Add local GeoLite provider and checked-IP Geo inputs for Axum

.github/workflows/format.yml

@@ -4,7 +4,8 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    # Keep lint gates active for native-store and Geo stacked PRs.
+    branches: [main, feat/native-celld-stores, feature/pluggable-geo-providers]
 
 permissions:
   contents: read
@@ -117,6 +118,12 @@ jobs:
             feature_sets: |-
               axum
               axum,test-utils
+              geo-cloudfront
+              geo-cloudfront,test-utils
+              geo-maxmind
+              geo-maxmind,test-utils
+              geo-cloudfront,geo-maxmind
+              geo-cloudfront,geo-maxmind,test-utils
     steps:
       - uses: actions/checkout@v6
 

.github/workflows/test.yml

@@ -4,7 +4,14 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    # Keep checks active for native-store and Geo stacked PRs.
+    branches:
+      [
+        main,
+        docs/outbound-http-spec,
+        feat/native-celld-stores,
+        feature/pluggable-geo-providers,
+      ]
 
 permissions:
   contents: read
@@ -114,6 +121,61 @@ jobs:
       - name: Run workspace tests
         run: cargo test --workspace --all-targets
 
+      - name: Native store dependency isolation
+        run: bash scripts/check_native_store_dependency_contract.sh
+
+      - name: Geo dependency isolation
+        run: bash scripts/check_geo_dependency_contract.sh
+
+      - name: Synthetic GeoIP fixture reproducibility
+        run: |
+          node --check scripts/generate_geoip_fixtures.mjs
+          node scripts/generate_geoip_fixtures.mjs --check
+
+      - name: Immutable core Geo outcome
+        run: scripts/run_test_nonzero.sh geo_owned_outcome_survives_public_request_mutation cargo test --offline --locked -p edgezero-core --lib geo_
+
+      - name: Native Geo disabled implementation and policy unit contracts
+        run: |
+          scripts/run_test_nonzero.sh geo_protected_policy_reuses_network_bounds cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum --lib geo::
+          scripts/run_test_nonzero.sh geo_unavailable_selection_fails_before_runner_resources cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum --lib geo_
+
+      - name: Native Geo supplied-provider unit contract without built-in
+        run: scripts/run_test_nonzero.sh source_admission_precedes_header_inspection_and_provider_calls cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum --lib source_admission_precedes_header_inspection_and_provider_calls
+
+      - name: Native Geo enabled implementation and managed dispatch unit contracts
+        run: |
+          scripts/run_test_nonzero.sh geo_cloudfront_parsing_matches_spec cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features geo-cloudfront --lib geo::
+          scripts/run_test_nonzero.sh geo_managed_resolution_runs_once_from_owned_ingress cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features geo-cloudfront --lib geo_
+          cargo test --offline --locked -p edgezero-adapter-axum --features geo-cloudfront --lib service::tests
+
+      - name: Native Geo disabled built-in hosting (loopback only)
+        run: scripts/run_test_nonzero.sh geo_hosting_rejects_unavailable_cloudfront cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum,test-utils --test production_hosting geo_hosting_rejects_unavailable_cloudfront
+
+      - name: Native Geo supplied provider without built-in (loopback only)
+        run: scripts/run_test_nonzero.sh geo_hosting_supplied_provider_without_builtin cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum,test-utils --test production_hosting geo_hosting_supplied_provider_without_builtin
+
+      - name: Native Geo real-peer hosting (loopback only)
+        run: scripts/run_test_nonzero.sh geo_hosting_proves_real_peer_and_shared_outcome cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features geo-cloudfront,test-utils --test production_hosting geo_hosting_proves_real_peer_and_shared_outcome
+
+      - name: Native AWS provider and startup contracts (loopback only)
+        run: |
+          cargo test --offline --locked -p edgezero-store-aws --no-default-features --features appconfig-agent --lib
+          cargo test --offline --locked -p edgezero-store-aws --no-default-features --features secrets-manager --lib
+          cargo test --offline --locked -p edgezero-store-aws --no-default-features --features dynamodb-kv --lib
+          cargo test --offline --locked -p edgezero-store-aws --all-features --lib
+          scripts/run_test_nonzero.sh production_runner_loads_envelope_and_real_sdk_secret_before_serving_mixed_stores cargo test --offline --locked -p edgezero-adapter-axum --features aws-stores,test-utils --test native_aws_startup
+
+      - name: Native celld independent provider and startup contracts (loopback only)
+        run: |
+          cargo test --offline --locked -p edgezero-store-celld --no-default-features --lib
+          cargo test --offline --locked -p edgezero-store-celld --no-default-features --features config --lib
+          cargo test --offline --locked -p edgezero-store-celld --no-default-features --features kv --lib
+          cargo test --offline --locked -p edgezero-store-celld --all-features --lib
+          cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features native-bindings --lib
+          cargo test --offline --locked -p edgezero-adapter-axum --features celld-config,celld-kv,test-utils --test native_celld_startup
+          cargo test --offline --locked -p edgezero-adapter-axum --features aws-stores,aws-dynamodb,celld-config,celld-kv,test-utils --lib --test native_aws_startup --test native_celld_startup
+
       - name: Bundled demo logging contract
         run: scripts/run_test_nonzero.sh demo_respects_off_without_hiding_terminal_errors cargo test --offline --locked -p edgezero-cli --features demo-example --test demo_logging
 
@@ -147,6 +209,29 @@ jobs:
             bash scripts/check_adapter_feature_matrix.sh "${adapter}" native
           done
 
+      - name: Generated native AWS startup (loopback only)
+        env:
+          EDGEZERO_GENERATED_TEST_TARGET_DIR: ${{ github.workspace }}/target
+        run: scripts/run_test_nonzero.sh --ignored generated_cli_build_features_and_native_aws_startup_are_proven_together cargo test --offline --locked -p edgezero-cli --test native_store_generated_proof
+
+      - name: Generated native DynamoDB KV (loopback only)
+        env:
+          EDGEZERO_GENERATED_TEST_TARGET_DIR: ${{ github.workspace }}/target
+        run: scripts/run_test_nonzero.sh --ignored generated_cli_default_off_and_enabled_dynamodb_crud_list_ttl_restart cargo test --offline --locked -p edgezero-cli --test dynamodb_generated_proof
+
+      - name: Generated native celld startup and KV (deterministic loopback fixture)
+        env:
+          EDGEZERO_GENERATED_TEST_TARGET_DIR: ${{ github.workspace }}/target
+        run: scripts/run_test_nonzero.sh --ignored generated_celld_default_off_kv_and_config_restart cargo test --offline --locked -p edgezero-cli --no-default-features --features cli,edgezero-adapter-axum --test celld_generated_proof generated_celld_default_off_kv_and_config_restart
+
+      - name: Native provider integration runner tests
+        run: node --test scripts/native_aws_test_admin.test.mjs scripts/run_native_aws_integration.test.mjs scripts/run_native_celld_integration.test.mjs
+
+      - name: Generated native AWS independent service contracts
+        env:
+          EDGEZERO_GENERATED_TEST_TARGET_DIR: ${{ github.workspace }}/target
+        run: node scripts/run_native_aws_integration.mjs
+
       - name: Verify a generated project compiles
         run: scripts/run_test_nonzero.sh --ignored generated_workspace_compiles cargo test --offline --locked -p edgezero-cli --test generated_project_builds
 
@@ -177,6 +262,81 @@ jobs:
           cargo check --locked -p app-demo-adapter-fastly --target wasm32-wasip1 --no-default-features --features fastly
           cargo check --locked -p app-demo-adapter-spin --target wasm32-wasip2 --no-default-features --features spin
 
+  geo-features:
+    name: Geo isolated features [${{ matrix.features }}]
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - features: axum
+            cache_key: axum
+            builtin_sentinel: geo_unavailable_selection_fails_before_runner_resources
+          - features: geo-cloudfront
+            cache_key: cloudfront
+            builtin_sentinel: geo_cloudfront_parsing_matches_spec
+          - features: geo-maxmind
+            cache_key: maxmind
+            builtin_sentinel: geo_maxmind_structural_pass_closes_upstream_data_gaps
+          - features: geo-cloudfront,geo-maxmind
+            cache_key: cloudfront-maxmind
+            builtin_sentinel: geo_maxmind_structural_pass_closes_upstream_data_gaps
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Cache Cargo dependencies
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-geo-${{ matrix.cache_key }}-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Retrieve Rust version
+        id: rust-version
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+        shell: bash
+
+      - name: Set up Rust tool chain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: ${{ steps.rust-version.outputs.rust-version }}
+
+      - name: Fetch dependencies (locked)
+        run: cargo fetch --locked
+
+      - name: Isolated Geo unit contracts
+        env:
+          FEATURES: ${{ matrix.features }}
+          SENTINEL: ${{ matrix.builtin_sentinel }}
+        run: |
+          scripts/run_test_nonzero.sh "$SENTINEL" cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features "$FEATURES" --lib geo_
+          scripts/run_test_nonzero.sh geo_reader_admission_uses_private_checked_provenance cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features "$FEATURES" --lib geo_reader_admission_uses_private_checked_provenance
+
+      - name: Supplied reader hosting without required built-ins
+        env:
+          FEATURES: ${{ matrix.features }}
+        run: scripts/run_test_nonzero.sh geo_hosting_supplied_reader_without_builtin cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features "$FEATURES,test-utils" --test production_hosting geo_hosting_supplied_reader_without_builtin
+
+      - name: Disabled MaxMind fails before hosting
+        if: "!contains(matrix.features, 'geo-maxmind')"
+        env:
+          FEATURES: ${{ matrix.features }}
+        run: scripts/run_test_nonzero.sh geo_hosting_rejects_unavailable_maxmind cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features "$FEATURES,test-utils" --test production_hosting geo_hosting_rejects_unavailable_maxmind
+
+      - name: MaxMind snapshot and restart hosting
+        if: contains(matrix.features, 'geo-maxmind')
+        env:
+          FEATURES: ${{ matrix.features }}
+        run: scripts/run_test_nonzero.sh geo_hosting_maxmind_snapshot_and_restart cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features "$FEATURES,test-utils" --test production_hosting geo_hosting_
+
+      - name: Public examples with isolated features
+        env:
+          FEATURES: ${{ matrix.features }}
+        run: cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features "$FEATURES" --doc
+
   adapter-wasm-tests:
     name: ${{ matrix.adapter }} wasm tests
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## Unreleased
 
+### Axum local GeoIP and breaking Geo input migration
+
+Draft implementation, not accepted for release. Full metadata-corruption rejection remains blocked
+by the pinned reader API, with an explicit ignored regression. File acquisition is Unix-only;
+non-Unix selection reports implementation unavailability. Production-size measurements remain open.
+
+- Add default-off `geo-maxmind` for an operator-supplied GeoLite2 City or Country MMDB.
+  Prepare and validate a bounded, read-only in-memory snapshot before initialization and binding.
+  Updates require restart; active processes retain their snapshot after source replacement/deletion.
+  Preparation precedes runtime signal/stop polling and has no filesystem I/O deadline.
+- Add explicit `PeerAllowed`/`ForwardedRequired` checked-reader selection and
+  `SuppliedReaderIp` composition, which works with `axum` alone. No geographic-header fallback,
+  downloader, remote lookup or automatic permission decision is added.
+- Breaking pre-release migration: replace `GeoInput { country, subdivision }` with
+  `GeoInput::Assertions { country, subdivision }`, match fields by variant, and explicitly handle
+  or reject `ReaderIp { address, source }`. Update exhaustive matches for resolution `NoMatch`,
+  unavailable `MissingReaderIp`/`NoMatch`, source `LocalDatabase`/`CheckedReaderIp` and trust basis
+  `CheckedReaderIp(GeoIpSource)`. Unsupported inputs return `ProviderFailure`.
+- Replace capability's `Selected { provider, source, trust_basis }` with
+  `Selected { provider, input: NativeGeoInputContract }`. Capability validates configuration
+  without database I/O and does not describe request provenance. Reserve custom provider ID
+  `maxmind` alongside `cloudfront`. No compatibility aliases or unrelated version bumps.
+- Document mounts, proxy trust, redaction, uncertainty, dataset attribution and operator-owned
+  update/deletion duties, including running snapshots and rollback copies, in the
+  [native Geo guide](docs/guide/native-geo.md).
+
 ### Portable HTTP And Request Lifecycles (PR #275)
 
 The changes below cover [PR #275](https://github.com/stackpop/edgezero/pull/275), including its