DO NOT MERGE: Axum integration RC

.claude/agents/code-architect.md

@@ -16,7 +16,7 @@ architectural principles:
 
 3. **Thin adapters**: each adapter translates platform types to/from core types.
    Business logic never lives in adapters. The adapter file structure is:
-   `context.rs`, `request.rs`, `response.rs`, `proxy.rs`, `logger.rs`, `cli.rs`.
+   `context.rs`, `request.rs`, `response.rs`, `outbound.rs`, `logger.rs`, `cli.rs`.
 
 4. **Contract testing**: every adapter has `tests/contract.rs` that validates
    request/response mapping. New adapters must follow this pattern.

.claude/commands/check-ci.md

@@ -1,8 +1,10 @@
-Run the full CI gate checks locally before pushing. Run all four commands sequentially and report any failures:
+Run the full CI gate checks locally before pushing. Run the commands below sequentially and report any failures:
 
 1. `cargo fmt --all -- --check`
 2. `cargo clippy --workspace --all-targets --all-features -- -D warnings`
 3. `cargo test --workspace --all-targets`
-4. `cargo check --workspace --all-targets --features "fastly cloudflare"`
+4. `cargo test -p edgezero-core --doc`
+5. `cargo check --workspace --all-targets --features "fastly cloudflare spin"`
+6. `cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin`
 
 If any step fails, show the errors and suggest fixes. Do not proceed to the next step until the current one passes.

.gitattributes

@@ -0,0 +1,2 @@
+# Unified patches contain single-space context lines; check whitespace in the applied source.
+patches/viceroy/*.patch -whitespace

.github/actions/deploy-core/tests/run.sh

@@ -2795,8 +2795,8 @@ test_fastly_logical_link_documentation() {
     grep -Fq -- '--service-id "$FASTLY_SERVICE_ID"' "$fastly_deployment"
   assert_fails "Fastly managed deployment does not recommend direct provider deployment" \
     grep -Fq 'fastly compute deploy' "$fastly_deployment"
-  assert_succeeds "bare Fastly deploy is explicitly store-free production compatibility" \
-    grep -Fq 'store-free production compatibility' "$fastly_deployment_flat"
+  assert_succeeds "bare Fastly deploy is explicitly limited to store-free production" \
+    grep -Fq 'supports store-free production deployments using a manifest command' "$fastly_deployment_flat"
 
   # shellcheck disable=SC2016 # GitHub expression is the literal documentation contract.
   assert_fails "lifecycle examples do not reference a cross-job archive path output" \

.github/dependabot.yml

@@ -11,10 +11,32 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 7
+    groups:
+      audited-decoders:
+        patterns:
+          - "alloc-no-stdlib"
+          - "alloc-stdlib"
+          - "adler2"
+          - "async-compression"
+          - "brotli"
+          - "brotli-decompressor"
+          - "compression-codecs"
+          - "compression-core"
+          - "crc32fast"
+          - "flate2"
+          - "miniz_oxide"
+          - "simd-adler32"
 
   - package-ecosystem: "npm" # See documentation for possible values
     directory: "docs/" # Location of package manifests
     schedule:
       interval: "weekly"
     cooldown:
       default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/scripts"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/axum-container.yml

@@ -0,0 +1,244 @@
+name: Axum container preparation
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - .github/actions/deploy-core/tests/check-action-pins.sh
+      - .github/zizmor.yml
+      - scripts/install-actionlint.sh
+      - scripts/install-yq.sh
+      - .github/workflows/axum-container.yml
+      - Cargo.toml
+      - Cargo.lock
+      - .tool-versions
+      - crates/**
+      - examples/app-demo/**
+      - examples/container-publishing/**
+      - examples/axum-deployment/**
+      - scripts/*axum_container*.sh
+      - scripts/axum_container*.mjs
+      - scripts/package*.json
+      - scripts/tests/*axum_container*.mjs
+  push:
+    branches: [main]
+    paths:
+      - .github/actions/deploy-core/tests/check-action-pins.sh
+      - .github/zizmor.yml
+      - scripts/install-actionlint.sh
+      - scripts/install-yq.sh
+      - .github/workflows/axum-container.yml
+      - Cargo.toml
+      - Cargo.lock
+      - .tool-versions
+      - crates/**
+      - examples/app-demo/**
+      - examples/container-publishing/**
+      - examples/axum-deployment/**
+      - scripts/*axum_container*.sh
+      - scripts/axum_container*.mjs
+      - scripts/package*.json
+      - scripts/tests/*axum_container*.mjs
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # Keep validator versions paired with .github/workflows/deploy-action.yml.
+  ACTIONLINT_VERSION: 1.7.7
+  ZIZMOR_VERSION: 1.16.3
+  YQ_VERSION: 4.53.3
+
+jobs:
+  static-checks:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install pinned validation binaries
+        run: |
+          bin="$RUNNER_TEMP/tools/bin"
+          mkdir -p "$bin"
+          INSTALL_DIR="$bin" scripts/install-actionlint.sh "$ACTIONLINT_VERSION"
+          INSTALL_DIR="$bin" scripts/install-yq.sh "$YQ_VERSION"
+          cargo install zizmor --version "$ZIZMOR_VERSION" --locked --root "$RUNNER_TEMP/tools"
+          "$bin/actionlint" -version | grep -qF "$ACTIONLINT_VERSION"
+          "$bin/yq" --version | grep -qF "version v$YQ_VERSION"
+          "$bin/zizmor" --version | grep -qF "$ZIZMOR_VERSION"
+          printf '%s\n' "$bin" >>"$GITHUB_PATH"
+
+      - name: Install ShellCheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+
+      - name: Validate the inactive application release recipe
+        run: |
+          "$RUNNER_TEMP/tools/bin/actionlint" -shellcheck='shellcheck -S warning' examples/container-publishing/release.yml
+          .github/actions/deploy-core/tests/check-action-pins.sh examples/container-publishing/release.yml
+          "$RUNNER_TEMP/tools/bin/zizmor" --offline examples/container-publishing/release.yml
+
+      - name: ShellCheck Axum container scripts
+        run: shellcheck -e SC1091 scripts/*axum_container*.sh examples/container-publishing/publish.sh
+
+  prepare:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version-file: .tool-versions
+      - name: Use the declared Rust toolchain
+        run: |
+          version=$(awk '$1 == "rust" { print $2 }' .tool-versions)
+          rustup toolchain install "$version" --profile minimal
+          echo "RUSTUP_TOOLCHAIN=$version" >> "$GITHUB_ENV"
+      - name: Install framework helper dependencies
+        run: npm ci --prefix scripts --ignore-scripts
+      - name: Prepare one application and lockfile
+        run: |
+          ./scripts/prepare_generated_axum_container.sh "$RUNNER_TEMP/fixture"
+          AXUM_PREPARED_CONTEXT="$RUNNER_TEMP/fixture/container-probe" \
+            node --test scripts/tests/test_axum_container*.test.mjs
+          tar -C "$RUNNER_TEMP/fixture" -cf "$RUNNER_TEMP/context.tar" container-probe
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: axum-context-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/context.tar
+          if-no-files-found: error
+          retention-days: 7
+
+  native:
+    needs: prepare
+    timeout-minutes: 30
+    # Framework packaging evidence is not application release approval.
+    env:
+      SCAN_POLICY: report-only
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version-file: .tool-versions
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: axum-context-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/context
+          digest-mismatch: error
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        with:
+          version: v0.37.0
+          # Reuse the daemon; the handoff helper creates the pinned build instance.
+          driver: docker
+          use: false
+      - name: Install framework helper dependencies
+        run: npm ci --prefix scripts --ignore-scripts
+      - name: Native image, packaging, scan and OCI identity checks
+        env:
+          ARCH: ${{ matrix.arch }}
+        run: |
+          tar -C "$RUNNER_TEMP/context" -xf "$RUNNER_TEMP/context/context.tar" --no-same-owner
+          ./scripts/test_axum_container_handoff.sh build \
+            "$RUNNER_TEMP/context/container-probe" "$RUNNER_TEMP/accepted" \
+            "linux/$ARCH" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: accepted-${{ matrix.arch }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/accepted/image.tar
+            ${{ runner.temp }}/accepted/receipt.json
+            ${{ runner.temp }}/accepted/inputs.json
+            ${{ runner.temp }}/accepted/scan.json
+            ${{ runner.temp }}/accepted/scanner.json
+            ${{ runner.temp }}/accepted/sbom.json
+            ${{ runner.temp }}/accepted/provenance.json
+            ${{ runner.temp }}/accepted/rust-advisories.json
+          if-no-files-found: error
+          retention-days: 7
+      - name: Retain sanitized failure evidence separately
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: failed-${{ matrix.arch }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/accepted/*.log
+            ${{ runner.temp }}/accepted/scan.json
+            ${{ runner.temp }}/accepted/scanner.json
+            ${{ runner.temp }}/accepted/image.json
+            ${{ runner.temp }}/accepted/inputs.json
+            ${{ runner.temp }}/accepted/rust-advisories.json
+            ${{ runner.temp }}/accepted/smoke
+            ${{ runner.temp }}/accepted/compose
+          if-no-files-found: warn
+          retention-days: 7
+
+  handoff:
+    needs: [static-checks, native]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      SCAN_POLICY: report-only
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version-file: .tool-versions
+      - name: Select exact immutable artifacts from this run and attempt
+        id: artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=100" \
+            | jq '{artifacts: [.[].artifacts[]]}' > "$RUNNER_TEMP/artifacts.json"
+          ids=$(node examples/container-publishing/verify_artifacts.mjs artifact-ids \
+            "$RUNNER_TEMP/artifacts.json" --run-id "$GITHUB_RUN_ID" --attempt "$GITHUB_RUN_ATTEMPT")
+          echo "ids=$ids" >> "$GITHUB_OUTPUT"
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          artifact-ids: ${{ steps.artifacts.outputs.ids }}
+          path: ${{ runner.temp }}/bundles
+          digest-mismatch: error
+      - name: Import accepted variants in a separate job without rebuilding
+        run: |
+          for arch in amd64 arm64; do
+            ./scripts/test_axum_container_handoff.sh import \
+              "$RUNNER_TEMP/bundles/accepted-$arch-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+              "$RUNNER_TEMP/import-$arch" "linux/$arch" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          done
+      - name: Assemble and verify a localhost runtime index without external publication
+        run: |
+          source examples/container-publishing/tools.env
+          registry="axum-index-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          trap 'docker rm -f "$registry" >/dev/null 2>&1 || true' EXIT
+          docker run -d --name "$registry" -p 127.0.0.1::5000 "$REGISTRY_IMAGE"
+          port=$(docker port "$registry" 5000/tcp | awk -F: '{print $NF}')
+          for _ in $(seq 1 30); do curl --fail --silent "http://127.0.0.1:$port/v2/" && break; sleep 1; done
+          curl --fail --silent "http://127.0.0.1:$port/v2/" >/dev/null
+          ./examples/container-publishing/publish.sh "127.0.0.1:$port/fixture" fixture \
+            "$RUNNER_TEMP/bundles/accepted-amd64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+            "$RUNNER_TEMP/bundles/accepted-arm64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+            "$RUNNER_TEMP/index" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"

.github/workflows/codeql.yml

@@ -15,7 +15,6 @@ on:
   push:
     branches: ["main"]
   pull_request:
-    branches: ["main"]
   schedule:
     - cron: "40 17 * * 3"
 

.github/workflows/deploy-action.yml

@@ -49,6 +49,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
+  # Keep validator versions paired with .github/workflows/axum-container.yml.
   ACTIONLINT_VERSION: 1.7.7
   ZIZMOR_VERSION: 1.16.3
   YQ_VERSION: 4.53.3