[ChristianPavilonis]

RC refresh checkpoint, 2026-11-10

Current head: d475727691e2a80ca2dbb324568283f63e34a870.

The five celld-only donor commits are replayed onto updated #414, without obsolete hosting or diagnostic ancestry. Config/KV source selection stays typed and feature-isolated; startup snapshots are bounded and KV preserves exact keys, prefixes, continuation and expiry rules.

Feature proof passes 38 celld cases, independent settings/config/KV suites, 478 Axum unit, 6 mixed AWS startup and 4 celld startup cases, CLI/isolation/runner checks and scoped strict Clippy. Independent provider source review found no confirmed defect. Lower namespace/CI fixes are merged and all five locked fetches pass.

Ordinary KV is not conditional create/CAS/atomic RMW or identity-allocation qualification. The separate record API follow-on is not included here. Prepared celld KV does not prove runtime connectivity/grants, and snapshots are not atomic across documents. Matching-service/generated runtime proofs remain separate gates.

Draft pending fresh hosted checks and the combined RC audit. Two unchanged native default-parallel deadline misses remain recorded and unclassified; serial passes and untouched-foundation parallel passes do not clear them. No timing bound was relaxed. No deployment, main merge, security-alert dismissal or review-thread resolution occurred. Historical design/review context follows.

---

Summary

• Add native celld configuration snapshots and live KV through a scoped API embedded inside celld, with independent default-off config/KV features.
• Preserve portable store traits and native startup ordering, with separate AWS/celld policies, credentials, accounting and actual-variant preparation sessions.
• Add bounded transport/fault tests, public-runner and generated-consumer proofs, structural-only CLI support, documentation and CI checks.

Changes

Crate / File	Change
edgezero-store-celld	Strict settings, redacted explicit tokens, bounded HTTP/TLS client, immutable config snapshots and live KV. No celld runtime or V8 dependency.
edgezero-adapter-axum	Per-ID typed bindings, once-only selected token capture, independent provider policies/capabilities and existing readiness/staging integration.
edgezero-cli and generated Axum manifest	Independent feature forwarding, structural-only validation with availability unknown, and selected remote config-push refusal.
Tests, scripts and CI	Feature-isolation checks, TLS/proxy/no-replay fault tests, mixed AWS/celld/local startup, generated consumers and explicit local-service acceptance.
Consumer lockfiles	Refresh settings-only provider edges for the excluded demo and reusable-app workspaces without registry version changes.
Documentation	Native celld guide, reviewed spec/plan and exact local verification evidence with remaining gaps.

Closes

Closes #437.

Related to #410 and stacked on #414. This is store-provider work, not the celld HTTP runtime adapter in #421.

Dependencies and draft status

• Base branch: issue-410-native-store-providers, currently draft Add native AWS store providers #414.
• Requires the unreleased embedded celld scoped API at f72ae21a515859570622ac9d6ca9c19cf6870b81. The companion celld branch remains local and has not been published by this PR.
• No gateway, sidecar, Worker bridge, celld secret provider or portable core trait changes.
• Fleet forwarding/reload/failover, production deployment isolation, replication/storage acceptance, upgrades and sustained fault/shutdown stress remain open. The generated TLS and disposable namespace-isolation proofs are separate arrangements.
• A real-service CI job remains deferred until a reviewed service artifact is available. Missing prerequisites fail the explicit local harness instead of passing by skipping.

Test plan

• cargo test --workspace --all-targets: 2,028 passed, 6 ignored. Ignored acceptance tests listed below were explicitly selected separately.
• cargo clippy --workspace --all-targets --all-features -- -D warnings, with focused Clippy follow-ups for the final test-only additions.
• cargo fmt --all -- --check and git diff --check.
• cargo check --workspace --all-targets --features "fastly cloudflare spin".
• All provider WASM target builds. Spin wasm32-wasip2 check passed; full Fastly and Cloudflare target builds were not executed.
• examples/app-demo full workspace tests. Both excluded consumer lockfiles passed offline locked metadata validation; reusable fixture-axum check passed.
• Docs lint, format and site build.
• Manual edgezero serve --adapter axum. Production-runner and generated native binaries were exercised instead.
• Provider settings/config/KV/combined suites: 4 / 27 / 30 / 38 passed, with independent feature Clippy checks.
• Native feature matrices, 253 combined native units, 4 celld startup subprocess tests, and 6 mixed/AWS startup tests. AWS-only startup also passed all 5 existing cases.
• Generated celld target with neither feature, each feature alone, both, and both alongside all AWS provider features.
• Real generated app against modified celld over verified TLS: binary/empty KV, pagination, 61-second expiry, immutable config adoption and persistence across app/celld restarts.
• Disposable user/network/mount/PID namespace proof for scoped access, internal-listener denial, hidden service files and server procfs isolation.
• Existing generated AWS and DynamoDB proofs, dependency feature-isolation checks, and 24 integration-runner Node tests.

All Cargo verification used offline locked dependencies after reviewed lockfile updates. The workspace test runner needed stdin closed because existing consent tests assume noninteractive CI. No test was excluded to resolve that run.

The real-service command requires an explicit modified binary and uses only disposable state and dummy credentials:

CELLD_BIN=/absolute/path/to/modified/celld \
EDGEZERO_GENERATED_TEST_TARGET_DIR=/absolute/path/to/disposable-build-cache \
node scripts/run_native_celld_integration.mjs

The implementation plan records the tested source/binary fingerprints and proof limits. No real AWS/fleet credentials or production deployment were used.

Checklist

• Changes follow CLAUDE.md conventions.
• No new direct Tokio dependencies in core or adapter crates; native transport lives in the provider crate.
• No legacy route-param syntax introduced.
• Application handlers use edgezero_core types.
• Store wiring uses the existing typed registries and staging path.
• New behavior has tests.
• No production secrets or credentials committed. The checked-in DER key/certificates and token strings are public, disposable fixture material only.