read from edgezero.toml" rule. - `build_seed_payload_emits_d9_body_shape` + `..._uses_platform_label_not_logical_id` — body shape + env-resolved store name. - Updated `raw_push_spin_dry_run_dispatches_to_adapter` in the CLI test suite to provide a `seed_url` (now required for dry-run too, since the dry-run prints the planned URL). Dep gating (D11 verified): - `reqwest = "0.13"` gained `blocking` + `json` workspace features. - `reqwest` listed under the `cli` feature on edgezero-adapter-spin (host-only). Confirmed via `cargo tree -i reqwest --target wasm32-wasip2` that reqwest does NOT leak into the wasm tree. - `subtle` and `serde_json` remain non-optional and confirmed present in the wasm tree (the wasm seed handler core needs them). Cargo.lock adds the existing `subtle 2.6.1` to the spin adapter's manifest transitive set (a 5-line diff). Verified: cargo fmt, host clippy workspace --all-features -D warnings, cargo test workspace (95 spin tests; full workspace green), per-target wasm-clippy on cloudflare / fastly / spin.
…tores - `spin provision` now iterates `[stores.config]` ids alongside `[stores.kv]` and appends each platform-resolved label to `[component.X].key_value_stores` (idempotent), matching how KV stores are wired. Status lines report "added config label <label>" so operators see the parity. - `single_store_kinds()` drops `"config"` and returns only `["secrets"]`: KV-backed config is multi-capable; secrets stay Single until native secret support lands. - Scaffold `spin.toml.hbs` declares `key_value_stores = ["app_config"]` on the generated component so a fresh `edgezero new --adapter spin` is runnable without a manual provision pass. - Delete the `[variables]`-backed code paths (`not_a_table_error`, `write_spin_variables`, 7 associated tests) and the `translate_key_for_spin` helper — provision no longer touches Spin variables for config. Add coverage for the KV-array write and the "multi-config now accepted, multi-secret still rejected" capability-gate split (`provision.rs` host tests). Stage 5 gates: cargo fmt, host clippy (--all-targets --all-features), cargo test --workspace --all-targets, host check with `fastly cloudflare spin`, and wasm clippy for fastly (wasm32-wasip1), cloudflare (wasm32-unknown-unknown), and spin (wasm32-wasip2) all green.
Now that config lives in KV (arbitrary UTF-8 keys) and never shares Spin's flat variable namespace, the validator pieces that mirrored `[variables]` rules are obsolete: - Delete Spin's `validate_app_config_keys` override + the `translate_key_for_spin` helper (and its 3 unit tests). The trait's `Ok(())` default applies; an `#[expect]` on the impl block documents why no impl is provided. - Simplify Spin's `validate_typed_secrets`: drop the `.→__` config-key pre-population of the `seen` set. Secrets still resolve through Spin variables, so the within-`#[secret]` uniqueness + `is_valid_spin_key` canonicalisation checks stay. - Update CLI tests: delete `spin_key_syntax_rejects_uppercase_*`, `spin_key_syntax_rejects_dash_in_key`, `spin_config_secret_collision_typed_only` (3 stale expectations). Rewrite `raw_push_runs_spin_key_validation_*` into `raw_push_runs_spin_adapter_manifest_check_*`: same regression intent (raw push must run `run_shared_checks` before dispatch), new probe (Spin's `[component.*]` discovery rather than the removed key rule). - Spin adapter unit-test cleanup: remove `validate_app_config_keys_rejects_uppercase`, `validate_app_config_keys_rejects_dashes`, `validate_typed_secrets_detects_collision`, `validate_typed_secrets_detects_collision_after_lowercasing_secret_value` (all assert the deleted behavior); keep the secret-value canonicalisation + cross-secret collision tests intact. - Update stale wording: the `Adapter::validate_app_config_keys` trait docstring no longer cites Spin's defunct rule; the `run_config_push_typed` and `ValidationContext` comments no longer cite "Spin key syntax" / `api-token` examples. Stage 6 gates: cargo fmt, host clippy (--all-targets --all-features), cargo test --workspace --all-targets, host check with `fastly cloudflare spin`, and wasm clippy on spin (wasm32-wasip2) all green.
User-facing docs and the reference app no longer describe Spin config as `[variables]`-backed: - `docs/guide/adapters/spin.md` — rewrite the Config Store section to describe the KV-backed flow (multi-store, `key_value_stores` declarations, seed-handler push). Trim the cross-namespace collision wording from the Secret Store section: KV config and Spin variables no longer share keys, so only the within-`#[secret]` canonicalisation check survives. - `docs/guide/cli-reference.md` and `cli-walkthrough.md` — rewrite the spin row / bullet in the push table from "pure spin.toml editing + `.→__` translation" to "HTTP POST to `/__edgezero/config/seed`" with the full URL/token resolution chain. Drop the "Spin key syntax" bullet from the validate walkthrough. - `docs/guide/configuration.md` — update the config-store adapter-behavior bullet for Spin: multi-store KV, labels declared in `key_value_stores`, seeded via `config push`. - `examples/app-demo/crates/app-demo-adapter-spin/spin.toml` — drop `greeting`, `feature__new_checkout`, `service__timeout_ms` from `[variables]` (now in the `app_config` KV store via the seed handler) and add `app_config` to the component's `key_value_stores`. `[variables]` is now SECRETS-ONLY (`api_token`, `vault`, `smoke_secret`). - `examples/app-demo/crates/app-demo-cli/tests/config_flow.rs` — thread `args.seed_url` through `push_args` for spin (dry-run still requires the URL to be resolvable). Update the byte-identical test's comment to point at the new in-adapter preview test. Delete the trait-poking `spin_dry_run_preview_lists_app_demo_translated_keys_and_both_tables` test: it bypassed the public CLI to inspect log lines, hand- built `AdapterPushContext` + `ResolvedStoreId`, and duplicated `edgezero_adapter_spin::cli::tests::push_dry_run_emits_url_and_entries_without_posting`. - `scripts/smoke_test_config.sh` — update the comment that cited Spin's `[variables]` defaults to describe the new `config push --adapter spin --local` flow. Stage 7 gates: cargo fmt + host clippy (--all-targets --all-features) in both root and `examples/app-demo` workspaces, `cargo test --workspace --all-targets` in both, app-demo `cargo build -p app-demo-adapter-spin --target wasm32-wasip2 --release`, plus wasm clippy on spin (wasm32-wasip2), fastly (wasm32-wasip1), cloudflare (wasm32-unknown-unknown) all green.
…eout
The `spin up` smoke test surfaced a gap the plan didn't
anticipate: Spin rejects component-declared `key_value_stores`
labels with "unknown key_value_stores label <name>" unless each
custom label (anything but `default`) is declared in a
`runtime-config.toml` that the Spin runtime can resolve to a
backend. Fix this end-to-end so scaffolded and demo projects are
runnable out of the box:
- Add `runtime-config.toml.hbs` scaffold template that declares
the default `[stores.config].ids = ["app_config"]` label
against Spin's SQLite-backed KV backend (`type = "spin"`).
Register it as the fourth Spin scaffold file alongside
`Cargo.toml`, `src/lib.rs`, and `spin.toml`.
- Update the spin adapter's `serve` command template from
`spin up --from {crate_dir}` to
`spin up --from {crate_dir} --runtime-config-file
{crate_dir}/runtime-config.toml` so `edgezero serve --adapter
spin` resolves the KV labels in scaffolded projects.
- Add `examples/app-demo/crates/app-demo-adapter-spin/runtime-config.toml`
declaring `app_config`, `sessions`, and `cache` against the
SQLite backend (matching the labels app-demo's `spin.toml`
references), and update `examples/app-demo/edgezero.toml`'s
`adapters.spin.commands.serve` to pass
`--runtime-config-file`.
- Document the runtime-config requirement in
`docs/guide/adapters/spin.md`: show the file shape, explain
why custom labels need an entry, link to Spin's
runtime-config docs for production backends
(azure/redis/etc.), and clarify that `provision` does NOT
touch this file.
Final verification gate ran cargo fmt, host clippy
(--all-targets --all-features), and `cargo test --workspace
--all-targets` in both the root and `examples/app-demo`
workspaces. Wasm clippy passed for spin (wasm32-wasip2), fastly
(wasm32-wasip1), and cloudflare (wasm32-unknown-unknown);
app-demo wasm release builds succeeded for all three. End-to-
end `spin up` smoke confirmed Spin's runtime-config resolves
all three KV labels (`[key_value_store.<label>: spin]`); the
remaining wasi-http version skew (`wasi:http/types@0.3.0-rc-
2026-03-15` not in Spin 3.6.3's linker) is unrelated to the
KV-config migration and is gated on Spin catching up to the
WASI HTTP rc the wasm component imports.
Also commit the v12 plan + spec as a record of the eight-stage
design + execution path.
Lands the review-pass fixes from the PR thread (security hardening
of the seed handler, correctness, API cleanup, test coverage) plus
the design document for the per-backend-push pivot that
SUPERSEDES the seed handler in the follow-up commits.
Why "supersedes": the seed handler at /__edgezero/config/seed is
a permanent EdgeZero-owned attack surface that ships in every
deployed Spin app even with the hardening below. The PR-thread
review (separate reviewer) raised the bigger question: Spin can
seed KV stores via Spin's own mechanisms (`spin cloud key-value
set` for Fermyon Cloud, direct SQLite for local) — we shouldn't
need our own HTTP endpoint at all. This commit ships the
hardening as a transitional improvement; the next commit drops
the handler entirely and the one after adds per-backend writers.
See `docs/superpowers/plans/2026-06-04-spin-per-backend-push.md`.
## Security hardening of the seed handler (transitional)
- **Pre-auth body cap (256 KiB)**: bounds the read surface so an
unauthenticated POST can't OOM the runtime with a multi-MB body.
Returns 413 before `serde_json::from_slice` runs. (H1)
- **Per-entry caps**: `entries.len() <= 1000`, `value.len() <= 64
KiB`, both return 413 with the offending index + key named in
the body. (H2)
- **Fail-closed token gate FIRST**: server token validation moves
before the method/content-type gates so an unauthenticated
attacker can't fingerprint the route by observing 405/415
behaviour. GET-with-no-token now returns 401 (matches the
`run_app_with_seeder` docstring contract). (N-M3)
- **422 body names BOTH index and key** of the failing entry so
operators can trim earlier entries and retry. (H4)
- **`SpinKvSeedWriter::write_batch`**: trait method rewritten to
open the KV store ONCE per batch instead of N times per entry.
Also gains the `NoSuchStore` variant distinct from
`WriteFailed`, mapped to 404 (label not declared in
runtime-config.toml) vs 422 (transient write failure). (M3 + M4)
- **Tighter content-type matching**: rejects `application/json-bad`
which the previous `starts_with` check accepted. (N-L1)
- **Drop wire-token length from mismatch log**: was a partial
oracle on server-token length. (M1)
- **16-byte-floor doc clarification**: explicit "16 random bytes
(e.g. `openssl rand -base64 16`)" wording — operators using
hex-encoded tokens get half the entropy. (M2)
- **Reserved-path collision detection**: `Adapter::reserved_paths()`
trait method; CLI rejects any `[[triggers.http]].path` matching
an adapter's reserved path so user-declared handlers can't be
silently shadowed by `run_app_with_seeder`. (H3)
## Correctness fixes (survive the pivot)
- **`ConfigStoreError::internal`** for `SpinSdkKvStore::open`
failures: structural / permanent (label not declared), distinct
from transient `unavailable`. `build_config_registry` uses
`anyhow::Context::with_context` to preserve the chain instead
of stringifying. (M4)
- **`spin-sdk` pinned to `~6.0`** so a 6.1.x signature or KV
schema change is a build failure rather than a runtime mismatch.
(M6)
- **`Adapter::merged_id_kinds()`** trait method: Spin overrides
to `&["kv", "config"]`. CLI rejects logical-id overlap across
merged kinds — same id under `[stores.kv].ids` and
`[stores.config].ids` would silently share writes via one
underlying KV label. (M7)
## API cleanup (survive the pivot)
- **Drop dead `_config_keys` parameter** from
`Adapter::validate_typed_secrets`. No implementer used it
post-Stage-6; every caller still computed the flattened key
set. (M8)
## Test bug + coverage
- **Fix duplicate `err.contains("api-token")` assertion** in
`validate_typed_secrets_rejects_invalid_spin_variable_in_secret_value`:
the field name `api_token` (underscore) was never actually
checked. (H5)
- **11 new tests for `resolve_adapter_push_ctx`** URL/token
resolution chains: flag > env > manifest precedence (prod),
flag > env > builtin fallback (local), the security-load-
bearing manifest-bypass guarantee under `--local`, distinct
prod vs local env vars, token-from-flag-or-env (never
manifest). (H6)
- **2 new manifest tests** pinning the `seed-url` TOML key's
serde rename: the dashed key populates `commands.seed_url`,
the underscored form is silently ignored — docs/errors must
point at the dashed form. (N-M2)
- **2 new reserved-path tests** asserting the
`/__edgezero/config/seed` collision is rejected at
`config validate` time. (H3)
- **2 new merged-id collision tests** asserting kv+config
overlap on the same logical id is rejected. (M7)
- **6 new seed handler tests**: 401 fail-closed on GET-no-token
and wrong-CT-no-token, 413 on oversized body / too many
entries / oversized value, 422 with index+key naming. (H1/H2/
H4/N-M3)
## Other fixes
- **`raw_push_runs_spin_key_validation_before_push`** rewritten
as `raw_push_runs_spin_adapter_manifest_check_before_push`:
the original probed Spin's deleted `^[a-z][a-z0-9_]*$` rule;
the new test uses `[component.*]` discovery in spin.toml as
the regression probe. Same intent (raw push runs shared
checks before dispatch), new probe.
- **`--local` help text** rewritten to document Spin-specific
semantics: `--local` switches the seed-URL resolution chain
away from the manifest's prod URL and toward the local env
var / builtin fallback. The manifest prod URL is NEVER
consulted under `--local` so a misconfigured prod entry can't
bleed into a local push. (N-L2)
- **Shared-token model documented** in `args.rs`: `--seed-token`
has no LOCAL variant, so operators with both contexts open
should set the env var to a value safe for both or pass the
flag explicitly per push. (M5)
- **App-demo wired through `run_app_with_seeder`**: the
scaffold was already using it; app-demo was still on plain
`run_app`, which made the seed endpoint unreachable on the
demo. Will be reverted in the next commit when the seeder is
deleted entirely. (N-M1)
## Gates
cargo fmt + host clippy (--all-targets --all-features) + cargo
test --workspace --all-targets across root and `examples/app-demo`.
Wasm clippy green for spin (wasm32-wasip2), fastly (wasm32-wasip1),
cloudflare (wasm32-unknown-unknown). 354 root core tests + 108 cli
tests + 88 spin tests + 71 macros tests + 12 adapter tests + the
rest of the workspace; 26 app-demo tests; all green.
## Next commits
1. `spin: drop /__edgezero/config/seed handler (architecture
pivot)` — deletes seed.rs, run_app_with_seeder, --seed-url /
--seed-token, the seed-url manifest field, the reserved_paths
trait method, and the resolve_adapter_push_ctx URL/token
logic. Reverts the app-demo seeder wiring above. The hardening
in this commit becomes historical (the file is deleted) but
the work was real for the time the handler was the design.
2. `spin: per-backend writers (SQLite-direct + Fermyon Cloud
shellout)` — implements the replacement: parse Spin's own
runtime-config.toml, dispatch to a SQLite writer (vendoring
Spin's exact `spin_key_value` schema with a byte-compare
contract test) or shell `spin cloud key-value set` based on
the backend type + auto-detected Fermyon Cloud deploy.
7 of 8 reviewer items from the June-02 batch — the eighth ("preserve
the historical root-level adapter registry API") is intentionally left
unaddressed: pulling the registry items back to the crate root would
require either a workspace-wide pub_use exception or a backward-
compatibility shim, and we'd rather have downstream adapters migrate
to `edgezero_adapter::registry::*` (the path every in-tree adapter
already uses) than carry a permanent allow.
Fixes:
- examples/app-demo/crates/app-demo-adapter-spin/src/lib.rs and
crates/edgezero-adapter-spin/src/templates/src/lib.rs.hbs:
spin_sdk::http_component expands to required WASI export glue
(`__export_wasi_http_incoming_handler_0_2_0_cabi` produces an
unsafe attribute + unsafe extern + unsafe block). Add a narrowly-
scoped `#![allow(unsafe_code, reason = ...)]`. Verified the lint
actually fires before adding the allow.
- crates/edgezero-adapter-cloudflare/src/templates/src/lib.rs.hbs:
pass `include_str!("../../../edgezero.toml")` as the new first
argument to `run_app::<…>`; the previous `(req, env, ctx)` call
no longer compiles against the current `run_app` signature.
- .github/workflows/test.yml: wasmtime install now enforces the pinned
version on every run — `.tool-versions` joins the cache key so a
bump invalidates the cached binary, and the install step compares
`wasmtime --version` against the pin and reinstalls on mismatch.
Defends against both stale cache hits and runner-provided wasmtime.
- crates/edgezero-adapter-cloudflare/src/lib.rs and
crates/edgezero-adapter-spin/src/lib.rs: `init_logger` is a no-op
that always returns `Ok(())`. Updated the `# Errors` doc to say
so, with a note that the Result signature exists so the future
"wire in a real logger" branch is drop-in compatible.
- crates/edgezero-adapter-fastly/src/request.rs: `dispatch_with_config`
logs+skips missing config stores rather than returning an error.
Updated the `# Errors` doc to describe the actual error surface
(request conversion / KV resolution / dispatch / response conversion).
The seed handler at `POST /__edgezero/config/seed` shipped on every
deployed Spin app via `run_app_with_seeder` — a permanent
EdgeZero-owned attack surface that even hardened (16-byte
constant-time tokens, 256 KiB body cap, 1000-entry/64 KiB caps,
fail-closed token-first ordering, etc., per the prior commit) is
still a liability we own forever. The PR-thread review made the
case that Spin already exposes the right primitives for KV
seeding (`spin cloud key-value set` for Fermyon Cloud; direct
SQLite for local) and we shouldn't need our own HTTP endpoint at
all.
This commit removes the handler and the surrounding CLI surface.
The replacement (per-backend writers reading Spin's own
`runtime-config.toml` to dispatch to SQLite-direct or
`spin cloud key-value set`) lands in the next commit on this
branch — `docs/superpowers/plans/2026-06-04-spin-per-backend-push.md`
spells out the design. Until then, `config push --adapter spin`
returns a clear "under restructure" error pointing at the plan
document so anyone running it (e.g., the app-demo integration
test that's `#[ignore]`d here) gets actionable next steps.
## Runtime side
- Delete `crates/edgezero-adapter-spin/src/seed.rs` (917 lines:
the handler itself plus the 23 D9-status-code unit tests added
in the prior commit, the `SeedWriter` trait, the
`SpinKvSeedWriter` impl, the `InMemorySeedWriter` test harness,
and the `MAX_BODY_BYTES` / `MAX_ENTRIES` / `MAX_VALUE_BYTES`
caps. All of this becomes moot once we don't own an HTTP
endpoint).
- Delete `run_app_with_seeder` from
`crates/edgezero-adapter-spin/src/lib.rs` and the `mod seed`
gate. Plain `run_app::<A>(req)` is the only public entrypoint
again.
- Revert
`examples/app-demo/crates/app-demo-adapter-spin/src/lib.rs`
to call `run_app::<App>` (drops the wiring added in the prior
commit).
- Revert
`crates/edgezero-adapter-spin/src/templates/src/lib.rs.hbs`
scaffold to call `run_app::<App>`. Generated projects no
longer ship a seed endpoint.
## CLI side
- Delete `--seed-url`, `--seed-token` flags from
`ConfigPushArgs`. Delete the related docstring paragraphs.
- Add `--runtime-config <PathBuf>` flag (default: adapter
resolves a location, typically `runtime-config.toml` next to
the adapter manifest). The per-backend writer will read this
file to dispatch.
- Delete `seed_url`, `seed_token`, `with_seed_url`,
`with_seed_token` from `AdapterPushContext`. Add
`runtime_config_path: Option<&Path>` + builder.
- Delete `Adapter::reserved_paths` trait method (only user was
Spin's seed route).
- Rewrite `resolve_adapter_push_ctx` to a 1-line function that
passes through `--local` + `--runtime-config` without any
URL/token resolution chain.
- Rewrite `dispatch_push` to use the new builder API. Drop
`EDGEZERO__ADAPTERS__SPIN__SEED_*` env handling entirely
(the env vars are gone).
- Delete the 11 `resolve_seed_*` unit tests added in the prior
commit (Pass 6) — they tested URL/token resolution that no
longer exists.
- Delete the 2 `spin_reserved_seed_*` and
`spin_non_reserved_paths_*` tests + the
`reject_reserved_path_collisions` helper.
## Manifest side
- Delete the `seed_url` field (and `rename = "seed-url"`) from
`ManifestAdapterCommands`. Delete the 2 tests added in the
prior commit (Pass 7) that pinned the rename.
## Spin adapter side
- Rewrite `Adapter::push_config_entries` /
`push_config_entries_local` impls as stubs that return a
pointed error ("under restructure; per-backend writers land in
the next commit"). Both methods stay so the trait signatures
remain satisfied; the real implementations land in Commit 3.
- Delete `Adapter::reserved_paths` impl.
- Delete `build_seed_payload` and the 4 push tests
(`push_with_no_entries_*`, `push_dry_run_emits_url_*`,
`push_errors_when_seed_url_unset_prod`,
`push_errors_when_seed_url_unset_local_names_local_env_var`)
+ 2 `build_seed_payload_*` tests.
- Drop the `reqwest::blocking::Client as HttpClient` import (no
more HTTP POST).
- Rewrite `raw_push_runs_spin_key_validation_before_push`'s
docstring to drop the stale `api-token` reference (the test
body already probes `[component.*]` discovery, not the deleted
key rule).
## App-demo + scaffold
- App-demo's `config_push_spin_dry_run_dispatches_cleanly_and_preserves_manifest`
integration test is `#[ignore]`-d with a pointer to
`2026-06-04-spin-per-backend-push.md`. It gets rewritten in
Commit 3 against a SQLite round-trip in a temp
`.spin/sqlite_key_value.db`.
- `raw_push_spin_dry_run_dispatches_to_adapter` in CLI tests
same treatment: body becomes a comment pointing at the plan,
`#[ignore]` so the suite stays green.
## Docs + scripts
- `docs/guide/adapters/spin.md` Config Store section's push
subsection rewritten to a `::: warning Push under restructure`
callout pointing at the plan document. The rest of the section
(KV-backed config model, runtime-config.toml requirement,
multi-store via `[stores.config].ids`) stays — KV runtime
reads are unchanged; only the writeback path is restructuring.
- `docs/guide/cli-reference.md` and `cli-walkthrough.md` spin
rows / bullets rewritten with the same restructure callout.
- `scripts/smoke_test_config.sh` comment updated: the
references to the seed handler become "SQLite write into
`.spin/sqlite_key_value.db` once the per-backend writer
lands".
## Net diff
14 files, 108 insertions, 1903 deletions. Most of the deletions
are seed.rs (917 lines) + the Pass 1-7 hardening + tests that
hardened the handler before we decided to retire it. Honest
history: that work was real for the time the handler was the
design; now the design changed.
## Gates
- `cargo fmt --all -- --check` — green.
- `cargo clippy --workspace --all-targets --all-features
-- -D warnings` — green.
- `cargo test --workspace --all-targets` — 5 root crate test
result blocks green (138 axum + 352 core + 41 cloudflare +
43 fastly + 12 adapter + 94 cli + 58 spin + others), 1 test
`#[ignore]`d (`raw_push_spin_dry_run_dispatches_to_adapter`),
zero failures.
- App-demo workspace: 26 + 3 (1 ignored) + 1 + 0×6 — green.
- Wasm clippy: spin (`wasm32-wasip2`), fastly
(`wasm32-wasip1`), cloudflare (`wasm32-unknown-unknown`) all
green.
## Next commit
`spin: per-backend writers (SQLite-direct + Fermyon Cloud
shellout)` — implements `push_config_entries` for real:
parses `runtime-config.toml`, dispatches based on backend
`type`. SQLite path vendors Spin's exact `spin_key_value`
schema with a byte-compare contract test against the upstream
source. Fermyon Cloud path shells `spin cloud key-value set`
per entry, auto-detected from `[adapters.spin.commands].deploy
= "spin deploy"` (suppressed by `--local`).
Implements the per-backend `config push --adapter spin` dispatch
that the previous commit's deletion left as a stub. No HTTP
endpoint, no EdgeZero-owned attack surface in deployed apps —
just direct backend writes via the runtime-config-declared
adapter.
## Architecture
`crates/edgezero-adapter-spin/src/cli/` (new submodule):
- `runtime_config.rs` — parses `runtime-config.toml`'s
`[key_value_store.<label>]` stanzas. Recognises `type = "spin"`
(local SQLite), `type = "redis"`, `type = "azure_cosmos"`, and
preserves anything else as `Unknown { type_name }` so the
dispatcher can name the unrecognised type in its error.
- `push_sqlite.rs` — SQLite-direct writer using rusqlite. Vendors
Spin's exact `spin_key_value(store, key, value)` schema and
`INSERT … ON CONFLICT DO UPDATE` statement from
spinframework/spin's `crates/key-value-spin/src/store.rs`. One
transaction per batch; creates file + parent dir + schema if
missing (matches Spin's runtime first-read behaviour).
- `push_cloud.rs` — Fermyon Cloud shellout. Shells `spin cloud
key-value set --store <label> <key> <value>` per entry,
capturing stderr. Detects "not logged in" specifically and
points the operator at `spin cloud login`. Auto-detection from
`[adapters.spin.commands].deploy` containing `spin deploy` /
`spin cloud deploy`.
`dispatch_push` (in `cli.rs`) decides which writer to use:
1. `--local` set → SQLite-direct (forces local even if manifest
deploy command would trip Fermyon Cloud auto-detect; lets the
operator push without authenticating against Fermyon Cloud).
2. Else if `manifest_adapter_deploy_cmd` contains a Fermyon
Cloud deploy hint → `spin cloud key-value set` shellout.
3. Else dispatch on `runtime-config.toml`'s
`[key_value_store.<label>].type`:
- `type = "spin"` (or no stanza) → SQLite-direct.
- `type = "redis"` → error pointing at
`redis-cli -u <url> SET <key> <value>`.
- `type = "azure_cosmos"` → error pointing at the Azure CLI.
- `Unknown { type_name }` → error naming the type so the
operator can plan accordingly.
## Schema-drift protection
`push_sqlite::SPIN_KV_CREATE_TABLE` and `SPIN_KV_SET` are
vendored byte-for-byte from spinframework/spin's
`crates/key-value-spin/src/store.rs`. A unit test
(`vendored_schema_matches_upstream_byte_for_byte`) byte-equals
each constant against the upstream string; a second
(`vendored_schema_creates_table_with_expected_column_shape`)
runs `PRAGMA table_info` and asserts the resulting column
shape matches Spin's expected
`(store TEXT, key TEXT, value BLOB)` PRIMARY KEY `(store, key)`.
Combined with `Cargo.toml`'s `spin-sdk = "~6.0"` pin, this
catches drift two ways: our vendored copy diverging from
upstream (byte-compare test fails), or Spin shipping a 6.1.x
that touches the schema (semver pin blocks the build).
## API surface changes
- `AdapterPushContext` gains
`manifest_adapter_deploy_cmd: Option<&'ctx str>` and a builder
method (`with_manifest_adapter_deploy_cmd`). Threaded through
from CLI's `dispatch_push` (which now reads
`adapter_cfg.commands.deploy` and populates the field).
## Templates / scaffold
- `templates/spin.toml.hbs`: dropped the stale "seed handler"
comment; replaced with "writes directly into the SQLite
backend declared for it in runtime-config.toml, or shells
`spin cloud key-value set` when deploying to Fermyon Cloud".
- `templates/runtime-config.toml.hbs`: corrected the example
managed-backend type name (`azure_cosmos`, not `azure`) and
added a paragraph stating that the current dispatcher
supports `type = "spin"` and points other types at their
native CLIs.
- `crates/edgezero-cli/src/templates/root/gitignore.hbs`: now
also ignores `.wrangler/`, `.spin/`, and `.edgezero/` so
scaffolded projects don't commit local emulator state. The
EdgeZero repo's own `.gitignore` already did this; the
scaffold was missing it.
## Tests
- 19 new spin-adapter unit tests across the three new files
(runtime-config parser variants + missing file + malformed
TOML, SQLite round-trip / overwrite / store-isolation /
default-path / explicit-path resolution, vendored-schema
byte-equal and PRAGMA shape, deploy-command Fermyon-Cloud
detection, etc.). Spin adapter is now at 77 tests (up from
58 after Commit 2's deletions).
- App-demo integration test
`config_push_spin_writes_sqlite_round_tripped_via_rusqlite`
(re-enabled, no longer `#[ignore]`-d): drives the full typed
flow through `run_config_push_typed::<AppDemoConfig>` against
a temp project with a `runtime-config.toml` selecting
`type = "spin"`, then re-opens the resulting
`.spin/sqlite_key_value.db` via rusqlite and asserts the
flattened, secret-stripped entries landed. Pins:
- `greeting` lands verbatim;
- `service.timeout_ms` lands with the nested-table dotted key;
- boolean `feature.new_checkout` flattens to "false";
- `#[secret]` `api_token` is stripped from the payload;
- `#[secret(store_ref)]` `vault` is stripped too.
## Docs
- `docs/guide/adapters/spin.md` Config Store → Seeding the
store: replaced the Commit 2 "under restructure" placeholder
with the real per-backend resolution order, the schema-
coupling note (vendored CREATE TABLE + drift test +
`spin-sdk` pin), and the local/cloud usage examples.
- `docs/guide/cli-reference.md` spin row in the push table:
replaced placeholder with the actual dispatch rules.
- `docs/guide/cli-walkthrough.md` spin bullet: same.
## Gates
- `cargo fmt --all -- --check` — green.
- `cargo clippy --workspace --all-targets --all-features
-- -D warnings` — green. Required two `#![expect]` opt-outs
in `cli.rs`: `self_named_module_files` (workspace policy
denies both `self_named_*` and `mod_module_*`, which
contradict; repo convention is the self-named form) and
`arbitrary_source_item_ordering` (the strict-ordering lint
disagrees with the conventional placement of `mod`
declarations after `use` blocks).
- `cargo test --workspace --all-targets` — green. 352 core +
138 axum + 94 cli + 77 spin + 43 cloudflare + 41 fastly +
others = ~1100 tests, zero failures.
- App-demo workspace tests — green, including the new
SQLite round-trip integration test.
- Wasm clippy on spin (wasm32-wasip2), fastly (wasm32-wasip1),
and cloudflare (wasm32-unknown-unknown) — all green.
`rusqlite` is gated behind `[target.'cfg(not(target_arch =
"wasm32"))'.dependencies]` so wasm builds never link it.
Five fixes against the per-backend writer redesign, surfaced by
the reviewer's deep-dive verification pass:
## F1 (blocker): `--local` now forces SQLite-direct unconditionally
Previously the dispatcher's `if !push_ctx.local && fermyon_cloud
_detect(...)` only short-circuited the Fermyon Cloud auto-detect.
After that early return, the runtime-config backend match still
ran -- so `--local` against `[key_value_store.app_config] type =
"redis"` printed the redis-cli error instead of writing local
SQLite, despite docs claiming `--local` "forces SQLite-direct".
The new dispatcher returns `write_sqlite(...)` immediately when
`push_ctx.local` is set. If the runtime-config DOES declare
`type = "spin"` with an explicit `path`, we honour that path; for
any other backend type we silently fall through to Spin's default
`.spin/sqlite_key_value.db`. Behaviour now matches the docs across
4 source files (adapters/spin.md, cli-reference.md, cli-walkthrough.md,
args.rs).
Three dispatch-matrix tests pin the override:
- `dispatch_push_local_forces_sqlite_even_when_runtime_config_declares_redis`
- `dispatch_push_local_forces_sqlite_even_when_runtime_config_declares_azure`
- `dispatch_push_local_forces_sqlite_even_when_deploy_targets_fermyon_cloud`
## F2: Platform-label collision check (not just logical ids)
`reject_merged_id_collisions` previously rejected only logical-id
overlap (`[stores.kv].ids = ["x"]` + `[stores.config].ids = ["x"]`).
But `EDGEZERO__STORES__KV__SESSIONS__NAME=shared` +
`EDGEZERO__STORES__CONFIG__APP_CONFIG__NAME=shared` resolve two
distinct logical ids to the SAME Spin KV label at runtime --
re-creating the silent-shared-writes bug the check was meant to
prevent.
The check now resolves each (kind, logical_id) pair through
`EnvConfig::store_name(kind, id)` and tracks platform labels in
a separate map; second appearance of the same platform label
across merged kinds errors. The function gains an
`env_config: &EnvConfig` parameter and the caller reads
`EnvConfig::from_env()` once per validation.
Test: `spin_distinct_logical_ids_collide_when_env_overlay_resolves_to_same_platform_label`.
## F3: Spin runtime-version compatibility check
The byte-compare schema-drift test was self-referential (compared
to a literal in the same file). The `spin-sdk = "~6.0"` pin only
covers the build-time SDK, not the operator's installed Spin CLI
/ runtime. Spin's docs explicitly warn the SQLite file format is
"subject to change".
`push_sqlite::verify_spin_runtime_compat` shells `spin --version`
once per session before the first SQLite-direct write, parses the
major version, and `log::warn!`s if it's outside
`VERIFIED_SPIN_MAJOR_RANGE = &[2, 3]`. Never blocks (Spin is
optional from the writer's perspective; CI without Spin still
works). The module docstring now spells out all three layered
guards (vendored constants + build-time SDK pin + run-time CLI
check) and explicitly names what they CANNOT catch (a point-
release schema change within the same major + same CLI version).
Four tests pin the parser:
- handles the canonical `spin 3.6.3 (sha date)` format
- handles `spin-cloud 0.11.0` hyphenated prefix
- returns None for unrecognised stdout
- parses double-digit major versions defensively
## F4: Clean stale docs / comments
- `docs/guide/configuration.md:201-205`: still described Spin push
as POSTing to `/__edgezero/config/seed`. Replaced with the
per-backend dispatch summary and a link to the spin adapter
guide's Seeding the store section.
- `crates/edgezero-adapter/src/registry.rs:253`: trait docstring
on `push_config_entries` still mentioned Spin's
`.` -> `__` key translation (removed in Stage 6 of the original
KV migration). Rewritten to drop that example.
- `crates/edgezero-cli/src/config.rs:3`: module header still
named "Spin key-syntax / component-discovery rules" and "Spin
config/secret collision check" -- both removed (Stage 6).
Replaced with the actual current shape ("per-adapter validators
(`[component.*]` discovery for Spin, etc.)").
## F5: Real dispatch tests; un-stub the empty CLI test
The redesign deleted the seed-handler dispatch tests and left
`raw_push_spin_dry_run_dispatches_to_adapter` as an empty
`#[ignore]`d body -- effectively zero CLI-level coverage that
`config push --adapter spin` even reaches Spin's dispatcher.
11 new dispatch-matrix tests in `adapter-spin/src/cli.rs`'s test
mod pin every branch of `dispatch_push`:
- empty-entries no-op
- 3 `--local`-forces-SQLite cases (vs Redis / Azure / Fermyon
Cloud auto-detect) -- F1 verification
- `--local` honours explicit Spin path
- Fermyon Cloud auto-detect from `spin deploy` deploy command
- Redis backend errors with redis-cli hint + url
- Azure backend errors with az-cosmosdb hint
- Unknown backend errors with the type name
- Default branch -> SQLite at `.spin/sqlite_key_value.db`
- `--runtime-config <path>` flag honoured (was test-coverage gap H2)
- Unrelated label in runtime-config doesn't block the matching
label's dispatch
The empty CLI stub is re-implemented to drive a raw `--local`
dry-run through `run_config_push` end-to-end and assert spin.toml
stays byte-identical (the per-backend writer never edits it).
## Gates
cargo fmt + host clippy (--all-targets --all-features) + cargo
test --workspace --all-targets all green. Wasm clippy on spin
(wasm32-wasip2) green. App-demo workspace tests green.
Spin adapter test count: 93 (was 77, +16: 11 dispatch matrix +
4 version parser + 1 the test-mod helper shape). CLI test count:
96 (was 94, +2 for env-overlay platform-label collision +
un-stubbed CLI dispatch test).
Net diff: +674 / -45 lines across 5 files.
… provision collision check Five fixes against the per-backend dispatcher, against the reviewer's second-round findings on tip 0be7444. ## H1 (production blocker): Fermyon Cloud command shape was wrong The `set` subcommand in fermyon/cloud-plugin's `src/commands/key_value.rs` takes: spin cloud key-value set --store STORE KEY=VALUE [KEY=VALUE ...] Key/value pairs are POSITIONAL arguments in `key=value` form (parsed via `spin_common::arg_parser::parse_kv`) and the command accepts MULTIPLE pairs per invocation. The previous shape (`--store STORE KEY VALUE`, one shellout per entry) would fail upstream arg-parsing and probably target the wrong concept. Push_cloud now: - Formats each entry as `key=value`, refusing `=` in keys (`parse_kv` splits on the FIRST `=` so a key containing `=` would silently truncate). - Batches entries into chunks under a 96 KiB argv budget per invocation (well below typical `ARG_MAX`) — a 1000-entry push becomes 1 or 2 shellouts, not 1000. - Updates the dry-run preview wording at `cli.rs:551`, `cli-reference.md:248`, and `runtime-config.toml.hbs:20` to reflect the corrected shape. Seven new tests pin the shape: - `format_pair_emits_key_equals_value` - `format_pair_allows_equals_in_value` - `format_pair_rejects_equals_in_key` - `chunk_entries_packs_single_chunk_when_small` - `chunk_entries_handles_empty_slice` - `chunk_entries_splits_when_aggregate_exceeds_cap` - `chunk_entries_rejects_oversized_single_pair` ## H2: Non-default labels now require a runtime-config stanza Spin auto-provides ONLY the `default` KV label. Any other label must have a `[key_value_store.<label>]` entry in `runtime-config.toml` or `spin up` errors with "unknown key_value_stores label X" and the SQLite file we just wrote is unreadable from the running app. The previous dispatcher fell through to SQLite-direct for any absent label — so `app_config` could be pushed "successfully" to .spin/sqlite_key_value.db while the running spin app fails at `Store::open("app_config")`. `verify_label_declared` now checks BOTH the `--local`-forced branch AND the default branch: - `default` label → fall through to SQLite (Spin auto-provides). - Label with stanza → fall through to SQLite. - Non-default label WITHOUT stanza → hard error naming the missing stanza, the runtime symptom Spin would emit, AND the exact line to add to runtime-config.toml. Two new tests: - `dispatch_push_default_label_with_no_runtime_config_dispatches_to_sqlite` (the `default` exception still works) - `dispatch_push_non_default_label_without_runtime_config_stanza_errors` (the new error path) - `dispatch_push_non_default_label_with_runtime_config_stanza_dispatches_to_sqlite` (counterpart to the error case) Updated three pre-existing dispatch tests to declare the runtime-config stanza they were silently relying on. ## M1: `provision --adapter spin` now runs the same env-overlay collision check The env-resolved platform-label collision check landed in `config validate` in commit 0be7444 but `provision` had its own pre- dispatch flow that didn't call it. Result: an operator with `EDGEZERO__STORES__KV__SESSIONS__NAME=shared` + `EDGEZERO__STORES__CONFIG__APP_CONFIG__NAME=shared` saw `config validate` exit 1 but `provision --adapter spin --dry-run` exit 0 and emit two label writes that both land on the same store. - `reject_merged_id_collisions` is now `pub(crate)` so `provision.rs` can call it. - The call lives between the `validate_adapter_manifest` hook and the `resolve_kind` env-resolution block, so it fires unconditionally before any platform-label resolution. - New test `run_provision_spin_rejects_env_overlay_platform_label_collision_across_kv_and_config` pins parity with the `config validate` regression added in 0be7444. ## L1: Stale docs cleaned - `docs/guide/cli-reference.md:281`: the spin provision row said "Config and secret ids are intentionally not handled here" -- out of date since Stage 5 of the KV-config migration, when provision started writing config ids too. Rewritten. - `docs/guide/cli-walkthrough.md:110`: same paragraph; same fix. - `docs/guide/configuration.md:201` was already fixed in 0be7444; spot-check confirms. - `runtime-config.toml.hbs:20`: scaffold comment said push "only dispatches to local SQLite" -- stale since the Fermyon Cloud writer landed. Rewritten to name all three dispatch branches (SQLite-direct, `spin cloud key-value set` for auto-detected cloud, native-CLI errors for redis / azure_cosmos / unknown). ## L2: `manifest_guard` added to the F2 env-overlay test The F2 test sets process-global `EDGEZERO__STORES__*` env vars without serialising against other env-mutating tests. Per `test_support.rs:137` docs, every env-mutating test should hold the manifest mutex before the `EnvOverride` guards drop. Added. ## Gates - cargo fmt + host clippy (--all-targets --all-features) green. - cargo test --workspace --all-targets green: - Spin adapter: 102 (was 93; +9 across H1 chunker + H2 stanza-required branches). - CLI: 97 (was 96; +1 for the M1 provision regression). - Wasm clippy on spin (wasm32-wasip2) green. - App-demo workspace tests green. The reviewer's earlier `cargo test -p edgezero-cli raw_push_spin_dry_run_dispatches_to_adapter -- --ignored` invocation now passes WITHOUT `--ignored` (the stub is real, asserts spin.toml byte-identical post-dispatch, and was extended to write the required runtime-config stanza).
…l, docs Three fixes against the per-backend dispatcher, against the reviewer's third-round findings on tip 7dd6ab6. ## Blocker: Parallel test env leakage `cargo test -p edgezero-cli spin` failed under default parallelism because the F2 collision test sets `EDGEZERO__STORES__*__NAME=shared` (under manifest_guard) while unrelated tests run `run_config_push` / `run_config_validate` in parallel WITHOUT the guard. The unguarded tests read process env mid-flight and see `shared`, then fail the new H2 "non-default label without runtime-config stanza" check. Audit + fix: 24 tests in config.rs that hit `run_config_validate*` / `run_config_push*` now hold the `manifest_guard` for the duration of the at-risk call. Existing provision tests already held it (12 sites unchanged). Pattern matches the documented invariant in `test_support.rs:137`: "every test that touches process env must hold the guard". Stress-tested 5 sequential `cargo test -p edgezero-cli` runs under default parallelism: 5/5 pass at 97/97. ## H: Fermyon Cloud push now uses --app + --label, not --store Per [fermyon/cloud-plugin's `key_value.rs`](https://github.com/fermyon/cloud-plugin/blob/main/src/commands/key_value.rs) `SetCommand`, the `set` subcommand has two mutually-exclusive addressing modes: - `--store STORE` — target the cloud KV store by its actual resource name. Requires knowing the cloud-side resource. - `--app APP --label LABEL` — target the cloud KV store via the app-scoped label that's mapped to it. Matches Fermyon's [label model](https://developer.fermyon.com/cloud/linking-applications-to-resources-using-labels). EdgeZero's `store.platform` is the env-resolved Spin label written into `spin.toml`'s `key_value_stores`, NOT the cloud- side KV resource name. The previous `--store <platform>` shape conflated the two: if an operator linked label `app_config` → store `prod-config` in Fermyon Cloud, our writer was seeding `prod-config` only when the operator had literally named the label and the store the same. The corrected shape: `--app APP --label LABEL KEY=VALUE …`, where `APP` comes from `spin.toml`'s `[application].name` and `LABEL` is the env-resolved platform label. Operators pre-link the label to a cloud KV store via `spin cloud link key-value` (or the dashboard); the dispatcher detects the "label not linked" stderr and suggests the link command. Implementation: - `push_cloud::write_batch(app_name, label, entries)` takes the app name as a new first parameter. - `dispatch_push` reads `[application].name` from spin.toml before calling the cloud writer. Missing `[application].name` produces an actionable error (rather than silently shelling `set --app --label …` which would fail upstream with an unhelpful clap error). - New helper `read_spin_application_name` mirrors the existing `resolve_spin_component` pattern. Three new tests pin the corrected shape + actionability: - `dispatch_push_fermyon_cloud_auto_detects_from_spin_deploy_and_uses_app_label_shape` asserts the dry-run preview includes `--app x --label app_config` and does NOT include `--store`. - `dispatch_push_fermyon_cloud_errors_when_spin_application_name_missing` pins the actionable error. - The cloud writer's "not linked" branch is now exercised via the `not linked` / `no store linked` / generic `link` stderr classification. ## L (medium): Stale docs - `docs/guide/adapters/spin.md:158-174`: rewrote points 1-4 of the "Seeding the store" resolution order to reflect ALL three recent semantic changes: - `--local` requires runtime-config stanzas for non-default labels (from earlier round); - Fermyon Cloud writer uses `--app <APP> --label <LABEL> KEY=VALUE` shape with chunking semantics named explicitly; - default branch only auto-fallback for `default` label. - `docs/guide/cli-reference.md:248`: same updates to the spin row of the push table. - `docs/guide/cli-walkthrough.md:179-198`: same updates to the spin bullet, including link to Fermyon's label model docs. ## Gates - cargo fmt + host clippy (--all-targets --all-features) green. - cargo test --workspace --all-targets green: spin adapter at 103 (was 102, +1 for the cloud-shape + app-name-required tests collapsed), CLI at 97 (env tests now consistently serialize). - 5/5 stress runs of `cargo test -p edgezero-cli` under default parallelism all 97/97 green. - Wasm clippy on spin (wasm32-wasip2) green. - App-demo workspace tests green. The reviewer's failing invocation `cargo test -p edgezero-cli spin` (default parallelism) now passes deterministically.
…in tests Three fixes against the reviewer's fourth-round findings on tip 762c426. ## F1 (medium): `link key-value` hint suggested wrong syntax The previous hint: spin cloud link key-value --app <APP> --label <LABEL> <store> is invalid. Per fermyon/cloud-plugin's `src/commands/link.rs::KeyValueStoreLinkCommand`, the actual shape is: spin cloud link key-value --app <APP> --store <STORE> <LABEL> Where the LABEL is positional (no `--label` flag), and `--store` takes the cloud KV resource name. The `link` and `set` commands have ASYMMETRIC argument shapes — `set` uses `--label`, but `link` does NOT. The fix-suggestion path is the path operators will need most when first linking; getting it wrong defeats the actionable purpose of the hint. Corrected to the verified upstream shape. ## F2 (low): Scaffold runtime-config.toml.hbs still showed old Cloud command The implementation switched to `--app <APP> --label <LABEL> KEY=VALUE` in commit 762c426, and `docs/guide/` was updated alongside. The scaffold template's comment (line 24) was missed: newly scaffolded projects would carry stale `--store <label> KEY=VALUE …` wording. Rewritten to reflect the actual shape AND the link command operators need to run before the first push. ## F3 (low): Hermetic mock-spin tests for actual argv `chunk_entries` + `format_pair` cover the per-pair / chunking logic in isolation, but they don't prove `write_batch` assembles the exact argv. Past command-shape regressions (`--store` → `--app/--label`) would have been caught by an end-to-end argv test against a fake `spin` binary. Four new tests stand up a tempdir with a `spin` script that captures its argv via `printf '%s\n' "$arg"` and stderr via `cat stderr.txt`, prepend the dir to `PATH` under a per-test mutex, and assert: 1. `write_batch_assembles_app_label_keyvalue_argv_against_a_mock_spin` — exact argv shape: `[cloud, key-value, set, --app, my-app, --label, app_config, greeting=hello, svc.timeout=1500]`. 2. `write_batch_translates_not_logged_in_stderr_to_actionable_error` — fake spin exits 1 with "not logged in" stderr; the wrapped error suggests `spin cloud login`. 3. `write_batch_translates_unlinked_stderr_to_actionable_link_hint` — fake spin exits 1 with "label `app_config` is not linked to a store" stderr; the wrapped error suggests the CORRECTED `link key-value --app ... --store <store-name> app_config` shape AND does NOT contain `--label` in the link-command region (specifically scoped to avoid false-positive matches against the failing SET command which legitimately uses `--label`). 4. `write_batch_chunks_large_batch_into_multiple_invocations_against_mock_spin` — same fixture as the existing chunker unit test (7 × ~30 KiB), but verifies the actual mock-spin invocation count matches the chunker's chunk count, proving the loop in `write_batch` actually shells once per chunk. The tests are `#[cfg(unix)]` because the mock relies on a `#!/bin/sh` script and chmod +x. A separate `path_mutation_guard` mutex serializes them so two parallel mock tests don't race on `PATH`. Stderr payloads contain backticks and `$` characters that would be reinterpreted by the shell, so the script reads stderr from a file rather than interpolating it into the script body. ## Gates - cargo fmt + host clippy (--all-targets --all-features) green. - cargo test --workspace --all-targets green: spin adapter jumps to 107 tests (was 103, +4 hermetic mock-spin tests). - Wasm clippy on spin (wasm32-wasip2) green (the new mock infrastructure is `#[cfg(unix)] #[cfg(test)]`-gated so it doesn't ship to wasm). - App-demo workspace tests green.
Brings in PR #257 review-feedback fixes (e788714) on top of the extensible-CLI / per-backend `config push` work. Conflicts resolved in three files — all by keeping HEAD where upstream targeted APIs/forms that this branch has since superseded: - crates/edgezero-adapter-fastly/src/request.rs Upstream re-touched `dispatch_raw`/`dispatch_with_config`/ `dispatch_with_config_handle` doc-strings; this branch's 9d31015 Hard-cutoff pass deleted those functions. Kept HEAD — the block stays removed. - crates/edgezero-adapter-spin/src/templates/src/lib.rs.hbs - examples/app-demo/crates/app-demo-adapter-spin/src/lib.rs Upstream switched to an unconditional `#![allow(unsafe_code, …)]` with `spin_sdk::http_component` wording. This branch is already on Spin SDK 6 (`#[http_service]` + `Request`), so kept HEAD's `cfg_attr(target_arch = "wasm32", allow(unsafe_code, reason = …))` form which both narrows the allow to wasm builds and references the macro this branch actually uses. Auto-merged without conflict: .github/workflows/test.yml, crates/edgezero-adapter-cloudflare/src/lib.rs, crates/edgezero-adapter-cloudflare/src/templates/src/lib.rs.hbs, crates/edgezero-adapter-spin/src/lib.rs. Verified on the merged tree: - cargo fmt --all -- --check - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo test --workspace --all-targets (865 passed) - cargo clippy -p edgezero-adapter-spin --target wasm32-wasip2 … - cargo clippy -p edgezero-adapter-fastly --target wasm32-wasip1 … - cargo clippy -p edgezero-adapter-cloudflare --target wasm32-unknown-unknown … - cd examples/app-demo && cargo test --workspace --all-targets
…s cleanup Addresses the June-05 PR #257 review. 1. Important — Spin adapter CLI tests are no longer hermetic under parallel execution. The `push_sqlite::write_batch` writer shells `spin --version` once-per-process via `verify_spin_runtime_compat`. When `push_cloud`'s tests prepend a fake `spin` to `$PATH` (guarded only by a module-local mutex), a concurrently-running push_sqlite test's first `write_batch` can hit that fake spin and append `--version` into the cloud test's argv log, failing the cloud assertion and poisoning the mutex. Fix: early-return from `verify_spin_runtime_compat` under `cfg!(test)`. The function is best-effort warning logic with no production semantic impact, and its parser is unit-tested independently, so dropping it in tests doesn't lose coverage. `cfg!()` is a const expression (not a `#[cfg(not(test))]` attribute) so it doesn't trip strict-clippy's `cfg_not_test`. `cfg!(test)` resolves only for THIS crate's test target, so the shellout still runs when `write_batch` is called from production code or from downstream crates' tests (e.g. `app-demo-cli`). 2. Medium — `dispatch_push` parsed `runtime-config.toml` before branching, so a malformed local runtime-config blocked even Fermyon Cloud `--dry-run` previews — even though the cloud path only needs `[application].name` from `spin.toml`. Restructure so the cloud branch never reads runtime-config: keep the path math at the top, read inside `--local`, skip read in the cloud branch, read again in the SQLite-direct fallthrough. Regression covered by `dispatch_push_fermyon_cloud_dry_run_ignores_malformed_runtime_config` which seeds the tempdir with `this is not [valid toml` and asserts the cloud preview still renders. 3. Low — `edgezero config push`'s CLI reference omitted `--local` and `--runtime-config`. Added both to the synopsis and to the argument list, calling out that `--local` is Spin/Fastly/CF and `--runtime-config` is Spin-only (and explicitly noting cloud pushes don't consult it). 4. Low — stale wording in: - `docs/guide/adapters/spin.md`: example showed `type = "azure"` for the managed-backend swap, but the parser only recognises `azure_cosmos`. Changed to `azure_cosmos`. - `crates/edgezero-adapter-spin/src/templates/spin.toml.hbs`: the `key_value_stores = ["app_config"]` comment claimed `app_config` was the default `[stores.config].ids` declared in the generated `edgezero.toml`, but that section is commented-out by default. Reworded to reflect the opt-in-default model (uncomment in edgezero.toml to wire it up; delete here + in runtime-config.toml to disable). Verified on this branch (all gates green): - cargo fmt --all -- --check - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo test --workspace --all-targets - cargo clippy -p edgezero-adapter-spin --target wasm32-wasip2 --features spin --all-targets -- -D warnings - cargo clippy -p edgezero-adapter-fastly --target wasm32-wasip1 --features fastly --all-targets -- -D warnings - cargo clippy -p edgezero-adapter-cloudflare --target wasm32-unknown-unknown --features cloudflare --all-targets -- -D warnings - cd examples/app-demo && cargo test --workspace --all-targets - (cd docs && npx prettier --check guide/cli-reference.md guide/adapters/spin.md)
…, refresh stale Spin wording Addresses the June-06 PR #257 review. 1. High — Generated Cloudflare projects did not compile. The scaffold's `lib.rs.hbs` called `run_app::<App>(include_str!(...), req, env, ctx)` (4 args), but the current runtime API is `run_app(req, env, ctx)` (3 args). Verified by `cargo test -p edgezero-cli --test generated_project_builds -- --ignored`, which failed pre-fix with E0061 "this function takes 3 arguments but 4 arguments were supplied" and passes after. Fix: drop the obsolete `include_str!` argument; the template now matches `examples/app-demo/crates/app-demo-adapter-cloudflare` (which has been on the 3-arg form for a while). 2. Medium — Fermyon Cloud `--dry-run` returned before calling the real argv validation (key contains `=`, per-pair/per-chunk argv cap). A "successful" dry-run could be followed by a hard failure on the real push. Fix: call `push_cloud::chunk_entries(entries)?` inside the dry-run arm. Same validation as the real write_batch path, so a green dry-run is a real predictor of push success. Also surfaces the chunk count in the preview line ("for N entries across M invocation(s)") so operators can see the batching decision the real push would make. Regression covered by `dispatch_push_fermyon_cloud_dry_run_rejects_equals_in_key`. 3. Low — Stale Spin-config wording in places where the runtime moved from Spin variables to KV (which stores dotted keys verbatim): - `crates/edgezero-core/src/config_store.rs:212`: trait doc listed `SpinConfigStore` as "Spin component variables" — updated to "Spin KV (`spin_sdk::key_value::Store`)". - `examples/app-demo/app-demo.toml:24-28`: comment claimed `feature.new_checkout` was translated to `feature__new_checkout` on Spin's flat namespace — Spin now reads `feature.new_checkout` verbatim, no translation. - `examples/app-demo/crates/app-demo-core/src/config.rs:27-33`: same fix, on the typed AppConfig field's doc comment. These were doc drift only — runtime code already does the right thing, but the stale wording would mislead anyone seeding stores manually or migrating an older app. Verified (all gates green): - cargo fmt --all -- --check - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo test --workspace --all-targets - cargo test -p edgezero-cli --test generated_project_builds -- --ignored - cargo clippy -p edgezero-adapter-spin --target wasm32-wasip2 --features spin --all-targets -- -D warnings - cargo clippy -p edgezero-adapter-fastly --target wasm32-wasip1 --features fastly --all-targets -- -D warnings - cargo clippy -p edgezero-adapter-cloudflare --target wasm32-unknown-unknown --features cloudflare --all-targets -- -D warnings - cd examples/app-demo && cargo test --workspace --all-targets
Addresses the post-f1179df PR #257 review. 1. Medium — Spin Cloud pushes are non-atomic across chunks (one `spin cloud key-value set` shellout per ≤96 KiB argv chunk), but the pre-fix error only named the failing chunk's size + exit status. If chunk 1 committed and chunk 2 failed, the operator was left with partially-updated live cloud state and no resume boundary. Fastly already produces a committed / failed / not-attempted diagnostic (cli.rs::push_entries_with_committer). Mirror Fastly's shape in `push_cloud::write_batch`: track a cursor through `entries` as committed-chunks accumulate, and on failure emit a structured error naming - committed keys (already on Fermyon Cloud, safe to skip), - failed-chunk keys (the cloud API is atomic per shellout, so a non-zero exit means none of these landed), - not-attempted keys (subsequent chunks, fully re-push needed), - a resume hint pointing out that `set` is idempotent so re-running with the full set is also safe. Regression covered by `write_batch_partial_failure_reports_committed_failed_and_not_attempted_keys`, which stands up a fake `spin` that succeeds on invocation 1 and fails on invocation 2, feeds 7 × ~30 KiB entries (>=3 chunks), and asserts the diagnostic names all three buckets plus the upstream stderr. 2. Medium — `docs/guide/manifest-store-migration.md`'s capability table still listed spin's Config as `Single (flat variables)`, but the Spin runtime is KV-backed and Multi for Config (one `spin_sdk::key_value::Store` per declared `[stores.config].id`). This page is linked from the loader's hard-error message when it encounters a pre-rewrite manifest, so the stale entry can actively mislead migrations. Changed to `Multi (KV label)`. 3. Low — Axum config-push docs claimed it was "future Stage 7 work" and told users to populate `.edgezero/local-config-<id>.json` directly. `config push --adapter axum` ships and writes the same file the runtime reads. Updated: - `docs/guide/configuration.md` — bullet now points operators at `edgezero config push --adapter axum`. - `docs/guide/adapters/axum.md` — same bullet under the Config Store section; also calls out the typed flow from a downstream `<your-cli>` for `#[secret]` stripping. Verified (all gates green): - cargo fmt --all -- --check - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo test --workspace --all-targets - cargo clippy -p edgezero-adapter-spin --target wasm32-wasip2 --features spin --all-targets -- -D warnings - cd examples/app-demo && cargo test --workspace --all-targets - (cd docs && npx prettier --check guide/manifest-store-migration.md guide/configuration.md guide/adapters/axum.md)
The June-07 review caught a clippy regression in the freshly-added `write_batch` partial-failure diagnostic: under `cargo clippy --workspace --all-targets --all-features -- -D warnings` the direct slice indexing (`entries[..cursor]`, `entries[cursor..chunk_end]`, `entries[chunk_end..]`) tripped `clippy::indexing_slicing`, and the single-letter destructured binding `(k, _)` tripped `clippy::min_ident_chars`. Both are part of this repo's strict-clippy restriction set (Stage 8 chore/strict-clippy merge), so the previous form failed CI on `cargo clippy` even though `cargo test` and `cargo fmt` were clean. Refactor: replace the three slice indices with `.get(..)` calls that fall through to `&[]` if the in-bounds invariant is ever violated (it can't be — `cursor` and `chunk_end` are produced from `entries.len()` and `chunk_entries`'s structure) — and rename the destructured binding to `(key, _value)`. Pure refactor: the partial-failure error string and the `write_batch_partial_failure_reports_committed_failed_and_not_attempted_keys` regression test are unchanged. All 16 push_cloud tests still pass. Verified (clean): - cargo fmt --all -- --check - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo test -p edgezero-adapter-spin --features cli push_cloud
The June-07 review caught `npx prettier --check .` failing on `docs/guide/cli-walkthrough.md` lines 190 / 202-204. Prettier doesn't preserve indentation on continuation lines inside backtick-wrapped inline-code spans (`KEY=VALUE`, `SET <key> <value>`, `azure_cosmos`), so the de-indent it wants is purely a source-format change — the rendered VitePress output is unchanged because the surrounding backticks group the whole multi-line span as one inline code block. Pure formatting; no content edits. Verified: `(cd docs && npx prettier --check .)` is clean.
25 tasks done
Integrate revision-isolated build caching and compatible dependency updates. Preserve audited SDK and codec pins, per-crate Syn major versions, and qualified WASI dependencies. Correct lifecycle fixture formatting required by CI.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the portable outbound HTTP and request-lifecycle contracts across core and the Axum, Cloudflare, Fastly, and Spin adapters.
start_batch_until, indexednext, explicitcancel, orderedcollect, and thesend_all_untilconvenience path.start_batch_untiltakes an observation cutoff: reaching it stops observation even when individual slots retain budget, while earlier cutoffs remain a supported partial-result operation.PlatformMetadatafacts for memory ceilings, live inbound request population, and host-ingress accounting, preserving source and explicit unknown reasons.Fits,Exceeds, and typedIndeterminateoutcomes; publishes canonical Axum, Cloudflare, Fastly, generic Spin, and Akamai Functions profiles.CompletedorCutoff. OnlyCutoffpermits unresolved slots in a successful result. Explicit adapter failure, premature driver EOF, and duplicate or out-of-range indices returnOutboundBatchFailure, preserving the precise error and every terminal slot collected before failure.MonotonicClock::deadline_afteranchors relative cutoffs to that clock. Equality expiry wins and backwards time fails closed.ResponseEgressCompletion, transferred directly throughPreparedIngress,ResponseEgressEnvelope, and the soleResponseEgressAttempt. Terminal state is stored before the response-scoped completion and global observer run, each exactly once and behind independent panic boundaries. No response-extension carrier or envelope extraction bypass remains.ResponseEgressCompletion::joincomposition so independent response-owned resources share one exactly-once terminal report, and hard-cuts detached normalized errors toSend { completion, deadline } | Abortwith request-start-relative bounded deadlines.AdmissionDecision::Abort. Axum closes the owned HTTP/1 connection before body polling; Cloudflare, Fastly, and Spin return a fixed provider error at their strongest available pre-response boundary and remain conservatively classifiedBestEffort.Hooks::configureplus core-ownedApp::build::<A>(platform). Successful hooks must preserve the complete adapter-selected metadata; core rejects changed facts instead of restoring them. Typed configuration failures propagate unchanged and stop serving before request handling. The generated scaffold keeps finite ingress policy with core-owned empty lifecycle tokens; the checked-in demo retains the full application-owned resource-composition example.AbortController, Fastly's low-levelstream_to_client, and Spin's WASI response/body/result writers.Current Checkpoint: Bounded Synthesized Headers
Added in
d47c8026:This checkpoint is not completion of the broader adoption plan or hosted qualification. The full head-first/eager/redirect migration, Fastly's failed G2 preserving-read proof, all nine failed Fastly framing SDK parity controls, Cloudflare overflow recovery, consumer integration and exact-candidate hosted qualification remain open. No capability is promoted, no compatibility layer is restored, and the PR remains draft.
Reviewer correctness follow-up
Addressed R1–R4 in
92111839:Main merge and shared-policy follow-up
Addressed R5 and R6 in
91f4af38, merging main683202c6without restoring superseded APIs:OutboundBatch::from_futures; adapters retain preflight validation, exchange ownership, clocks, and terminal samples. Ready results remain retained, driver EOF/index invariants remain enforced, and cutoff releases pending futures before reporting termination. Fastly retains its distinct provider-handle driver.ResponseBodyPolicyandapply_response_body_policy, preserving declared-length checks, encoded limits, decoding/header rewriting, decoded limits, passthrough, and rechunk order. Transport reads, bodyless handling, deadlines, cancellation, and final buffering remain adapter-owned.Result<(), E>through a wrapper that prevents SDK-generated second responses.R7's dependency-audit-script deduplication remains deferred; dependency contract checks remain unchanged and pass.
Bounded native ingress and config follow-up
ConfigValuereturns. Axum constructors requireConfigStoreLimits;from_mapis fallible. Reads share payloads, and local config push updates require a server restart.serde_json 1.0.150, hash canonical JSON incrementally, and release extraction's raw handle before secret retrieval. A moving-reallocation malformed-root probe measured 36,428 requested peak bytes under a 100,060-byte staging cap, with zero retained bytes after rejection.Unsupportedand response egress remainsBestEffort. Local emulators and guest contract tests are not deployed runtime evidence.Bounded provider reads and lifecycle qualification infrastructure
FinalizationRegistrycleanup support. Generated and demo Workers explicitly enableenable_weak_ref, and regression tests inspect their TOML rather than assuming an exact one-flag string.try_opennow returns typedConfigStoreError.Downstream acceptance impact
Cloudflare
outbound-deadlinesandstreamed-upload-deadlinesareBestEffort, notNative. Downstream acceptance suites must use best-effort deadline wording and must not claim exact cancellation enforcement until deployed host-observed evidence exists.The response completion, ingress abort, and fallible application-assembly changes are intentional breaking changes. Consumers must provide a completion on every response-producing admission decision and propagate
App::build::<A>(platform)failures.Evidence boundaries
Capability declarations remain conservative where provider behavior is not proved:
Unsupportedon all adapters.Nativeon Axum andBestEfforton Cloudflare, Fastly, and Spin because finite host-side teardown is not proved or synchronously preemptible.Nativeon Axum's owned HTTP/1 connection andBestEfforton Cloudflare, Fastly, and Spin because provider transport reset/close is not directly observable.BestEfforton every adapter because no boundary proves end-client receipt; provider-specific blocking and teardown limits are documented.Unsupported; provider parsing/materialization, SDK copies, informational responses, trailers, allocator overhead, and other host-owned memory remain outside guest-visible caps.BestEfforton every adapter because provider operations are not proved cancellable within a finite wall-clock interval.BestEffortpending a deployed host-observed cancellation artifact. Fastly and Spin retain their separately documented deadline, phase-budget, and isolation limitations.Validation
scripts/run_tests.shcargo fmt --all -- --checkcargo clippy --workspace --all-targets --all-features -- -D warningscargo test --workspace --all-targetscargo check --workspace --all-targets --features "fastly cloudflare spin"Closes
Closes #436.