Add native AWS store providers

.github/workflows/format.yml

@@ -28,6 +28,7 @@ jobs:
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
+            tests/fixtures/reusable-app/target/
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-
@@ -49,6 +50,12 @@ jobs:
       - name: Run cargo fmt
         run: cargo fmt --all -- --check
 
+      - name: Run cargo fmt (lifecycle fixtures)
+        run: cargo fmt --manifest-path tests/fixtures/reusable-app/Cargo.toml --all -- --check
+
+      - name: Run cargo clippy (native lifecycle fixtures)
+        run: cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core -p fixture-axum --all-targets -- -D warnings
+
       - name: Run cargo clippy
         run: cargo clippy --workspace --all-targets --all-features -- -D warnings
 
@@ -121,6 +128,7 @@ jobs:
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
+            tests/fixtures/reusable-app/target/
           key: ${{ runner.os }}-cargo-${{ matrix.adapter }}-clippy-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-${{ matrix.adapter }}-clippy-
@@ -166,6 +174,18 @@ jobs:
               -D warnings
           done <<<"${FEATURE_SETS}"
 
+      - name: Clippy ${{ matrix.adapter }} lifecycle fixture
+        env:
+          ADAPTER: ${{ matrix.adapter }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          target_args=()
+          if [[ "${TARGET}" != "native" ]]; then
+            target_args=(--target "${TARGET}")
+          fi
+          cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml \
+            -p "fixture-${ADAPTER}" "${target_args[@]}" --all-targets -- -D warnings
+
   format-docs:
     runs-on: ubuntu-latest
     defaults:

.github/workflows/test.yml

@@ -4,7 +4,8 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    # Native-store PRs are currently stacked on the outbound HTTP specification.
+    branches: [main, docs/outbound-http-spec]
 
 permissions:
   contents: read
@@ -29,6 +30,7 @@ jobs:
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
             target/
+            tests/fixtures/reusable-app/target/
           key: ${{ runner.os }}-cargo-test-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
             ${{ runner.os }}-cargo-test-
@@ -51,6 +53,7 @@ jobs:
         run: |
           cargo fetch --locked
           cargo fetch --locked --manifest-path examples/app-demo/Cargo.toml
+          cargo fetch --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml
 
       - name: No placeholder pins
         run: ./scripts/check_no_placeholder_pins.sh
@@ -90,9 +93,42 @@ jobs:
       - name: Nested AppConfig checker tests
         run: cargo test -p edgezero-cli --features nested-app-config-check --bin check_no_nested_app_config
 
+      - name: Lifecycle fixture host tests
+        run: |
+          cargo test --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core --features fixture-core/qualification
+          node --test scripts/qualify_response_egress.test.mjs
+
+      - name: Check Axum lifecycle fixture
+        run: cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-axum
+
+      - name: Check opt-in lifecycle qualification fixtures
+        # These are compile-only identities, never deployed qualification evidence.
+        env:
+          EDGEZERO_QUALIFICATION_REVISION: "0000000000000000000000000000000000000000"
+          EDGEZERO_QUALIFICATION_ARTIFACT: "0000000000000000000000000000000000000000000000000000000000000000"
+        run: |
+          cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-axum --features qualification
+          cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-fastly --features qualification --bin fixture-fastly-qualification --target wasm32-wasip1
+          cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-cloudflare --features qualification --target wasm32-unknown-unknown
+          cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-spin --features qualification --target wasm32-wasip2
+
       - name: Run workspace tests
         run: cargo test --workspace --all-targets
 
+      - name: Native store dependency isolation
+        run: bash scripts/check_native_store_dependency_contract.sh
+
+      - name: Native AWS provider and startup contracts (loopback only)
+        run: |
+          cargo test --offline --locked -p edgezero-store-aws --no-default-features --features appconfig-agent --lib
+          cargo test --offline --locked -p edgezero-store-aws --no-default-features --features secrets-manager --lib
+          cargo test --offline --locked -p edgezero-store-aws --no-default-features --features dynamodb-kv --lib
+          cargo test --offline --locked -p edgezero-store-aws --all-features --lib
+          scripts/run_test_nonzero.sh production_runner_loads_envelope_and_real_sdk_secret_before_serving_mixed_stores cargo test --offline --locked -p edgezero-adapter-axum --features aws-stores,test-utils --test native_aws_startup
+
+      - name: Bundled demo logging contract
+        run: scripts/run_test_nonzero.sh demo_respects_off_without_hiding_terminal_errors cargo test --offline --locked -p edgezero-cli --features demo-example --test demo_logging
+
       - name: Run native outbound adapter contracts
         run: |
           scripts/run_test_nonzero.sh batch_preflight_precedence_and_indices cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum,test-utils --test contract
@@ -123,6 +159,24 @@ jobs:
             bash scripts/check_adapter_feature_matrix.sh "${adapter}" native
           done
 
+      - name: Generated native AWS startup (loopback only)
+        env:
+          EDGEZERO_GENERATED_TEST_TARGET_DIR: ${{ github.workspace }}/target
+        run: scripts/run_test_nonzero.sh --ignored generated_cli_build_features_and_native_aws_startup_are_proven_together cargo test --offline --locked -p edgezero-cli --test native_store_generated_proof
+
+      - name: Generated native DynamoDB KV (loopback only)
+        env:
+          EDGEZERO_GENERATED_TEST_TARGET_DIR: ${{ github.workspace }}/target
+        run: scripts/run_test_nonzero.sh --ignored generated_cli_default_off_and_enabled_dynamodb_crud_list_ttl_restart cargo test --offline --locked -p edgezero-cli --test dynamodb_generated_proof
+
+      - name: Native AWS integration runner tests
+        run: node --test scripts/native_aws_test_admin.test.mjs scripts/run_native_aws_integration.test.mjs
+
+      - name: Generated native AWS independent service contracts
+        env:
+          EDGEZERO_GENERATED_TEST_TARGET_DIR: ${{ github.workspace }}/target
+        run: node scripts/run_native_aws_integration.mjs
+
       - name: Verify a generated project compiles
         run: scripts/run_test_nonzero.sh --ignored generated_workspace_compiles cargo test --offline --locked -p edgezero-cli --test generated_project_builds
 
@@ -188,6 +242,7 @@ jobs:
             ~/.cargo/git/db/
             ~/.wasmtime/bin/
             target/
+            tests/fixtures/reusable-app/target/
           key: ${{ runner.os }}-cargo-${{ matrix.adapter }}-${{ hashFiles('**/Cargo.lock', '.tool-versions') }}
           restore-keys: |
             ${{ runner.os }}-cargo-${{ matrix.adapter }}-
@@ -323,3 +378,19 @@ jobs:
 
       - name: Check ${{ matrix.adapter }} wasm feature matrix
         run: bash scripts/check_adapter_feature_matrix.sh ${{ matrix.adapter }} ${{ matrix.target }}
+      - name: Fastly reusable HTTP smoke
+        if: matrix.adapter == 'fastly'
+        run: ./scripts/smoke_test_reusable_app.sh --adapter fastly --suite smoke
+
+      - name: Preserve Fastly lifecycle evidence
+        if: always() && matrix.adapter == 'fastly'
+        uses: actions/upload-artifact@v4
+        with:
+          name: fastly-lifecycle-evidence
+          path: tests/fixtures/reusable-app/.runs/
+          include-hidden-files: true
+          if-no-files-found: ignore
+          retention-days: 7
+
+      - name: Check ${{ matrix.adapter }} lifecycle fixture
+        run: cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-${{ matrix.adapter }} --target ${{ matrix.target }} --all-targets