DO NOT MERGE: integration-only AWS prospect demo RC (not for review)

.claude/agents/code-architect.md

@@ -16,7 +16,7 @@ architectural principles:
 
 3. **Thin adapters**: each adapter translates platform types to/from core types.
    Business logic never lives in adapters. The adapter file structure is:
-   `context.rs`, `request.rs`, `response.rs`, `proxy.rs`, `logger.rs`, `cli.rs`.
+   `context.rs`, `request.rs`, `response.rs`, `outbound.rs`, `logger.rs`, `cli.rs`.
 
 4. **Contract testing**: every adapter has `tests/contract.rs` that validates
    request/response mapping. New adapters must follow this pattern.

.claude/commands/check-ci.md

@@ -1,8 +1,9 @@
-Run the full CI gate checks locally before pushing. Run all four commands sequentially and report any failures:
+Run the full CI gate checks locally before pushing. Run all five commands sequentially and report any failures:
 
 1. `cargo fmt --all -- --check`
 2. `cargo clippy --workspace --all-targets --all-features -- -D warnings`
 3. `cargo test --workspace --all-targets`
-4. `cargo check --workspace --all-targets --features "fastly cloudflare"`
+4. `cargo test -p edgezero-core --doc`
+5. `cargo check --workspace --all-targets --features "fastly cloudflare"`
 
 If any step fails, show the errors and suggest fixes. Do not proceed to the next step until the current one passes.

.github/actions/deploy-core/tests/run.sh

@@ -2795,8 +2795,8 @@ test_fastly_logical_link_documentation() {
     grep -Fq -- '--service-id "$FASTLY_SERVICE_ID"' "$fastly_deployment"
   assert_fails "Fastly managed deployment does not recommend direct provider deployment" \
     grep -Fq 'fastly compute deploy' "$fastly_deployment"
-  assert_succeeds "bare Fastly deploy is explicitly store-free production compatibility" \
-    grep -Fq 'store-free production compatibility' "$fastly_deployment_flat"
+  assert_succeeds "bare Fastly deploy is explicitly limited to store-free production" \
+    grep -Fq 'supports store-free production deployments using a manifest command' "$fastly_deployment_flat"
 
   # shellcheck disable=SC2016 # GitHub expression is the literal documentation contract.
   assert_fails "lifecycle examples do not reference a cross-job archive path output" \

.github/workflows/axum-container.yml

@@ -0,0 +1,189 @@
+name: Axum container preparation
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - .github/workflows/axum-container.yml
+      - Cargo.toml
+      - Cargo.lock
+      - .tool-versions
+      - crates/**
+      - examples/app-demo/**
+      - examples/container-publishing/**
+      - examples/axum-deployment/**
+      - scripts/*axum_container*.sh
+      - scripts/axum_container*.mjs
+      - scripts/tests/test_axum_container*.test.mjs
+      - docs/guide/*axum-containers.md
+      - docs/guide/adapters/axum.md
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/axum-container.yml
+      - Cargo.toml
+      - Cargo.lock
+      - .tool-versions
+      - crates/**
+      - examples/app-demo/**
+      - examples/container-publishing/**
+      - examples/axum-deployment/**
+      - scripts/*axum_container*.sh
+      - scripts/axum_container*.mjs
+      - scripts/tests/test_axum_container*.test.mjs
+      - docs/guide/*axum-containers.md
+      - docs/guide/adapters/axum.md
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  prepare:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "24.12.0"
+      - name: Use the declared Rust toolchain
+        run: |
+          version=$(awk '$1 == "rust" { print $2 }' .tool-versions)
+          rustup toolchain install "$version" --profile minimal
+          echo "RUSTUP_TOOLCHAIN=$version" >> "$GITHUB_ENV"
+      - name: Prepare one application and lockfile
+        run: |
+          ./scripts/prepare_generated_axum_container.sh "$RUNNER_TEMP/fixture"
+          AXUM_PREPARED_CONTEXT="$RUNNER_TEMP/fixture/container-probe" \
+            node --test scripts/tests/test_axum_container*.test.mjs
+          tar -C "$RUNNER_TEMP/fixture" -cf "$RUNNER_TEMP/context.tar" container-probe
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: axum-context-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/context.tar
+          if-no-files-found: error
+          retention-days: 7
+
+  native:
+    needs: prepare
+    timeout-minutes: 30
+    # Framework packaging evidence is not application release approval.
+    env:
+      SCAN_POLICY: report-only
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "24.12.0"
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: axum-context-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/context
+          digest-mismatch: error
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        with:
+          version: v0.37.0
+          use: false
+          driver-opts: image=moby/buildkit:v0.25.1@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6
+      - name: Native image, packaging, scan and OCI identity checks
+        env:
+          ARCH: ${{ matrix.arch }}
+        run: |
+          tar -C "$RUNNER_TEMP/context" -xf "$RUNNER_TEMP/context/context.tar" --no-same-owner
+          ./scripts/test_axum_container_handoff.sh build \
+            "$RUNNER_TEMP/context/container-probe" "$RUNNER_TEMP/accepted" \
+            "linux/$ARCH" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: accepted-${{ matrix.arch }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/accepted/image.tar
+            ${{ runner.temp }}/accepted/receipt.json
+            ${{ runner.temp }}/accepted/inputs.json
+            ${{ runner.temp }}/accepted/scan.json
+            ${{ runner.temp }}/accepted/scanner.json
+            ${{ runner.temp }}/accepted/sbom.json
+            ${{ runner.temp }}/accepted/provenance.json
+          if-no-files-found: error
+          retention-days: 7
+      - name: Retain sanitized failure evidence separately
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: failed-${{ matrix.arch }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/accepted/*.log
+            ${{ runner.temp }}/accepted/scan.json
+            ${{ runner.temp }}/accepted/scanner.json
+            ${{ runner.temp }}/accepted/image.json
+            ${{ runner.temp }}/accepted/inputs.json
+            ${{ runner.temp }}/accepted/smoke
+          if-no-files-found: warn
+          retention-days: 7
+
+  handoff:
+    needs: native
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      SCAN_POLICY: report-only
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "24.12.0"
+      - name: Select exact immutable artifacts from this run and attempt
+        id: artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/artifacts?per_page=100" > "$RUNNER_TEMP/artifacts.json"
+          ids=$(node examples/container-publishing/verify_artifacts.mjs artifact-ids \
+            "$RUNNER_TEMP/artifacts.json" --run-id "$GITHUB_RUN_ID" --attempt "$GITHUB_RUN_ATTEMPT")
+          echo "ids=$ids" >> "$GITHUB_OUTPUT"
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          artifact-ids: ${{ steps.artifacts.outputs.ids }}
+          path: ${{ runner.temp }}/bundles
+          digest-mismatch: error
+      - name: Import accepted variants in a separate job without rebuilding
+        run: |
+          for arch in amd64 arm64; do
+            ./scripts/test_axum_container_handoff.sh import \
+              "$RUNNER_TEMP/bundles/accepted-$arch-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+              "$RUNNER_TEMP/import-$arch" "linux/$arch" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          done
+      - name: Assemble and verify a localhost runtime index without external publication
+        run: |
+          source examples/container-publishing/tools.env
+          registry="axum-index-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          trap 'docker rm -f "$registry" >/dev/null 2>&1 || true' EXIT
+          docker run -d --name "$registry" -p 127.0.0.1::5000 "$REGISTRY_IMAGE"
+          port=$(docker port "$registry" 5000/tcp | awk -F: '{print $NF}')
+          for _ in $(seq 1 30); do curl --fail --silent "http://127.0.0.1:$port/v2/" && break; sleep 1; done
+          ./examples/container-publishing/publish.sh "127.0.0.1:$port/fixture" fixture \
+            "$RUNNER_TEMP/bundles/accepted-amd64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+            "$RUNNER_TEMP/bundles/accepted-arm64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
+            "$RUNNER_TEMP/index" "$GITHUB_SHA" "$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"

.github/workflows/deploy-action.yml

@@ -3,6 +3,16 @@ name: Deploy actions
 on:
   pull_request:
     paths:
+      - scripts/*axum_container*.sh
+      - scripts/axum_container*.mjs
+      - scripts/tests/test_axum_container*.test.mjs
+      - examples/container-publishing/**
+      - examples/axum-deployment/**
+      - docs/guide/*axum-containers.md
+      # ANY workflow or action change must start the repository-wide pin gate (and
+      # the smokes) — including a brand-new action directory or an unrelated
+      # workflow like test.yml that could introduce a floating ref.
+
       - .github/actions/**
       - .github/workflows/**
       - .github/zizmor.yml
@@ -23,6 +33,16 @@ on:
   push:
     branches: [main]
     paths:
+      - scripts/*axum_container*.sh
+      - scripts/axum_container*.mjs
+      - scripts/tests/test_axum_container*.test.mjs
+      - examples/container-publishing/**
+      - examples/axum-deployment/**
+      - docs/guide/*axum-containers.md
+      # ANY workflow or action change must start the repository-wide pin gate (and
+      # the smokes) — including a brand-new action directory or an unrelated
+      # workflow like test.yml that could introduce a floating ref.
+
       - .github/actions/**
       - .github/workflows/**
       - .github/zizmor.yml
@@ -81,12 +101,16 @@ jobs:
       - name: Actionlint
         run: |
           "$RUNNER_TEMP/tools/bin/actionlint" -shellcheck='shellcheck -S warning'
+          "$RUNNER_TEMP/tools/bin/actionlint" -shellcheck='shellcheck -S warning' examples/container-publishing/release.yml
 
       - name: Third-party action pin gate
-        run: .github/actions/deploy-core/tests/check-action-pins.sh
+        run: |
+          .github/actions/deploy-core/tests/check-action-pins.sh
+          .github/actions/deploy-core/tests/check-action-pins.sh examples/container-publishing/release.yml
 
       - name: Zizmor security scan
-        run: '"$RUNNER_TEMP/tools/bin/zizmor" --offline .github'
+        run: '"$RUNNER_TEMP/tools/bin/zizmor" --offline .github examples/container-publishing/release.yml'
+
 
       - name: ShellCheck action scripts
         run: |
@@ -95,7 +119,16 @@ jobs:
             .github/actions/*/tests/*.sh \
             .github/actions/deploy-core/tests/*.sh \
             scripts/install-actionlint.sh \
-            scripts/install-yq.sh
+            scripts/install-yq.sh \
+            scripts/*axum_container*.sh \
+            examples/container-publishing/publish.sh
+
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "24.12.0"
+
+      - name: Container helper unit tests
+        run: node --test scripts/tests/test_axum_container*.test.mjs
 
       - name: Bash contract tests
         run: .github/actions/deploy-core/tests/run.sh