Axum: define a production server lifecycle with bounded graceful shutdown #392

Description

The standard native runner handles Ctrl-C but has no explicit SIGTERM/readiness/drain-deadline contract on audited main; see crates/edgezero-adapter-axum/src/dev_server.rs:313. PR #406 implements the production lifecycle together with #396, on the unmerged #275 HTTP foundation. Keep this issue open until its accepted stack and process-level acceptance are complete.

Steps to reproduce

Start a generated native application under a subprocess/container supervisor. Send SIGTERM and SIGINT with a finite request in flight, then with a never-ending stream. Observe readiness, admission and process exit against a configured drain deadline. These are required acceptance checks, not results of this audit.

Expected behavior

Startup, ready, draining and stopped states have explicit ownership; signals or an embedding caller stop admission and allow finite work to finish before a bounded forced stop. Initialization/bind failures exit unsuccessfully.

Impact

Supervised deployments cannot rely on Ctrl-C-only shutdown or treat dropping a runtime as graceful process draining. Unbounded termination can interrupt work or exceed an orchestrator grace period.

Proposed fix

Review/integrate PR #406 on accepted #275 connection and completion contracts; reuse one serving path and application-owned readiness checks. Preserve route ownership, embedding shutdown and exactly-once terminal/resource handling. Document HTTP protocol and forced-stop limits separately from response delivery. Do not add another transport bridge.

Done when

• Re-audit the accepted PR feat: implement portable outbound HTTP and request lifecycle contracts #275 implementation and record which checks are already covered. Add only residual changes and missing production acceptance evidence.
• Subprocess tests show SIGTERM and SIGINT both initiate graceful shutdown.
• A finite in-flight request completes during draining; a never-ending request or stream cannot keep the process alive past the configured deadline.
• Readiness stays false during startup, becomes true after required initialization, and becomes false when draining starts.
• Invalid configuration, initialization failure, and bind failure return a non-zero exit status with a useful diagnostic.
• Health checks do not override existing application routes, and embedding callers can supply shutdown without installing signal handlers.
• State transitions, timeout defaults, and orchestrator termination-grace recommendations are documented.

Related

• Parent: Make the Axum adapter production-ready for self-hosted deployments #391. Implementation: PR Add Axum production startup and bounded shutdown #406 (also Axum: make production configuration and local storage explicit #396), based on PR feat: implement portable outbound HTTP and request lifecycle contracts #275 / Implement portable outbound HTTP and request lifecycle contracts #436.
• Coordinate Axum: enforce configurable buffered request-body limits #393/Axum: preserve incremental streaming with bounded backpressure #394 admission and stream cleanup, Axum: scaffold hardened production application Dockerfiles #398/Axum: validate multi-platform containers and provide an application publishing workflow #399 final-image checks and Axum: document Docker, Kubernetes, and managed-cloud deployments #400 operator guidance.
• Downstream app readiness: Trusted Server #1142.