Repository navigation
Conversation
Empty tracking commit for the implementation work tracked in: docs/superpowers/plans/2026-06-27-provision-local.md Issues: - Epic: <epic-issue-url> - Per-section sub-issues linked from the epic. This PR opens as a DRAFT and stays draft until Section 1 lands its first real commit. Each section opens as its own follow-up PR that lands here before the umbrella merges to main.
This was referenced Jun 29, 2026
run_shared_checks iterates every declared adapter and dispatches validate_adapter_manifest, which for Spin does fs::read_to_string(manifest_root.join(rel)). With the containment guard sitting after run_shared_checks, a manifest declaring [adapters.spin.adapter].manifest = "../outside/spin.toml" could trigger a filesystem read outside the project root before the guard rejected it — a spec violation of §"Path containment (MUST)" which requires the helper run BEFORE any manifest-path use. Fix by relocating the check to fire immediately after load_push_context, and looping over every declared adapter (not just ctx.adapter) since run_shared_checks reads all of them. Also close Task 7's Minor about the duplicate adapter_entry call by removing the now-redundant per-adapter guard block. Regression test: config_push_local_rejects_parent_traversal_in_ sibling_spin_adapter declares a poisoned Spin adapter alongside the pushed axum adapter, and asserts the error names the containment violation (not Spin's "failed to read spin manifest" message that would surface under the old ordering). Also tighten copy_tree's else-branch to explicitly gate on is_regular_file() rather than "everything non-dir non-symlink", add a Unix symlink-skip test, and drop a stale #[expect(dead_code)] on ValidationContext::manifest_path that now has real callers.
…to feature/provision-local-impl
The bare-cwd variant of the accept-test (--manifest edgezero.toml)
previously wrote the manifest to a tempdir and set EDGEZERO_MANIFEST,
but run_provision reads args.manifest directly (no env fallback).
The test therefore failed on manifest load ("failed to load
edgezero.toml") and its negative !contains(path-safety-markers)
assertion vacuously passed — no actual coverage of the
`args.manifest.parent() == ""` fallback.
Fix by adding a CwdGuard RAII helper that chdirs into the tempdir
under the manifest_guard() serialisation lock and restores the
previous cwd on drop. Both accept-tests now also assert positively
that the error is the (true, true) dispatch stub ("local dry-run
staging lands in Task 10/11"), proving the manifest loaded AND
path-safety passed AND we reached the dispatch matrix. Drop the
now-unnecessary EnvOverride from both tests.
Reviewer: reviewer of Task 9 pushed this as a Low ahead of Task 10
because run_with_staging depends on manifest-root/cwd correctness.
ChristianPavilonis
requested changes
Nov 6, 2026
ChristianPavilonis
left a comment
ChristianPavilonis
left a comment
Collaborator
There was a problem hiding this comment.
Summary
Adds local provisioning, generated adapter manifests, and shared CLI path and environment handling. Two reproduced path-resolution defects remain: stale WASM packaging with a relative Cargo home and an incorrect nested Cloudflare entrypoint for root crates.
Reviewed head 80b94804ee856041ef5a6fd9ff7a5ec69545d22f against merge base 87456c708ffe9edf86b3a0f8b06dfd15d60b07b5 with target main.
Both inline comments carry a one-click GitHub
suggestion. Use Commit suggestion or Add suggestion to batch to apply the proposed replacements.
Blocking
🔧 wrench
- R1. Relative
CARGO_HOMEcan package stale WASM. See inline atcrates/edgezero-adapter/src/cli_support.rs:193. - R2. Root Cloudflare crates get an incorrect nested entrypoint. See inline at
crates/edgezero-adapter-cloudflare/src/cli/run.rs:253-258.
Verification and scope
Each suggestion passed independently against the reviewed head, then both passed together. The approved patches stayed byte-identical throughout verification. Checks:
cargo fmt --all -- --check: PASS.cargo clippy --locked --workspace --all-targets --all-features -- -D warnings: PASS.cargo test --locked --workspace --all-targets: PASS.cargo check --locked --workspace --all-targets --features "fastly cloudflare spin": PASS.cargo check --locked -p edgezero-adapter-spin --target wasm32-wasip2 --features spin: PASS.cargo build --locked -p edgezero-cli: PASS.- R1 runtime probe using actual Cargo: the packaged WASM matched the fresh build output rather than the seeded stale artifact.
- R2 runtime probe: both root-crate spellings generated the correct entrypoint; actual Wrangler 4.151.3 passed
deploy --dry-run, using a worker-build stub that emits the shim at the crate-root output path.
The initial focused provisioning suite passed 293 tests; bash scripts/lib/smoke_backup_test.sh passed 50 assertions. Review depth focused on changed provisioning and execution behavior. Large mechanical module moves and unchanged test bodies were not all re-audited line by line. Live cloud mutations and deployments were not exercised locally.
CI Status
- cargo test: PASS (required).
- recovery-smoke: PASS.
- config-push-smoke: PASS.
- staging-smoke: PASS.
- production-smoke: PASS.
- store-free-deploy-smoke: PASS.
- fastly wasm tests: PASS (required).
- app-demo tests: PASS.
- workspace tests: PASS.
- cli tests: PASS.
- spin wasm tests: PASS (required).
- axum tests: PASS.
- cloudflare wasm tests: PASS (required).
- CodeQL: PASS.
- cache-new-revision-smoke: PASS.
- cache-restore-smoke: PASS.
- fastly wasm clippy: PASS (required).
- fixture-release: PASS.
- format-docs: PASS (required).
- store-free-release: PASS.
- Analyze (actions): PASS.
- spin wasm clippy: PASS (required).
- cloudflare wasm clippy: PASS (required).
- cache-restore-seed: PASS.
- static-checks: PASS.
- Analyze (javascript-typescript): PASS.
- Analyze (rust): PASS.
- cargo fmt: PASS (required).
This was referenced Nov 9, 2026
Collaborator
Author
|
Latest review feedback is addressed in d5c810a5. Current head is d62a1512, including the conflict-free update from main.
Verification on the final tree: 27/27 local gates passed, including workspace tests, strict Clippy, minimal-feature builds, all three WASM targets, generated-project native/WASM compilation, app-demo, smoke cleanup, and the expanded cache-action/static workflow checks. GitHub reports 29/29 checks successful, including CodeQL; all four workflows succeeded. Executed runtime evidence includes 36/36 real-Cargo packaging cases, 42 public synthesis layouts, typed/untyped real/dry-run provisioning, and 28/28 real Wrangler deployment dry-runs across two versions. A live local-dev source edit triggered rebuilding after the fix; it did not before. Authenticated cloud deployment and Windows execution were not performed. Independent artifact, Cloudflare/runtime, adjacent-surface, and final integration audits supported the minimal fix: shared Cargo resolution stays in adapter support, and Wrangler behavior stays in the Cloudflare adapter. Production CLI dispatch remains provider-neutral. Both inline replies were read back and verified. Ready for maintainer re-review; the existing changes-requested review remains in place. |
aram356
commented
Nov 11, 2026
aram356
left a comment
aram356
left a comment
Collaborator
Author
There was a problem hiding this comment.
REVIEWER: REQUEST_CHANGES — GitHub blocked this review event: Could not request_changes for pull request review. Can not request changes on your own pull request (HTTP 422). The acting account (aram356) is the PR author, so this is submitted as a COMMENT review that carries the REQUEST_CHANGES verdict. It is not an approval, and the PR is not merge-ready.
Reviewed head d62a151259957b9bc4f62935b785a4267a68bb1a against merge base cf2c57b1cf0e139d3b86f128218c798027d7978b. The PR body has no PRfection phase: marker, so I reviewed it as the implementation of the 2026-06-23 spec and the 2026-06-27 plan it links.
I started at 80b94804, and the head moved to d62a1512 during the review. The new commit d5c810a5 changes only lines below every anchor here, and the merge from main touches only CI files. I re-ran the full suite, the probes and the anchors at d62a1512.
Verdict
Changes are needed: 2 blocking, 25 should-fix and 7 nit findings, each in its own inline thread.
Blocking:
crates/edgezero-cli/src/provision.rs:1421: dry-run redaction prints secret text from commented or malformed.env/.dev.varslines.docs/superpowers/specs/2026-10-19-adapter-owned-cli-design.md:1: the adapter-owned CLI redesign is outside the approved plan and isn't disclosed on the PR.
Existing threads
-
ChristianPavilonis's two open findings from Nov 6 now have author replies citing
d5c810a5:- R1, relative
CARGO_HOME: #287 (comment) - R2, Cloudflare root-crate entrypoint: #287 (comment)
I read the commit:
- R1 now resolves
CARGO_HOMEagainst the crate dir and treats an empty value as unset. - R2 strips one leading
.from both paths before comparing them, and adds a matchingwatch_dir.
The new tests pass in the suite below. Both threads belong to ChristianPavilonis, so I left them open. The replies carry no
CREATOR:label, so under PRfection they don't count as dispositions yet. - R1, relative
-
The resolved Cloudflare namespace-id thread was later reversed in code; details are in the CHANGELOG thread.
Full suite at d62a1512
I ran this in a detached worktree at the head SHA. Host-test steps ran with fastly, wrangler and spin removed from PATH, as on the CI host runners. Every step exited 0.
63 steps: commands, exit codes and result lines
| ID | Command | Exit | Result line |
|---|---|---|---|
| P00 | for b in fastly wrangler spin; do if command -v "$b"; then echo "LEAK $b"; exit 1; fi; done; echo "no fastly/wrangler/spin on host PATH" |
0 | no fastly/wrangler/spin on host PATH |
| G01 | cargo fmt --all -- --check |
0 | (no output; exit code only) |
| G02 | cargo clippy --workspace --all-targets --all-features -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 25.36s |
| G03 | cargo test --workspace --all-targets |
0 | 23 test result: lines, all ok: 2013 passed, 0 failed, 1 ignored |
| G04 | cargo check --workspace --all-targets --features "fastly cloudflare spin" |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 15.62s |
| G05 | cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 12.24s |
| S01 | ./scripts/check_no_placeholder_pins.sh |
0 | check_no_placeholder_pins: OK |
| S02 | ./scripts/check_no_legacy_typed_reads.sh |
0 | check_no_legacy_typed_reads: OK |
| S03 | ./scripts/check_shared_dep_pins.sh && bash scripts/test_shared_dep_pins.sh |
0 | PASS worker-build unrelated-section |
| S04 | if git ls-files | grep -E '(^|/)(axum|fastly|spin|wrangler|runtime-config)\.toml$|(^|/)\.dev\.vars$|(^|/)\.env$' | grep -Ev '^tests/fixtures/request-fidelity/(fastly|spin|wrangler)\.toml$'; then echo TRACKED; exit 1; fi; echo "no tracked adapter manifests or env files" |
0 | no tracked adapter manifests or env files |
| S05 | for probe in crates/demo/axum.toml crates/demo/wrangler.toml crates/demo/fastly.toml crates/demo/spin.toml crates/demo/runtime-config.toml crates/demo/.dev.vars crates/demo/.env .edgezero/.env; do git check-ignore -q "$probe" || { echo "NOT IGNORED $probe"; exit 1; }; done; echo "all probes ignored" |
0 | all probes ignored |
| S06 | shellcheck -x --severity=warning scripts/*.sh scripts/lib/*.sh && echo shellcheck-clean |
0 | shellcheck-clean |
| S07 | bash scripts/lib/smoke_backup_test.sh |
0 | smoke_backup_test: 50 passed, 0 failed |
| S08 | cargo fmt --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --all -- --check |
0 | (no output; exit code only) |
| S09 | cargo test --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --locked |
0 | test result: ok. 20 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 1.25s |
| S10 | cargo clippy --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 9.68s |
| S11 | cargo test --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core |
0 | 3 test result: lines, all ok: 26 passed, 0 failed, 0 ignored |
| C01 | cargo run -q --bin check_no_nested_app_config --features nested-app-config-check -- examples/app-demo crates/edgezero-cli/src/templates |
0 | check_no_nested_app_config: OK |
| C02 | cargo test -p edgezero-cli --features nested-app-config-check --bin check_no_nested_app_config |
0 | test result: ok. 18 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s |
| C03 | cargo check -p edgezero-cli --bin check_no_nested_app_config --no-default-features --features nested-app-config-check |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 10.14s |
| C04 | cargo clippy -p edgezero-cli --lib --no-default-features -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 10.18s |
| C05 | cargo clippy -p edgezero-cli --bin check_no_nested_app_config --no-default-features --features nested-app-config-check -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 9.96s |
| C06 | cargo clippy -p edgezero-cli --all-targets --no-default-features --features cli -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 9.14s |
| C07 | cargo test -p edgezero-cli --all-targets |
0 | 5 test result: lines, all ok: 366 passed, 0 failed, 1 ignored |
| C08 | cargo test -p edgezero-adapter-axum -p edgezero-adapter-cloudflare -p edgezero-adapter-fastly -p edgezero-adapter-spin --all-targets --no-default-features --features cli |
0 | 8 test result: lines, all ok: 781 passed, 0 failed, 0 ignored |
| C09 | cargo test -p edgezero-cli --test generated_project_builds -- --ignored |
0 | test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 113.56s |
| A01 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-axum |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 20.70s |
| A02 | cargo test -p edgezero-adapter-axum --all-targets --features axum |
0 | test result: ok. 128 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.88s |
| D01 | cd examples/app-demo && cargo fmt --all -- --check |
0 | (no output; exit code only) |
| D02 | cd examples/app-demo && cargo clippy --workspace --all-targets --all-features -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 38.37s |
| D03 | cd examples/app-demo && cargo test --locked --workspace --all-targets |
0 | 9 test result: lines, all ok: 33 passed, 0 failed, 0 ignored |
| F01 | cargo fmt --manifest-path tests/fixtures/reusable-app/Cargo.toml --all -- --check |
0 | (no output; exit code only) |
| F02 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core -p fixture-axum --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 22.54s |
| F03 | cargo clippy -p edgezero-adapter-fastly --features cli --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 3.87s |
| F04 | cargo clippy -p edgezero-adapter-fastly --no-default-features --lib -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 2.92s |
| W01 | cargo clippy -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 5.53s |
| W02 | cargo clippy -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 4.97s |
| W03 | cargo clippy -p edgezero-adapter-fastly --features "fastly cli" --target wasm32-wasip1 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 2.87s |
| W04 | cargo clippy -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 3.54s |
| W05 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-cloudflare --target wasm32-unknown-unknown --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 19.50s |
| W06 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-fastly --target wasm32-wasip1 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 7.35s |
| W07 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-spin --target wasm32-wasip2 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 12.07s |
| X01 | cargo check -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 4.47s |
| X02 | cargo check -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 1.60s |
| X03 | cargo check -p edgezero-adapter-spin --features spin --target wasm32-wasip2 |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.21s |
| X04 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-cloudflare --target wasm32-unknown-unknown --all-targets |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 1.12s |
| X05 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-fastly --target wasm32-wasip1 --all-targets |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.95s |
| X06 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-spin --target wasm32-wasip2 --all-targets |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.41s |
| X07 | viceroy --version && CARGO_TARGET_WASM32_WASIP1_RUNNER="viceroy run" cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --test contract |
0 | test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s |
| X08 | CARGO_TARGET_WASM32_WASIP1_RUNNER="viceroy run" cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --lib |
0 | test result: ok. 97 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.20s |
| X09 | wasmtime --version && CARGO_TARGET_WASM32_WASIP2_RUNNER="wasmtime run" cargo test -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --test contract |
0 | test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s |
| X10 | cargo fmt --manifest-path tests/fixtures/request-fidelity/Cargo.toml --all -- --check |
0 | (no output; exit code only) |
| X11 | cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features fastly --target wasm32-wasip1 --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 15.33s |
| X12 | cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features spin --target wasm32-wasip2 --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 15.91s |
| X13 | cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features cloudflare --target wasm32-unknown-unknown --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 21.18s |
| N01 | cd docs && npm ci --no-audit --no-fund && npm run lint && npm run format |
0 | All matched files use Prettier code style! |
| R01 | ./scripts/test-request-fidelity.sh fastly |
0 | Finished release profile [optimized] target(s) in 17.95s |
| R02 | ./scripts/test-request-fidelity.sh spin |
0 | Finished release profile [optimized] target(s) in 19.04s |
| R03 | ./scripts/smoke_test_reusable_app.sh --adapter fastly --suite smoke |
0 | {"evidence":"/Users/ag/projects/stackpop/prebid/edgezero/.worktrees/review-287-d62a151/tests/fixtures/reusable-app/.runs/18e6de21403c5098-19f1-0","exit_code":0} |
| Z01 | git status --porcelain --untracked-files=normal; echo "--- (end of untracked/modified, ignored files excluded)" |
0 | --- (end of untracked/modified, ignored files excluded) |
| Y01 | '/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasmtime-x/wasmtime-v48.0.1-aarch64-macos/wasmtime' --version && CARGO_TARGET_WASM32_WASIP2_RUNNER='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasmtime-x/wasmtime-v48.0.1-aarch64-macos/wasmtime run' cargo test -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --test contract |
0 | test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s |
| Y02 | '/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasm-bindgen/bin/wasm-bindgen-test-runner' --version && CHROMEDRIVER='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/cft/chromedriver/mac_arm-157.0.8103.39/chromedriver-mac-arm64/chromedriver' WASM_BINDGEN_TEST_WEBDRIVER_JSON='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/webdriver.json' CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasm-bindgen/bin/wasm-bindgen-test-runner' cargo test -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --test contract |
0 | test result: ok. 13 passed; 0 failed; 0 ignored; 0 filtered out; finished in 0.04s |
| Y03 | WASM_BINDGEN_BIN='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasm-bindgen/bin/wasm-bindgen' ./scripts/test-request-fidelity.sh cloudflare |
0 | Finished release profile [optimized] target(s) in 29.23s |
Local tool versions:
- Viceroy 0.21.0 and wasmtime 48.0.1, matching
.tool-versions. - wasm-bindgen-test-runner 0.2.128 and worker-build 0.8.5, matching the lockfile and the fixture pin.
- Spin 4.1.0.
- Chrome 157.0.8103.39 with a matching chromedriver; CI pins Chrome 154.0.8037.92.
GitHub CI at d62a1512 reports all 28 checks passing. That is CI's run, not mine.
Not verified
- Authenticated cloud operations: Fastly, Cloudflare and Fermyon Cloud provision, push and deploy.
- Windows path handling.
- Whether Viceroy accepts
env = "<KEY>"secret-store entries. - Whether Fastly CLI 16 writes
service_idinto the--envmanifest on first deploy.
Collaborator
Author
|
CREATOR: Planning-scope and authorization record for d590f0e. The task user explicitly directed: “i am ok with that but I want to make sure each adapter is responsible for its own cli .. cli crate should not switch on adapter types”, then authorized the fixes and this PRfection feedback cycle. This records the direct authorization for the adapter-owned boundary; it is not an independent approval of every implementation detail. The October design and October implementation plan were introduced on this branch in 522ae79 and implemented in ddb3306. They extend the June provision-local artifacts, originally landed on main in e483723 (#269) and amended in f717674 (#381). The current June specification now states the implemented boundary. The current feedback plan records this repair cycle. The scope includes adapter-owned The prior PR-body claim that both designs had independent sign-off before implementation was unsupported and is withdrawn. REVIEWER: please explicitly assess and accept or reject this planning scope alongside the implementation during re-review. Acting account: |
Collaborator
Author
|
CREATOR: Full verification record for CREATOR executed the frozen full-suite harness from the adopted CREATOR worktree at this exact pushed head. The build-verification subagent independently checked that the runner/config retained every prescribed command and audited the live logs, final state and cleanup. Linux CI below was run by GitHub Actions. 77/77 commands exited 0; no failed or blocked command groups. Source was clean at start and completion, and the head remained unchanged. All commands below retain actual exit codes and verbatim result lines. Commands run from the worktree root unless a cwd is given. Machine-specific executable paths are displayed as pinned tool names or repository-relative paths; the complete original argv/output remains in the retained private verification report. No source/test/CI weakening was used. Relevant per-thread replies also quote the exact portable command and named successful regressions. The local deploy harness reported
The generated-project host ignore was executed explicitly (
Complete prescribed-suite command/result recordtool-pin-preflight — cwd python3 ../../../.git/worktrees/pr-287-nov02/prfection-review287/final-d590f0eb-independent/tools/verify-pins.py01-fmt — cwd cargo fmt --all -- --check02-clippy — cwd cargo clippy --workspace --all-targets --all-features --target-dir ../../../target -- -D warnings03-test — cwd cargo test --workspace --all-targets --target-dir ../../../target04-feature-check — cwd cargo check --workspace --all-targets --features 'fastly cloudflare spin' --target-dir ../../../target05-spin-check — cwd cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin --target-dir ../../../targetplaceholder-pins — cwd bash scripts/check_no_placeholder_pins.shlegacy-reads — cwd bash scripts/check_no_legacy_typed_reads.shshared-pins — cwd bash scripts/check_shared_dep_pins.shshared-pin-tests — cwd bash scripts/test_shared_dep_pins.shsmoke-backup-tests — cwd bash scripts/lib/smoke_backup_test.shsmoke-shellcheck — cwd bash -c 'shellcheck -x --severity=warning scripts/*.sh scripts/lib/*.sh'nested-audit — cwd cargo run -q --bin check_no_nested_app_config --features nested-app-config-check --target-dir ../../../target -- examples/app-demo crates/edgezero-cli/src/templatesnested-checker-tests — cwd cargo test -p edgezero-cli --features nested-app-config-check --bin check_no_nested_app_config --target-dir ../../../targetstandalone-nested-check — cwd cargo check -p edgezero-cli --bin check_no_nested_app_config --no-default-features --features nested-app-config-check --target-dir ../../../targetstandalone-lib-clippy — cwd cargo clippy -p edgezero-cli --lib --no-default-features --target-dir ../../../target -- -D warningsstandalone-checker-clippy — cwd cargo clippy -p edgezero-cli --bin check_no_nested_app_config --no-default-features --features nested-app-config-check --target-dir ../../../target -- -D warningsstandalone-cli-clippy — cwd cargo clippy -p edgezero-cli --all-targets --no-default-features --features cli --target-dir ../../../target -- -D warningscli-host-tests — cwd cargo test -p edgezero-cli --all-targets --target-dir ../../../targetadapter-cli-tests — cwd cargo test -p edgezero-adapter-axum -p edgezero-adapter-cloudflare -p edgezero-adapter-fastly -p edgezero-adapter-spin --all-targets --no-default-features --features cli --target-dir ../../../targetgenerated-projects — cwd cargo test -p edgezero-cli --test generated_project_builds --target-dir ../../../target -- --ignoredaxum-host-tests — cwd cargo test -p edgezero-adapter-axum --all-targets --features axum --target-dir ../../../targetfastly-cli-clippy — cwd cargo clippy -p edgezero-adapter-fastly --features cli --all-targets --target-dir ../../../target -- -D warningsfastly-default-clippy — cwd cargo clippy -p edgezero-adapter-fastly --no-default-features --lib --target-dir ../../../target -- -D warningsdemo-fmt — cwd cargo fmt --all -- --checkdemo-clippy — cwd cargo clippy --workspace --all-targets --all-features --target-dir ../../../../../target -- -D warningsdemo-test — cwd cargo test --locked --workspace --all-targets --target-dir ../../../../../targetrunner-fmt — cwd cargo fmt --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --all -- --checkrunner-test — cwd cargo test --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --locked --target-dir ../../../targetrunner-clippy — cwd cargo clippy --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --all-targets --locked --target-dir ../../../target -- -D warningslifecycle-fmt — cwd cargo fmt --manifest-path tests/fixtures/reusable-app/Cargo.toml --all -- --checklifecycle-host-test — cwd cargo test --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core --target-dir ../../../targetlifecycle-host-check — cwd cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-axum --target-dir ../../../targetlifecycle-host-clippy — cwd cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core -p fixture-axum --all-targets --target-dir ../../../target -- -D warningsingress-fmt — cwd cargo fmt --manifest-path tests/fixtures/request-fidelity/Cargo.toml --all -- --checkfastly-check — cwd cargo check -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --target-dir ../../../targetfastly-clippy — cwd cargo clippy -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --all-targets --target-dir ../../../target -- -D warningsfastly-cli-wasm-clippy — cwd cargo clippy -p edgezero-adapter-fastly --features 'fastly cli' --target wasm32-wasip1 --all-targets --target-dir ../../../target -- -D warningsfastly-lifecycle-check — cwd cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-fastly --target wasm32-wasip1 --all-targets --target-dir ../../../targetfastly-lifecycle-clippy — cwd cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-fastly --target wasm32-wasip1 --all-targets --target-dir ../../../target -- -D warningsfastly-ingress-clippy — cwd cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features fastly --target wasm32-wasip1 --all-targets --locked --target-dir ../../../target -- -D warningscloudflare-check — cwd cargo check -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --target-dir ../../../targetcloudflare-clippy — cwd cargo clippy -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --all-targets --target-dir ../../../target -- -D warningscloudflare-lifecycle-check — cwd cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-cloudflare --target wasm32-unknown-unknown --all-targets --target-dir ../../../targetcloudflare-lifecycle-clippy — cwd cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-cloudflare --target wasm32-unknown-unknown --all-targets --target-dir ../../../target -- -D warningscloudflare-ingress-clippy — cwd cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features cloudflare --target wasm32-unknown-unknown --all-targets --locked --target-dir ../../../target -- -D warningsspin-check — cwd cargo check -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --target-dir ../../../targetspin-clippy — cwd cargo clippy -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --all-targets --target-dir ../../../target -- -D warningsspin-lifecycle-check — cwd cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-spin --target wasm32-wasip2 --all-targets --target-dir ../../../targetspin-lifecycle-clippy — cwd cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-spin --target wasm32-wasip2 --all-targets --target-dir ../../../target -- -D warningsspin-ingress-clippy — cwd cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features spin --target wasm32-wasip2 --all-targets --locked --target-dir ../../../target -- -D warningsdocs-ci — cwd npm cidocs-lint — cwd npm run lintdocs-format — cwd npm run formatdocs-build — cwd npm run buildactionlint — cwd actionlint '-shellcheck=shellcheck -S warning'action-pin-gate — cwd bash .github/actions/deploy-core/tests/check-action-pins.shzizmor — cwd zizmor --offline .githubaction-shellcheck — cwd bash -c 'shellcheck -e SC1091 .github/actions/*/scripts/*.sh .github/actions/*/tests/*.sh .github/actions/deploy-core/tests/*.sh scripts/install-actionlint.sh scripts/install-yq.sh'deploy-contracts — cwd bash .github/actions/deploy-core/tests/run.shcache-contracts — cwd bash .github/actions/setup-rust-build-cache/tests/run.shpinned-tool-versions — cwd bash -c 'set -e; cargo --version; rustc --version; node --version; npm --version; viceroy --version; wasmtime --version; spin --version; wasm-bindgen --version; wasm-bindgen-test-runner --version; worker-build --version; actionlint -version; yq --version; shellcheck --version'tracked-and-ignore-policy — cwd python3 ../../../.git/worktrees/pr-287-nov02/prfection-review287/repair/current-state-policy.pyfastly-wasm-contract — cwd cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --test contract --target-dir ../../../targetfastly-wasm-unit — cwd cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --lib --target-dir ../../../targetfastly-http-ingress — cwd bash scripts/test-request-fidelity.sh fastlyfastly-reusable-http — cwd bash scripts/smoke_test_reusable_app.sh --adapter fastly --suite smokespin-wasm-contract — cwd cargo test -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --test contract --target-dir ../../../targetspin-http-ingress — cwd bash scripts/test-request-fidelity.sh spinchrome154-version-check — cwd bash -c 'set -e; '\''../../../.git/worktrees/pr-287-nov02/prfection-review287/baseline-d62a1512-pinned/tools/chrome154/chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing'\'' --version | grep -F '\''154.0.8037.92'\''; '\''../../../.git/worktrees/pr-287-nov02/prfection-review287/baseline-d62a1512-pinned/tools/chrome154/chromedriver-mac-arm64/chromedriver'\'' --version | grep -F '\''154.0.8037.92'\'''cloudflare-wasm-contract — cwd cargo test -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --test contract --target-dir ../../../targetcloudflare-http-ingress — cwd bash scripts/test-request-fidelity.sh cloudflareconfig-key-override-local — cwd bash scripts/smoke_test_config_key_override.shspin-fake-cloud-argv-proof — cwd python3 ../../../.git/worktrees/pr-287-nov02/prfection-review287/final-d590f0eb-independent/tools/verify-spin-fake.pyfastly-default-runner — cwd cargo test --features fastly --target wasm32-wasip1 --lib --target-dir ../../../../../targetworkspace-locked-test — cwd cargo test --locked --workspace --all-targets --target-dir ../../../targetzizmor-version — cwd zizmor --versionGitHub Actions Run Tests, Run Format and Deploy actions completed successfully; CodeQL is still in progress at this readback. Workflow links: Run Tests, Run Format, Deploy actions and CodeQL. Actions tested PR merge commit The initial unchanged-head baseline identified the default Fastly runner's dependency on a deleted demo manifest; this cycle corrected it and reran the actual no-override runner. A later d8f8bb3 full run retained two failures: an unverified Fastly same-guest recovery observation, and an author-owned Spin declaration missing required/default. The Spin defect was reproduced by the strengthened unit regression, fixed in06af5df4, and the actual unchanged key smoke passed14/0; d590f0e completed the guide migration correction. The final unchanged Fastly smoke exited0 and its raw events explicitly record |
aram356
changed the title
Collaborator
Author
|
CREATOR: Re-review requested for head The latest 34 original findings now each have a labeled disposition with a pushed fixing location and successful command/output evidence. The older relative-Cargo-home and root-Cloudflare-path threads have new current-head dispositions. The older namespace-adoption thread explicitly records won't fix for unverified local-ID auto-adoption and the manual verified migration/recovery tradeoff; its historical “resolved” reply is not presented as current behavior. Please review the planning-scope authorization/provenance record, explicitly accept or reject the October adapter-owned CLI scope, and independently assess the implementation and each disposition. Each adapter retains its own provider CLI policy; the production CLI coordinates shared contracts without switching on adapter types. Current-head verification and limitations: all77 prescribed command processes exited0, with no failed or blocked groups; RunTests/RunFormat/Deployactions succeeded and CodeQL remains in progress. The five macOS-only deploy-harness omissions are separately covered by the GitHub Actions Linux run ( Readback confirms OPEN, non-draft, intended head. Acting login and PR author: Cleanup: stopped verification-owned runtime/browser processes (none remained at independent readback). Removed worktrees/branches: none. Kept Next actor: REVIEWER, for planning-scope acceptance, current-head review and thread resolution. |
Collaborator
Author
|
CREATOR: Current-head CI update for |
aram356
commented
Nov 11, 2026
aram356
left a comment
aram356
left a comment
Collaborator
Author
There was a problem hiding this comment.
REVIEWER: REQUEST_CHANGES — GitHub blocked this review event: POST /pulls/287/reviews/5863244301/events with REQUEST_CHANGES returned HTTP 422 "Can not request changes on your own pull request". The acting account aram356 is also the PR author, so this is a COMMENT review carrying the REQUEST_CHANGES verdict. It is not an approval.
I re-reviewed head d590f0eb83e05f0bd8caeaf08a431b0db01b003a after the fix commits ca74224d, 5de3c00c, d8f8bb38, 06af5df4 and d590f0eb. The merge base is still cf2c57b1.
Verdict
Changes are still needed. Four round-one findings stay open, and this review adds four new findings in their own threads: 1 should-fix and 3 nits. None of the eight is blocking.
I accepted and resolved the other 30 round-one findings, including both blockers:
- The dry-run redaction leak is fixed.
- I accept the adapter-owned CLI scope, after reviewing the 2026-10-19 design and plan as a planning review on this PR.
Still open from round one:
- should-fix, Spin push warning and guide sentence: #287 (comment)
- should-fix, file-wide
arbitrary_source_item_orderingexpects inedgezero-cliconfig.rsandprovision.rs: #287 (comment) - should-fix, CHANGELOG and guides (Spin outbound wording, the Cloudflare namespace-ID procedure, migration-guide ordering): #287 (comment)
- nit, a mistyped
--manifestonconfig pushstill createstypo/.edgezero/provision.lock: #287 (comment)
New in this review:
- should-fix: an exported
__NAMEoverride reaches the adapter manifests but not existing env files, with no warning (crates/edgezero-adapter-axum/src/cli/provision_local.rs:44-49). - nit: dry-run refuses a symlinked crate
Cargo.tomlthat the real run accepts (crates/edgezero-cli/src/provision.rs:1694). - nit: two self-spawning tests check only the exit status against hard-coded names (
crates/edgezero-adapter-fastly/src/cli/local_vendor.rs:151; alsocrates/edgezero-cli/src/generator.rs:894-907). - nit: two stale rows in the spec's local-artifact tables (
docs/superpowers/specs/2026-06-23-provision-local.md:1710,:1689).
Older threads:
- R1 (#287 (comment)) and R2 (#287 (comment)): I verified CREATOR's labeled fixed dispositions at this head and accepted them. Both threads stay resolved.
- The namespace thread (#287 (comment)): I accept won't fix for the behavior. Its documentation gap is tracked on the CHANGELOG thread.
Checks beyond the suite
All of these used the head edgezero binary or the head build of app-demo-cli, on scratch copies of examples/app-demo outside the worktree, unless noted.
- Redaction: 18 secret-bearing
.envinputs, one per dry-run. No value or comment text reached the output. An unterminated quote makes the dry-run refuse (exit 1). - Dry-run into a broken pipe: exit 1,
write provision preview: Broken pipe (os error 32). - Operator
__NAMEedits: commented and customised lines survive re-provision byte-for-byte on Axum, Spin and Cloudflare, and the files are mode-rw-------. - Exported
__NAMEoverride: withEDGEZERO__STORES__CONFIG__APP_CONFIG__NAME=prod_configexported, re-provision adds aprod_configbinding towrangler.tomland Spin's manifests. The env files keepapp_config. - Typed provisioning: commented secret hints for Axum and Cloudflare, and
{ required = true, secret = true }for Spin. A second run is byte-identical. - Real Spin 4.1.0: a missing required secret makes
spin upexit 1. Spin rejectstoken_2,foo__barandfoo_, and acceptsa1_b2andapi_token_v2. - Scaffold:
edgezero newdeclaresallowed_outbound_hosts = ["https://*:*"]inedgezero.tomland the generatedspin.toml, and its.gitignorecovers.env.*,!.env.example,.dev.vars.*and.edgezero-write-*. - Mistyped
--manifest:provisioncreates nothing;config pushleavestypo/.edgezero/provision.lock. - Hostile environment: I re-ran the built test binaries.
- With
CARGO_TARGET_DIRandCARGO_BUILD_TARGET_DIRpointing elsewhere, every lib passes. - With
FASTLY_SERVICE_IDexported, the three tests named on the Fastly thread pass. The whole Fastly lib still fails 35 of 375: three tests that also exist at the merge base, plus aPoisonErrorcascade they cause. Details are on that thread.
- With
Not verified
- Authenticated cloud operations: Fastly, Cloudflare and Fermyon Cloud provision, push and deploy.
- Windows path handling.
- The five deploy-harness cases the harness skips on macOS (
non-Linux runner). - Whether the three Fastly tests that read
FASTLY_SERVICE_IDalso fail at the merge base. I didn't run the base.
GitHub CI at d590f0eb reports all 28 checks passing. That is CI's run, not mine.
Full suite at d590f0eb
I ran this in a detached worktree at the head SHA. Host-test steps ran with fastly, wrangler and spin removed from PATH, as on the CI host runners. Every step exited 0.
Compared with last round, this run adds:
- the head's tracked-file and ignore gates (S04/S05);
- the Fastly crate's own default runner with no override (X14);
- the Deploy actions
static-checksjob (DA1–DA7). That workflow triggers oncrates/edgezero-cli/**, and my last round missed it.
71 steps: commands, exit codes and result lines
| ID | Command | Exit | Result line |
|---|---|---|---|
| P00 | for b in fastly wrangler spin; do if command -v "$b"; then echo "LEAK $b"; exit 1; fi; done; echo "no fastly/wrangler/spin on host PATH" |
0 | no fastly/wrangler/spin on host PATH |
| G01 | cargo fmt --all -- --check |
0 | (no output; exit code only) |
| G02 | cargo clippy --workspace --all-targets --all-features -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.67s |
| G03 | cargo test --workspace --all-targets |
0 | 23 test result: lines, all ok: 2027 passed, 0 failed, 1 ignored |
| G04 | cargo check --workspace --all-targets --features "fastly cloudflare spin" |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.60s |
| G05 | cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.27s |
| S01 | ./scripts/check_no_placeholder_pins.sh |
0 | check_no_placeholder_pins: OK |
| S02 | ./scripts/check_no_legacy_typed_reads.sh |
0 | check_no_legacy_typed_reads: OK |
| S03 | ./scripts/check_shared_dep_pins.sh && bash scripts/test_shared_dep_pins.sh |
0 | PASS worker-build unrelated-section |
| S04 | if git ls-files | grep -E '(^|/)(axum|fastly|spin|wrangler|runtime-config)\.toml$|(^|/)\.(dev\.vars|env)(\..*)?$|(^|/)\.edgezero-write-' | grep -Ev '^tests/fixtures/request-fidelity/(fastly|spin|wrangler)\.toml$|(^|/)\.env\.example$'; then echo TRACKED; exit 1; fi; echo "no tracked adapter manifests or env files" |
0 | no tracked adapter manifests or env files |
| S05 | for probe in crates/demo/axum.toml crates/demo/wrangler.toml crates/demo/fastly.toml crates/demo/spin.toml crates/demo/runtime-config.toml crates/demo/.dev.vars crates/demo/.dev.vars.production crates/demo/.dev.vars.local crates/demo/.env crates/demo/.env.production crates/demo/.env.local crates/demo/.edgezero-write-probe .edgezero/.env; do git check-ignore -q "$probe" || { echo "NOT IGNORED $probe"; exit 1; }; done; for probe in .env.example crates/demo/.env.example crates/demo/src/bin/main.rs; do if git check-ignore -q "$probe"; then echo "WRONGLY IGNORED $probe"; exit 1; fi; done; echo "all positive probes ignored, all negative probes trackable" |
0 | all positive probes ignored, all negative probes trackable |
| S06 | shellcheck -x --severity=warning scripts/*.sh scripts/lib/*.sh && echo shellcheck-clean |
0 | shellcheck-clean |
| S07 | bash scripts/lib/smoke_backup_test.sh |
0 | smoke_backup_test: 50 passed, 0 failed |
| S08 | cargo fmt --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --all -- --check |
0 | (no output; exit code only) |
| S09 | cargo test --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --locked |
0 | test result: ok. 20 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.76s |
| S10 | cargo clippy --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.11s |
| S11 | cargo test --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core |
0 | 3 test result: lines, all ok: 26 passed, 0 failed, 0 ignored |
| C01 | cargo run -q --bin check_no_nested_app_config --features nested-app-config-check -- examples/app-demo crates/edgezero-cli/src/templates |
0 | check_no_nested_app_config: OK |
| C02 | cargo test -p edgezero-cli --features nested-app-config-check --bin check_no_nested_app_config |
0 | test result: ok. 18 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s |
| C03 | cargo check -p edgezero-cli --bin check_no_nested_app_config --no-default-features --features nested-app-config-check |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 5.46s |
| C04 | cargo clippy -p edgezero-cli --lib --no-default-features -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 11.31s |
| C05 | cargo clippy -p edgezero-cli --bin check_no_nested_app_config --no-default-features --features nested-app-config-check -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 6.54s |
| C06 | cargo clippy -p edgezero-cli --all-targets --no-default-features --features cli -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 4.06s |
| C07 | cargo test -p edgezero-cli --all-targets |
0 | 5 test result: lines, all ok: 370 passed, 0 failed, 1 ignored |
| C08 | cargo test -p edgezero-adapter-axum -p edgezero-adapter-cloudflare -p edgezero-adapter-fastly -p edgezero-adapter-spin --all-targets --no-default-features --features cli |
0 | 8 test result: lines, all ok: 788 passed, 0 failed, 0 ignored |
| C09 | cargo test -p edgezero-cli --test generated_project_builds -- --ignored |
0 | test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 212.06s |
| A01 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-axum |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 27.72s |
| A02 | cargo test -p edgezero-adapter-axum --all-targets --features axum |
0 | test result: ok. 128 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.73s |
| D01 | cd examples/app-demo && cargo fmt --all -- --check |
0 | (no output; exit code only) |
| D02 | cd examples/app-demo && cargo clippy --workspace --all-targets --all-features -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 54.87s |
| D03 | cd examples/app-demo && cargo test --locked --workspace --all-targets |
0 | 9 test result: lines, all ok: 33 passed, 0 failed, 0 ignored |
| F01 | cargo fmt --manifest-path tests/fixtures/reusable-app/Cargo.toml --all -- --check |
0 | (no output; exit code only) |
| F02 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core -p fixture-axum --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 27.65s |
| F03 | cargo clippy -p edgezero-adapter-fastly --features cli --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 13.61s |
| F04 | cargo clippy -p edgezero-adapter-fastly --no-default-features --lib -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 7.42s |
| W01 | cargo clippy -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 22.75s |
| W02 | cargo clippy -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 10.35s |
| W03 | cargo clippy -p edgezero-adapter-fastly --features "fastly cli" --target wasm32-wasip1 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 3.55s |
| W04 | cargo clippy -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 6.58s |
| W05 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-cloudflare --target wasm32-unknown-unknown --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 26.04s |
| W06 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-fastly --target wasm32-wasip1 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 7.94s |
| W07 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-spin --target wasm32-wasip2 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 12.93s |
| X01 | cargo check -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 8.10s |
| X02 | cargo check -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 2.66s |
| X03 | cargo check -p edgezero-adapter-spin --features spin --target wasm32-wasip2 |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.24s |
| X04 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-cloudflare --target wasm32-unknown-unknown --all-targets |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 1.55s |
| X05 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-fastly --target wasm32-wasip1 --all-targets |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 2.26s |
| X06 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-spin --target wasm32-wasip2 --all-targets |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 2.09s |
| X07 | viceroy --version && CARGO_TARGET_WASM32_WASIP1_RUNNER="viceroy run" cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --test contract |
0 | test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.16s |
| X08 | CARGO_TARGET_WASM32_WASIP1_RUNNER="viceroy run" cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --lib |
0 | test result: ok. 97 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s |
| X09 | wasmtime --version && CARGO_TARGET_WASM32_WASIP2_RUNNER="wasmtime run" cargo test -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --test contract |
0 | test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s |
| X10 | cargo fmt --manifest-path tests/fixtures/request-fidelity/Cargo.toml --all -- --check |
0 | (no output; exit code only) |
| X11 | cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features fastly --target wasm32-wasip1 --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 47.88s |
| X12 | cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features spin --target wasm32-wasip2 --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 35.89s |
| X13 | cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features cloudflare --target wasm32-unknown-unknown --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 34.47s |
| N01 | cd docs && npm ci --no-audit --no-fund && npm run lint && npm run format |
0 | All matched files use Prettier code style! |
| R01 | ./scripts/test-request-fidelity.sh fastly |
0 | fastly loopback fixture uses port 60630 |
| R02 | ./scripts/test-request-fidelity.sh spin |
0 | spin loopback fixture uses port 60695 |
| R03 | ./scripts/smoke_test_reusable_app.sh --adapter fastly --suite smoke |
0 | {"evidence":"/Users/ag/projects/stackpop/prebid/edgezero/.worktrees/review-287-d590f0e/tests/fixtures/reusable-app/.runs/18e70d6fb2972d98-1196f-0","exit_code... |
| X14 | cd crates/edgezero-adapter-fastly && env -u CARGO_TARGET_WASM32_WASIP1_RUNNER cargo test --features fastly --target wasm32-wasip1 --lib |
0 | test result: ok. 97 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s |
| DA1 | actionlint -version && actionlint -shellcheck="shellcheck -S warning" && echo actionlint-clean |
0 | actionlint-clean |
| DA2 | .github/actions/deploy-core/tests/check-action-pins.sh && echo pin-gate-clean |
0 | pin-gate-clean |
| DA3 | zizmor --version && zizmor --offline .github && echo zizmor-clean |
0 | zizmor-clean |
| DA4 | shellcheck -e SC1091 .github/actions/*/scripts/*.sh .github/actions/*/tests/*.sh .github/actions/deploy-core/tests/*.sh scripts/install-actionlint.sh scripts/install-yq.sh && echo action-shellcheck-clean |
0 | action-shellcheck-clean |
| DA5 | .github/actions/deploy-core/tests/run.sh |
0 | Passed: 643 Failed: 0 Skipped: 5 |
| DA6 | .github/actions/setup-rust-build-cache/tests/run.sh |
0 | setup-rust-build-cache action tests passed |
| DA7 | cd docs && npm run build |
0 | build complete in 3.04s. |
| Z01 | git status --porcelain --untracked-files=normal; echo "--- (end of untracked/modified, ignored files excluded)" |
0 | --- (end of untracked/modified, ignored files excluded) |
| Y01 | '/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasmtime-x/wasmtime-v48.0.1-aarch64-macos/wasmtime' --version && CARGO_TARGET_WASM32_WASIP2_RUNNER='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasmtime-x/wasmtime-v48.0.1-aarch64-macos/wasmtime run' cargo test -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --test contract |
0 | test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s |
| Y02 | '/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasm-bindgen/bin/wasm-bindgen-test-runner' --version && CHROMEDRIVER='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/cft/chromedriver/mac_arm-157.0.8103.39/chromedriver-mac-arm64/chromedriver' WASM_BINDGEN_TEST_WEBDRIVER_JSON='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/webdriver.json' CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasm-bindgen/bin/wasm-bindgen-test-runner' cargo test -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --test contract |
0 | test result: ok. 13 passed; 0 failed; 0 ignored; 0 filtered out; finished in 0.04s |
| Y03 | WASM_BINDGEN_BIN='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasm-bindgen/bin/wasm-bindgen' ./scripts/test-request-fidelity.sh cloudflare |
0 | cloudflare loopback fixture uses port 62564 |
dhruv8sh
requested changes
Nov 11, 2026
dhruv8sh
left a comment
dhruv8sh
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for this. It's a big piece of work. Local gates on the PR head with the pinned toolchain (1.98.1): cargo fmt --check passed, cargo clippy --workspace --all-targets --all-features -D warnings passed, cargo test --workspace --all-targets passed (2027 passed, 0 failed).
Requesting changes because of the ❓ question on the Spin-only fields in edgezero-core (inline). The remaining findings don't block.
Summary of findings
- ❓ Spin-only
allowed_outbound_hosts/cloudfields in the shared coreManifestAdapterDefinition(inline,manifest.rs). - 🤔 Parent directory not fsynced after the atomic rename (inline,
atomic_file.rs). - 🤔 New CI steps run in both matrix suites (inline,
test.yml). - ♻️
regexand the new modules inedgezero-adapteraren't behind theclifeature (inline,Cargo.toml). - ⛏ Root
Cargo.tomlordering and spacing (inline).
🏕 Unrelated churn in core. The three hand-written deserialize_in_place overrides in crates/edgezero-core/src/manifest.rs and the write_number change in canonical_form.rs (an unwrap_or(f64::NAN) that turns a clear panic into an assert) replace documented #[expect(...)] attributes. They aren't part of this feature and go against the project's minimal-changes rule. Please revert them unless something requires them.
📌 PR size. At 119 files (about +53k/-24k), this is very hard to review thoroughly. Please split future work along these lines, for example by adapter, or land the shared edgezero-adapter helpers first.
😃 Nice work. The env-file and manifest writes are careful: the sibling file is replaced only after a sync, new files are created 0600, and newline/CR/NUL injection is rejected in env lines. provision_lock.rs refuses a symlinked .edgezero directory and has a regression test. The CI checks that generated manifests and secret env files are both untracked and actually gitignored are a strong guard.
Collaborator
Author
|
CREATOR: fixed the non-inline core-cleanup request in review 5866915444, in commit 01f25f9a, tested at Restored the base canonical-number implementation and the three documented Deserialize implementations; removed the unrelated handwritten deserialize_in_place overrides. The new provisioning schema and adapter option contract remain. crates/edgezero-core/src/canonical_form.rs now has no diff against the current base; crates/edgezero-core/src/manifest.rs retains the per-impl lint expectations. cwd: .; exit 0 cargo test -p edgezero-core --target-dir ../../../targetActual output: This cycle covers the thirteen open inline findings plus six concrete follow-ups on accepted threads. Corrections are in 01f25f9 and ce25ef5; acabf95 incorporates the intervening upstream PR merge 63dc9a0, whose only source difference from d590f0e was the docs lockfile. The accepted decision not to auto-promote unverified ignored Cloudflare IDs remains unchanged; its documentation gap is corrected. Planning provenance: REVIEWER’s November 11 review accepts the October adapter-owned design/plan as a planning review on this PR and resolves thirty prior findings. That is scope acceptance, not approval of this implementation head. The November 12 follow-up plan stays within that scope. Internal work allocation: separate read-only investigations covered the adapter boundary, CLI tests, and env/atomic writes; minimal alternatives were compared and centrally implemented. A separate plan audit approved coverage. Two final technical audits found no blocking code defects and identified adjacent documentation corrections that are included. The verification auditor independently inspected the harness and final logs/state; CREATOR executed the commands. These are internal audits, not GitHub REVIEWER approval. Future work will be scoped into smaller reviewable changes, as requested. Account mode: one-account, acting login and PR author Cleanup: removed no worktrees or branches; keep |
Collaborator
Author
|
CREATOR: Full prescribed suite executed at All five primary Rust gates, standalone CLI profiles, shared CLI/default profiles, regex-free shared runtime graph, hostile-env Fastly library, generated apps, native demo/fixtures, WASM build/lint/contracts, real local ingress, docs, state policies, deployment/cache contracts passed as commands. Fastly hostile-env library: 375 passed. Key-override smoke: 14 passed, 0 failed. The Spin cloud subprocess uses a narrowly validated selective fake; all non-cloud Spin calls delegate to real pinned Spin 4.1.0. This is control-flow coverage, not live-cloud validation. The report confirms the tested/start/end head matches and tracked source is empty at start/end. Runtime cleanup snapshot: zero preexisting candidates, zero terminated leftovers, zero remaining owned processes. The auditor’s separate live-process query was sandbox-denied; no independent live-inventory claim is made. Local limitations remain explicit. Deployment contracts: 643 passed, 0 failed, 5 non-Linux skips; Linux GitHub CI is a separate result. The ignored generated-project test explicitly ran and passed in its dedicated command. The runner's ignored Cloudflare routing test invokes the same probes executed by the successful real Cloudflare ingress command; it was not claimed to run as a unit test. Thirteen core illustrative doctests remain intentionally ignored; one compile-fail doctest passed. No skipped or pending case is claimed as a successful hook assertion. Earlier RED/Clippy and corrective-iteration logs are retained separately from this passing-head record. After the full83 run, an auxiliary proof-file setup command was truncated in the interactive PTY; the missing-file attempt exited 2. That private setup failure is retained, the file transfer was corrected without changing source, and the exact same supplementary assertions now exit 0 with the four PASS lines below. It is not included among the 83 commands. The following transcript preserves commands, exit codes and actual result lines. Absolute local executable/report prefixes are represented with notation aliases: All 83 commands, exit codes and result linesSupplementary source/document contract verification: cwd: .; exit 0 python3 ../../../.git/worktrees/pr-287-nov02/prfection-review287/nov12/review-surface-contracts.pyActual output: Source of the supplementary contract checkfrom pathlib import Path
import tomllib
workflow=Path(".github/workflows/test.yml").read_text()
names=["Enforce adapter manifests and secret env files are not tracked","Enforce adapter manifests and secret env files are gitignored","ShellCheck smoke scripts","Smoke backup helper unit tests"]
for name in names:
block=workflow.split("- name: "+name+"\n",1)[1].split("\n - name:",1)[0]
assert "if: matrix.suite == 'workspace'" in block,name
assert "run: bash scripts/lib/smoke_backup_test.sh\n\n - name: Verify native request ingress harness" in workflow
print("PASS: all four repository helper steps run only in workspace; separator restored")
cargo=Path("Cargo.toml").read_text()
assert cargo.index('redb = "4.2.0"')<cargo.index('regex = "1.13.1"')<cargo.index("reqwest =")
assert '\n\n\n[workspace.lints.rust]' not in cargo
print("PASS: regex dependency order and workspace lint spacing")
spec=Path("docs/superpowers/specs/2026-06-23-provision-local.md").read_text()
assert 'commented `# <key_value>=""` hint' in spec
assert 'env-file selection prose after the Axum row' in spec
assert "converging upsert path" not in Path("crates/edgezero-adapter-spin/src/cli/provision_local.rs").read_text()
guide=Path("docs/guide/manifest-store-migration.md").read_text()
assert guide.index("## Preserve provider settings")<guide.index("## Un-tracking manifests")
assert guide.index("### Spin outbound HTTPS permissions")<guide.index("## Un-tracking manifests")
assert "IDs and titles, **not bindings**" in guide
assert "verified through 4.1" in Path("crates/edgezero-adapter-spin/src/cli/push_local.rs").read_text()
print("PASS: inactive Cloudflare hints, Spin prose/schema warning, pre-removal provider migration")
core=Path("crates/edgezero-core/src/manifest.rs").read_text()
assert "`allowed_outbound_hosts`, `cloud`, `component`, `crate`, `host`" in core
print("PASS: unknown-field diagnostics list both owned extension options") |
Collaborator
Author
|
CREATOR: Requesting REVIEWER re-review of PR #287 at 83 prescribed commands exited 0. Five non-Linux contract skips, intentional host/doctest ignores and explicit runtime PENDING/UNSUPPORTED cases are disclosed, not claimed as hook successes. No live-cloud validation was performed. Source stayed clean and the runtime cleanup snapshot has no owned processes remaining. Hosted GitHub Actions workflows at this exact head: Run Format success; Deploy actions success; CodeQL Advanced in_progress; Run Tests success. These are hosted results, separate from the local suite. REVIEWER acceptance remains required. Account mode: one-account, acting login and PR author No thread was resolved/minimized/hidden by CREATOR. REVIEWER alone accepts and resolves findings; the existing change request and REQUEST_CHANGES verdict remain pending. Next actors are GitHub CI for pending hosted checks and REVIEWER for current-head verification/acceptance. No approval or merge authorization is asserted. |
aram356
commented
Nov 12, 2026
aram356
left a comment
aram356
left a comment
Collaborator
Author
There was a problem hiding this comment.
REVIEWER: REQUEST_CHANGES — GitHub blocked this review event: POST /pulls/287/reviews/5879982066/events with REQUEST_CHANGES returned HTTP 422 "Could not request_changes for pull request review. Can not request changes on your own pull request". The acting account, aram356, is also the PR author, so I'm posting this as a COMMENT review that carries the REQUEST_CHANGES verdict. It is not an approval.
I re-reviewed head ce25ef5a008ac7c540964c0c98360b2a27ce4524. Since my last review at d590f0eb, the PR gained two fix commits, 01f25f9a and ce25ef5a. It also gained two merges, 63dc9a09 and acabf95b; they bring in main's e11ea308, and their only change is the docs lockfile. The merge base is now e11ea308.
Verdict
Changes are needed only for the four new nits in this review's threads. Nothing blocking or should-fix is open.
I verified and resolved all 13 threads that were open:
- My eight earlier findings.
- dhruv8sh's five inline threads: adapter option ownership, the parent-directory sync,
regexgating, CI step gating andCargo.tomlordering.
I also checked the unrelated core changes that dhruv8sh's review body raised without a thread. crates/edgezero-core/src/canonical_form.rs has no diff against e11ea308. The three Deserialize impls in manifest.rs are back to main's form, with their #[expect(clippy::missing_trait_methods)] and no hand-written deserialize_in_place.
dhruv8sh's CHANGES_REQUESTED review is theirs to update; this review doesn't change it.
New in this review, all nits:
- Env-file path: the
__NAMEscan's parse error no longer names the env file (crates/edgezero-adapter-axum/src/cli/provision_local.rs:48, and the Cloudflare and Spin equivalents). - Docs for the new options:
allowed_outbound_hostsandcloudare missing from the manifest reference table, and the new error message points to a guide that doesn't describe them (crates/edgezero-core/src/manifest.rs:938-941). - Cloudflare procedure: it has no tracked home for environment-specific namespace IDs (
docs/guide/adapters/cloudflare.md:329-331). - Spec: a renamed spec heading left two cross-references stale, and the same rows have stale
__KEYand line-number facts (docs/superpowers/specs/2026-06-23-provision-local.md:1692).
Checks beyond the suite
Unless noted, I used copies of the head edgezero and app-demo-cli binaries, which are byte-identical to the worktree builds. I ran them on scratch copies of examples/app-demo outside the worktree.
- Redaction: I ran 20 dry-runs, each with one secret-bearing
.envinput. They include two multiline__NAMEvalues, one double-quoted and one single-quoted.- No value or comment text reached the output.
- One case puts the sentinel in a key name. That key prints as
SENTINEL_KEYNAME_EIGHTEEN=<redacted>, by design. - An unterminated quote makes the run refuse with exit 1.
- Exported
__NAMEoverride: all three env files stay byte-identical, and the adapter manifests gain theprod_configbinding. Each adapter prints afile:linemismatch line in both live and dry-run output, and prints none without the export. - Option ownership:
- With
cloud = falseunder axum,config validate,provision --local(dry-run and live),buildanddeployeach exit 1 with "not owned". - Fastly with
allowed_outbound_hosts = []and Cloudflare withcloud = truefail the same way. - Spin accepts
cloud = false. - For Spin, an absent
allowed_outbound_hostsand an explicit[]synthesize identicalspin.tomlfiles.
- With
- Mistyped
--manifestonconfig push: I tried five adapter and mode combinations, each with a missing parent and with an existing empty parent. All exit 2 and create nothing. - Symlinked crate
Cargo.toml: dry-run and liveprovision --localboth exit 0, and the source stays a symlink. - Directory sync on other filesystems: on macOS exFAT and FAT disk images,
provision --localfor axum, cloudflare and spin each exits 0. - Hostile environment: I re-ran the built test executables. These ran in my review worktree.
- With
FASTLY_SERVICE_ID=HOSTILE123SVC,CARGO_TARGET_DIRandCARGO_BUILD_TARGET_DIRexported, every library and test executable in the workspace crates passes with the same counts as in a clean environment. - The Fastly lib now reports 375 passed and 0 failed. Last round, it failed 35 of 375 in that environment.
- With
edgezero-adapterwithout default features: these also ran in my review worktree.cargo check -p edgezero-adapter --no-default-featuresexits 0, and so doescargo clippy -p edgezero-adapter --no-default-features --all-targets -- -D warnings.cargo test -p edgezero-adapter --no-default-featuresreports20 passed; 0 failed.cargo tree -p edgezero-adapter --no-default-features -e normallists noregex.
Not verified
- Authenticated cloud operations: Fastly, Cloudflare and Fermyon Cloud provision, push and deploy.
- Windows path handling.
- Directory sync on SMB and Linux network or FUSE mounts.
- The five deploy-harness cases the harness skips on macOS (
non-Linux runner).
Full suite at ce25ef5a
I ran this in a detached worktree at the head SHA. Its target/ started as a copy-on-write clone of the main checkout's build output, and Cargo rebuilt the workspace crates under the worktree path. Host-test steps ran with fastly, wrangler and spin removed from PATH, as on the CI host runners. Every step exited 0.
71 steps: commands, exit codes and result lines
| ID | Command | Exit | Result line |
|---|---|---|---|
| P00 | for b in fastly wrangler spin; do if command -v "$b"; then echo "LEAK $b"; exit 1; fi; done; echo "no fastly/wrangler/spin on host PATH" |
0 | no fastly/wrangler/spin on host PATH |
| G01 | cargo fmt --all -- --check |
0 | (no output; exit code only) |
| G02 | cargo clippy --workspace --all-targets --all-features -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 11.52s |
| G03 | cargo test --workspace --all-targets |
0 | 21 test result: lines, all ok: 2036 passed, 0 failed, 1 ignored |
| G04 | cargo check --workspace --all-targets --features "fastly cloudflare spin" |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 6.04s |
| G05 | cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 7.64s |
| S01 | ./scripts/check_no_placeholder_pins.sh |
0 | check_no_placeholder_pins: OK |
| S02 | ./scripts/check_no_legacy_typed_reads.sh |
0 | check_no_legacy_typed_reads: OK |
| S03 | ./scripts/check_shared_dep_pins.sh && bash scripts/test_shared_dep_pins.sh |
0 | PASS worker-build unrelated-section |
| S04 | if git ls-files | grep -E '(^|/)(axum|fastly|spin|wrangler|runtime-config)\.toml$|(^|/)\.(dev\.vars|env)(\..*)?$|(^|/)\.edgezero-write-' | grep -Ev '^tests/fixtures/request-fidelity/(fastly|spin|wrangler)\.toml$|(^|/)\.env\.example$'; then echo TRACKED; exit 1; fi; echo "no tracked adapter manifests or env files" |
0 | no tracked adapter manifests or env files |
| S05 | for probe in crates/demo/axum.toml crates/demo/wrangler.toml crates/demo/fastly.toml crates/demo/spin.toml crates/demo/runtime-config.toml crates/demo/.dev.vars crates/demo/.dev.vars.production crates/demo/.dev.vars.local crates/demo/.env crates/demo/.env.production crates/demo/.env.local crates/demo/.edgezero-write-probe .edgezero/.env; do git check-ignore -q "$probe" || { echo "NOT IGNORED $probe"; exit 1; }; done; for probe in .env.example crates/demo/.env.example crates/demo/src/bin/main.rs; do if git check-ignore -q "$probe"; then echo "WRONGLY IGNORED $probe"; exit 1; fi; done; echo "all positive probes ignored, all negative probes trackable" |
0 | all positive probes ignored, all negative probes trackable |
| S06 | shellcheck -x --severity=warning scripts/*.sh scripts/lib/*.sh && echo shellcheck-clean |
0 | shellcheck-clean |
| S07 | bash scripts/lib/smoke_backup_test.sh |
0 | smoke_backup_test: 50 passed, 0 failed |
| S08 | cargo fmt --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --all -- --check |
0 | (no output; exit code only) |
| S09 | cargo test --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --locked |
0 | test result: ok. 20 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.85s |
| S10 | cargo clippy --manifest-path tests/fixtures/request-fidelity-runner/Cargo.toml --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 1.29s |
| S11 | cargo test --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core |
0 | 3 test result: lines, all ok: 26 passed, 0 failed, 0 ignored |
| C01 | cargo run -q --bin check_no_nested_app_config --features nested-app-config-check -- examples/app-demo crates/edgezero-cli/src/templates |
0 | check_no_nested_app_config: OK |
| C02 | cargo test -p edgezero-cli --features nested-app-config-check --bin check_no_nested_app_config |
0 | test result: ok. 18 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s |
| C03 | cargo check -p edgezero-cli --bin check_no_nested_app_config --no-default-features --features nested-app-config-check |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 6.32s |
| C04 | cargo clippy -p edgezero-cli --lib --no-default-features -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 6.71s |
| C05 | cargo clippy -p edgezero-cli --bin check_no_nested_app_config --no-default-features --features nested-app-config-check -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 2.73s |
| C06 | cargo clippy -p edgezero-cli --all-targets --no-default-features --features cli -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 8.13s |
| C07 | cargo test -p edgezero-cli --all-targets |
0 | 4 test result: lines, all ok: 375 passed, 0 failed, 1 ignored |
| C08 | cargo test -p edgezero-adapter-axum -p edgezero-adapter-cloudflare -p edgezero-adapter-fastly -p edgezero-adapter-spin --all-targets --no-default-features --features cli |
0 | 7 test result: lines, all ok: 787 passed, 0 failed, 0 ignored |
| C09 | cargo test -p edgezero-cli --test generated_project_builds -- --ignored |
0 | test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 65.24s |
| A01 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-axum |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 10.58s |
| A02 | cargo test -p edgezero-adapter-axum --all-targets --features axum |
0 | test result: ok. 128 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.83s |
| D01 | cd examples/app-demo && cargo fmt --all -- --check |
0 | (no output; exit code only) |
| D02 | cd examples/app-demo && cargo clippy --workspace --all-targets --all-features -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 19.78s |
| D03 | cd examples/app-demo && cargo test --locked --workspace --all-targets |
0 | 9 test result: lines, all ok: 33 passed, 0 failed, 0 ignored |
| F01 | cargo fmt --manifest-path tests/fixtures/reusable-app/Cargo.toml --all -- --check |
0 | (no output; exit code only) |
| F02 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core -p fixture-axum --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 9.72s |
| F03 | cargo clippy -p edgezero-adapter-fastly --features cli --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 2.88s |
| F04 | cargo clippy -p edgezero-adapter-fastly --no-default-features --lib -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 2.45s |
| W01 | cargo clippy -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 5.38s |
| W02 | cargo clippy -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 4.63s |
| W03 | cargo clippy -p edgezero-adapter-fastly --features "fastly cli" --target wasm32-wasip1 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 2.72s |
| W04 | cargo clippy -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 3.14s |
| W05 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-cloudflare --target wasm32-unknown-unknown --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 14.70s |
| W06 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-fastly --target wasm32-wasip1 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 4.64s |
| W07 | cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-spin --target wasm32-wasip2 --all-targets -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 7.98s |
| X01 | cargo check -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 3.23s |
| X02 | cargo check -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 1.37s |
| X03 | cargo check -p edgezero-adapter-spin --features spin --target wasm32-wasip2 |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.18s |
| X04 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-cloudflare --target wasm32-unknown-unknown --all-targets |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.69s |
| X05 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-fastly --target wasm32-wasip1 --all-targets |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.82s |
| X06 | cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-spin --target wasm32-wasip2 --all-targets |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 0.31s |
| X07 | viceroy --version && CARGO_TARGET_WASM32_WASIP1_RUNNER="viceroy run" cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --test contract |
0 | test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s |
| X08 | CARGO_TARGET_WASM32_WASIP1_RUNNER="viceroy run" cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --lib |
0 | test result: ok. 97 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.17s |
| X09 | wasmtime --version && CARGO_TARGET_WASM32_WASIP2_RUNNER="wasmtime run" cargo test -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --test contract |
0 | test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s |
| X10 | cargo fmt --manifest-path tests/fixtures/request-fidelity/Cargo.toml --all -- --check |
0 | (no output; exit code only) |
| X11 | cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features fastly --target wasm32-wasip1 --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 9.90s |
| X12 | cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features spin --target wasm32-wasip2 --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 10.32s |
| X13 | cargo clippy --manifest-path tests/fixtures/request-fidelity/Cargo.toml --features cloudflare --target wasm32-unknown-unknown --all-targets --locked -- -D warnings |
0 | Finished dev profile [unoptimized + debuginfo] target(s) in 16.73s |
| N01 | cd docs && npm ci --no-audit --no-fund && npm run lint && npm run format |
0 | All matched files use Prettier code style! |
| R01 | ./scripts/test-request-fidelity.sh fastly |
0 | fastly loopback fixture uses port 64581 |
| R02 | ./scripts/test-request-fidelity.sh spin |
0 | spin loopback fixture uses port 64611 |
| R03 | ./scripts/smoke_test_reusable_app.sh --adapter fastly --suite smoke |
0 | {"evidence":"/Users/ag/projects/stackpop/prebid/edgezero/.worktrees/review-287-ce25ef5/tests/fixtures/reusable-app/.runs/18e75ea837fb1b00-9567-0","exit_code":0} |
| X14 | cd crates/edgezero-adapter-fastly && env -u CARGO_TARGET_WASM32_WASIP1_RUNNER cargo test --features fastly --target wasm32-wasip1 --lib |
0 | test result: ok. 97 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.18s |
| DA1 | actionlint -version && actionlint -shellcheck="shellcheck -S warning" && echo actionlint-clean |
0 | actionlint-clean |
| DA2 | .github/actions/deploy-core/tests/check-action-pins.sh && echo pin-gate-clean |
0 | pin-gate-clean |
| DA3 | zizmor --version && zizmor --offline .github && echo zizmor-clean |
0 | zizmor-clean |
| DA4 | shellcheck -e SC1091 .github/actions/*/scripts/*.sh .github/actions/*/tests/*.sh .github/actions/deploy-core/tests/*.sh scripts/install-actionlint.sh scripts/install-yq.sh && echo action-shellcheck-clean |
0 | action-shellcheck-clean |
| DA5 | .github/actions/deploy-core/tests/run.sh |
0 | Passed: 643 Failed: 0 Skipped: 5 |
| DA6 | .github/actions/setup-rust-build-cache/tests/run.sh |
0 | setup-rust-build-cache action tests passed |
| DA7 | cd docs && npm run build |
0 | build complete in 1.91s. |
| Z01 | git status --porcelain --untracked-files=normal; echo "--- (end of untracked/modified, ignored files excluded)" |
0 | --- (end of untracked/modified, ignored files excluded) |
| Y01 | '/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasmtime-x/wasmtime-v48.0.1-aarch64-macos/wasmtime' --version && CARGO_TARGET_WASM32_WASIP2_RUNNER='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasmtime-x/wasmtime-v48.0.1-aarch64-macos/wasmtime run' cargo test -p edgezero-adapter-spin --features spin --target wasm32-wasip2 --test contract |
0 | test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s |
| Y02 | '/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasm-bindgen/bin/wasm-bindgen-test-runner' --version && CHROMEDRIVER='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/cft/chromedriver/mac_arm-157.0.8103.39/chromedriver-mac-arm64/chromedriver' WASM_BINDGEN_TEST_WEBDRIVER_JSON='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/webdriver.json' CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasm-bindgen/bin/wasm-bindgen-test-runner' cargo test -p edgezero-adapter-cloudflare --features cloudflare --target wasm32-unknown-unknown --test contract |
0 | test result: ok. 13 passed; 0 failed; 0 ignored; 0 filtered out; finished in 0.03s |
| Y03 | WASM_BINDGEN_BIN='/private/tmp/claude-501/-Users-ag-projects-stackpop-prebid-edgezero/4815ab91-4364-4ac3-911d-cffc3c79107f/scratchpad/tools/wasm-bindgen/bin/wasm-bindgen' ./scripts/test-request-fidelity.sh cloudflare |
0 | cloudflare loopback fixture uses port 49350 |
GitHub CI at ce25ef5a reports all 28 checks passing. That is CI's run, not mine.
| }; | ||
| // Existing records are operator-owned. Keep their bytes and report active | ||
| // names that disagree with the newly resolved bindings before deduping. | ||
| let mut status_lines = preserved_name_conflicts(&env_path, &name_lines)?; |
Collaborator
Author
There was a problem hiding this comment.
REVIEWER: nit: the new __NAME scan returns its parse error without the env-file path.
preserved_name_conflicts(&env_path, &name_lines)? now runs before the append, so an env file the scanner can't parse fails here with a bare message. Before this change, the append failed first, and this caller wraps its error as write <path>: … (:62). Cloudflare (crates/edgezero-adapter-cloudflare/src/cli/provision_local.rs:356) and Spin (crates/edgezero-adapter-spin/src/cli/provision_local.rs:138) behave the same way.
To check, I used the head edgezero binary on a fresh examples/app-demo copy:
- I ran
provision --localfor axum, spin and cloudflare. - I appended
UNTERM='xto.edgezero/.env, the Spin.envand.dev.vars. - I re-ran
provision --adapter <axum|spin|cloudflare> --local.
All three re-runs exit 1 with only this line, which doesn't say which of the three files to fix:
[edgezero] refusing to edit an env file with an unterminated quoted value
Requested: in all three adapters, wrap the scan's error with the env-file path, as the append's caller already does.
Comment on lines
+938
to
941
| "unknown field(s) under `[adapters.<name>.adapter]`: {}. Supported fields are \ | ||
| `allowed_outbound_hosts`, `cloud`, `component`, `crate`, `host`, \ | ||
| `manifest`, `port`; CLI adapters validate option ownership -- see \ | ||
| docs/guide/manifest-store-migration.md", |
Collaborator
Author
There was a problem hiding this comment.
REVIEWER: nit: the manifest reference doesn't cover the two options this PR adds, and this message points readers to a guide that doesn't describe them either.
- This message: it lists
allowed_outbound_hostsandcloudas supported, says CLI adapters validate option ownership, and then points todocs/guide/manifest-store-migration.md. That guide mentionsallowed_outbound_hostsonly as a Spin migration step (lines 234-251). A grep finds no`cloud`there, and nothing on which adapter owns which option. - The reference table: the field reference in
docs/guide/configuration.md, "Adapter Metadata" (line 504 at this head), still lists onlycomponent,crate,host,manifestandport. This PR edits that file but not the table.
Requested: add both fields to that table. Note that only Spin accepts them and that other built-in adapters reject them, even as false or []. Then point this message at that section.
Comment on lines
+329
to
+331
| `cargo run -p <app>-cli -- provision --adapter cloudflare --local` and compare | ||
| the generated bindings/IDs against the backup. Teammates can then regenerate | ||
| their own local manifests from the same tracked state. |
Collaborator
Author
There was a problem hiding this comment.
REVIEWER: nit: the procedure has no tracked place for environment-specific namespace bindings.
- Line 300 says to back up "environment-specific namespace bindings", and step 2 (line 309) says to read "environment-specific entries". Step 3 then says to copy the verified IDs into
[adapters.cloudflare.deployed]. - That table is keyed by logical store ID only.
ManifestAdapterDeployed(crates/edgezero-core/src/manifest.rs:386-400) haskv_namespaces,preview_kv_namespacesandservice_idand denies unknown fields. - A grep of
crates/edgezero-adapter-cloudflare/src/cli/for[env.and"env"finds only one comment, inpush_cloud.rs:108.
So a binding under a Wrangler [env.production] table with its own namespace ID can't be tracked. For those bindings, "Teammates can then regenerate their own local manifests from the same tracked state" doesn't hold.
Requested: say that environment-specific namespace IDs aren't tracked or regenerated, and how operators should carry them.
| | `wrangler.toml` | Synthesised from primitives when absent (first-run bootstrap; see "Primitive synthesiser output" below). When present, additively merged: missing `[[kv_namespaces]]` entries for any `stores.kv` or `stores.config` id are appended (per the propagation table above). Operator-set bindings, durable namespace ids from `[adapters.cloudflare.deployed]`, and unrelated keys are preserved verbatim. | yes -- per the gitignore section below | | ||
| | File | What `provision --local` writes | Already gitignored? | | ||
| | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | ||
| | `.dev.vars` | Same base/typed split as Axum's `.env`. **Base `provision --local`** writes `EDGEZERO__STORES__<KIND>__<ID>__NAME` lines for KV / CONFIG / SECRETS (values are the **platform-resolved name**, matching the `binding` of the corresponding `[[kv_namespaces]]` entry; see "Env-file `__NAME` values match adapter bindings" below) plus `EDGEZERO__STORES__CONFIG__<ID>__KEY` lines for CONFIG ids only. **Generated `<app-cli> provision --local` (`provision_typed`)** appends one commented `# <key_value>=""` hint per `#[secret]` field (inactive until the operator supplies a value). `wrangler dev` surfaces these to `env.var(...)`. See the "Per-adapter `provision_typed` output" table above for the typed path. | yes -- included in the scaffold-generated `.gitignore` (below) | |
Collaborator
Author
There was a problem hiding this comment.
REVIEWER: nit: 01f25f9a renamed the heading at line 1717 to "Env-file __NAME values and adapter bindings". This row and the Axum .edgezero/.env row (line 1660) still send readers to "Env-file __NAME values match adapter bindings".
The same rows also have stale facts that the code contradicts:
__KEYlines: this row and line 1660 describe the CONFIG__KEYoutput as plainEDGEZERO__STORES__CONFIG__<ID>__KEYlines. The adapters actually write a commented hint whose value is{logical}_staging(crates/edgezero-adapter-axum/src/cli/provision_local.rs:117,crates/edgezero-adapter-cloudflare/src/cli/provision_local.rs:425).- Spin
.envrow (line 1713): it shows that hint's value as<logical_id>, but the code writes{logical}_staging(crates/edgezero-adapter-spin/src/cli/provision_local.rs:744). - Stale line references in the Spin row:
- It cites
crates/edgezero-adapter-spin/src/request.rs:258and:301; those calls are now at:261and:304. - It cites
crates/edgezero-cli/src/lib.rs:182for serve env loading; that line is nowassert_adapter_declared_paths_safe.
- It cites
Requested: update both cross-references and correct these facts in the rows.
7 tasks done
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PRfection phase: implementation
Adds
edgezero provision --localand an adapter-owned CLI lifecycle. Clean clones regenerate ignored provider manifests and local store bindings from trackededgezero.toml. Each adapter owns provider policy, synthesis, local layout, invocation and cloud targeting; the CLI coordinates shared contracts without switching on adapter types.Current head:
ce25ef5a008ac7c540964c0c98360b2a27ce4524. Targetsmain.Specification and planning scope
The June artifacts landed on main in e483723 (#269), with amendments in f717674 (#381). The October design was added in 522ae79 and implemented in ddb3306. REVIEWER accepted the October design/plan as a planning review on this PR on November 11. The earlier unsupported assertion of external sign-off before implementation is withdrawn; internal audits are not GitHub approval. This head still requires implementation re-review. Current CREATOR scope/account record.
Resulting behavior
manifest_option_fields. Generic CLI checks reject unsupported explicitcloud/allowed_outbound_hostssettings, includingfalse/[]. Spin owns both, and custom adapters may declare ownership without CLI type switches.API and migration impact
See the CHANGELOG, migration guide, and Cloudflare namespace procedure.
Public changes include
AdapterExecContextand deploy lifecycle arguments;local_layout/ artifact kinds;manifest_option_fields;Option<Vec<String>>outbound hosts; explicitAdapterPushContext::cloud_target; fallible output; validation/provision signatures and non-exhaustive outcomes; scaffold defaults/tool/logging metadata. Shared filesystem/local helpers and regex require the shared crate'sclifeature. Out-of-tree adapters must update implementations and constructors.Before removing provider manifests or asking teammates to pull their removal, back up custom contents and commit supported tracked settings. Git deletes teammates' clean tracked copies;
git rm --cachedpreserves only the committer's copy. Copy required Spin outbound hosts into tracked adapter options first.Verify existing Cloudflare account ownership and recover binding-to-ID mappings from old config or deployed Worker settings; namespace listing supplies IDs/titles, not bindings. Commit verified primary/preview IDs into separate tracked deployed maps keyed by logical ID before the removal is pulled. Cloud provision skips unverified IDs found only in ignored Wrangler state; missing this migration can create duplicate namespaces. Recreate local manifests with project-CLI local provision and compare them with the backup.
Move existing Axum KV state to the project-root location while stopped. Comment older generated active-empty secret hints if they should remain unset; replace empty Spin defaults with required variables. Local provision/config requires declared manifest/crate paths.
Verification
CREATOR freshly executed 83 commands, all exit 0, at this head. An independent auditor verified the retained harness, logs, pinned environment, exact head and clean tracked source. Five non-Linux deploy-contract cases, thirteen illustrative doctests, and explicit runtime PENDING/UNSUPPORTED observations remain disclosed; successful command exits do not claim those missing hook verdicts. The entire key-override smoke passed 14/14, with a selective fake only for the Spin cloud subprocess; no live-cloud validation is claimed. Complete commands, exit codes, actual result lines and limitations.
Hosted GitHub Actions workflows at this exact head: Run Format success; Deploy actions success; CodeQL Advanced in_progress; Run Tests success. These are hosted results, separate from the local suite. REVIEWER acceptance remains required.
Review and handoff
The thirteen remaining inline findings and six follow-up notes receive labeled dispositions on their original threads, with correcting commits and current-head evidence. The non-inline core cleanup is also addressed; unrelated canonical-number/Deserialize changes are restored to base. Scope, account and audit record.
REVIEWER owns acceptance and thread resolution. The formal change request and REVIEWER REQUEST_CHANGES verdict have not been dismissed; no approval or merge authorization is claimed.
One-account mode: CREATOR and REVIEWER use
aram356, also the PR author. Branchfix/pr-287-nov02; PR branchfeature/provision-local-impl; adopted CREATOR worktree.claude/worktrees/pr-287-nov02. Keep the open PR's worktree, branches and reports; owned runtime cleanup is recorded with verification.Closes #288
Closes #289
Closes #290
Closes #291
Closes #292
Closes #293
Closes #294
Closes #295
Closes #296
Closes #297