Upgrade EdgeZero to v0.0.6

[aram356]

Summary

Upgrades the six edgezero workspace dependencies from tag = "v0.0.4" to tag = "v0.0.6", the release containing the squash-merge of stackpop/edgezero#316 (deploy actions + Fastly staging lifecycle), and adapts Trusted Server to its API changes.

• Repoint edgezero-adapter-{axum,cloudflare,fastly,spin}, edgezero-cli, and edgezero-core at tag = "v0.0.6" (c8d6e414); the lock is rebuilt from main with a scoped update, so the only non-edgezero lock changes are syn 3.0.4 and toml_edit 0.25.12 (both required by the edgezero tree).
• Wire the new ts CLI subcommands surfaced by edgezero-cli — active-version, healthcheck, rollback, config gc — plus deploy --staging, config push/diff --staging, and a top-level --version flag, with argument-parsing coverage.
• Document the new lifecycle and config gc surface in docs/guide/cli.md: the staged-deploy config leg, capture-before-deploy rollback ordering, Fastly-only labeling, the destructive config gc --yes / --store semantics, and the deploy -- passthrough migration.
• Migrate TrustedServerAppConfig to the AppConfigMeta::secret_fields() method that replaces the removed SECRET_FIELDS associated constant.

Known limitation (staging config selectors)

A staged version currently loads the production config blob: Trusted Server's Fastly entry point bypasses edgezero_adapter_fastly::run_app and never reads the version-linked edgezero_runtime_env selectors that a staged deploy redirects. The clean fix needs edgezero to expose its runtime-env loader as public API (the store name and key derivation are upstream internals; duplicating them here would drift):

• Expose a public runtime-env EnvConfig API for custom Fastly entry points stackpop/edgezero#349 — expose a public runtime-env EnvConfig API for custom Fastly entry points; fix open as Expose runtime_env_config for custom Fastly entry points stackpop/edgezero#351
• Staged deploys load production config: resolve config selectors from edgezero_runtime_env #1082 — wire it here once available, with a staging-vs-production selector adapter test
• Rollback error hint references a deploy previous-version output that does not exist stackpop/edgezero#350 — run_rollback's error hint references a deploy previous-version output that does not exist; fix open as Fix rollback hint to reference a capture route that exists stackpop/edgezero#352

docs/guide/cli.md carries a known-limitation callout warning operators not to rely on --staging to validate config changes until this lands.

Upstream merge resolution

#316 was squash-merged — the different-bytes case flagged in review — so the repin was treated as a content change: the CLI argument surface is byte-identical between the prior 5f3d648c pin and v0.0.6, the documented behaviors (healthcheck attempts = retry.max(1) clamp, selector-only staging mirror, leaves-only env overlay) were re-verified at the tag, and the full local gate list was re-run. Lockstep reminder for the deployer (outside this repo): move deploy-fastly@<ref> to v0.0.6 when adopting the actions.

Verification

All CI gates re-run locally against v0.0.6 and pass:

• cargo fmt --all -- --check — clean
• cargo clippy — fastly, axum, cloudflare native + wasm, spin native + wasm — clean
• Tests — core 2181, fastly/axum/cloudflare/spin adapters, host CLI (169), integration parity (13) — all pass
• JS build + vitest (871) + prettier — clean; docs prettier — clean
• Lock validated with cargo metadata --locked

Out of scope

• Adopting the new deploy GitHub Actions (deploy-fastly / healthcheck-fastly / rollback-fastly) in this repo's workflows is separate, unstarted work.
• Embedding the resolved edgezero rev in ts --version output (reviewer suggestion) is a follow-up.

Closes #939

[aram356]

Status update — P0/P1 tracking

Head: `96dd1f72` (main merged in twice since the original commit; edgezero dep unchanged, no conflicts).

P0.2 — CI + output-line contract

• Local verification at head is green: fmt, clippy (fastly), core+fastly tests (1648+99), vitest (411). The earlier red checks were a systemic/environmental run on `96dd1f72` (every job failed, incl. JS/fmt that pass locally) — fresh reruns of all four workflows are in progress.
• Machine-readable output lines the deployer parses are verified end-to-end. All three are emitted by edgezero-cli at `log::info!` (Info→stdout), and `ts`'s `main.rs` calls `edgezero_cli::init_cli_logger()`, so they reach stdout rather than being swallowed:

  Line	Source (edgezero @ 145f1699)
  `version=`	`edgezero-cli/src/lib.rs:253`
  `pushed-key=`	`edgezero-cli/src/config.rs:386`
  `rolled-back-to=`	`edgezero-adapter-fastly/src/cli.rs:2807`

• Dispatcher/arg-parse tests for `active-version`, `healthcheck`, `rollback` are in `crates/trusted-server-cli/src/run.rs`.

P1.3 — edgezero library ↔ action lockstep (recorded pair)

The `ts` CLI is built from this repo's `Cargo.toml` (edgezero library rev), and the deployer separately pins `stackpop/edgezero/.github/actions/deploy-fastly@` (edgezero action ref). These MUST be the same edgezero commit so library and action can't diverge.

• Current pair: both = `stackpop/edgezero@145f1699` (branch `feature/edgezero-deploy-actions`).
• On merge: when edgezero Remove immutable cache headers from integrations #316 lands and is tagged, move BOTH the six `Cargo.toml` deps and the deployer's `deploy-fastly@` to that same tag/SHA in lockstep.

P0.1 — re-pin off the moving branch (blocker, still open)

edgezero #316 is not yet merged and no new tag exists. Cannot re-pin until it lands; PR stays draft until then.

[prk-Jr]

Summary

Tight, well-tested upgrade: six edgezero deps repointed at the deploy-actions branch, SECRET_FIELDS migrated to secret_fields(), and the new active-version / healthcheck / rollback / config gc subcommands wired through with argument-parsing coverage for each. Dispatch is a clean passthrough and every new command has a doc comment. Two things block: the dependency reference is mutable while upstream #316 is still open, and the operator docs weren't updated for the new (partly destructive) surface.

Blocking

🔧 wrench

• Mutable branch = dep on an unmerged upstream PR (Cargo.toml:57-62): upstream stackpop/edgezero#316 is confirmed open / merged: false, but this PR is isDraft: false and MERGEABLE. See the inline comment for the rev pin suggestion.

• docs/guide/cli.md not updated for the new CLI surface: four subcommands ship undocumented — active-version, healthcheck, rollback, and config gc. config gc is the one that matters most: with --yes and --older-than it destructively sweeps config-store entries, and the only place its semantics are written down right now is a one-line clap doc string and three parse tests. The "Lifecycle commands" block (docs/guide/cli.md:79-90) and "Configuration commands" block (:43-77) both enumerate the available commands, so they read as complete and are now silently wrong.

  The same file also carries a version claim that this PR invalidates (docs/guide/cli.md:67-70):

  EdgeZero v0.0.4 only overrides leaves already present in the TOML; add newly introduced fields to existing configs before relying on their overrides.

  The dependency is no longer v0.0.4. Either confirm the behavior still holds on the new tree and drop the version qualifier, or update it to whatever gets pinned at merge time.

Non-blocking

🤔 thinking

• Unrelated dependency downgrades in the lock refresh (Cargo.lock): windows-sys 0.61.2 → 0.48.0 and itertools 0.13.0 → 0.10.5. Details and a scoped cargo update inline.

🌱 seedling

• ts --version can't identify the embedded edgezero (crates/trusted-server-cli/src/run.rs:16): follow-up, not this PR.

📝 note

• secret_fields() port (crates/trusted-server-core/src/config.rs:115): mechanical and correct; the empty-set caveat above it is unchanged.

👍 praise

• deploy_rejects_renamed_stage_flag_before_separator (crates/trusted-server-cli/src/run.rs:306): catches a silent staging→production routing hazard created by the upstream flag rename plus last = true passthrough.

CI Status

All 19 checks green on fe5767e — reported from GitHub, not re-run locally:

• fmt: PASS
• clippy (fastly / axum / cloudflare native + wasm / spin native + wasm): PASS
• rust tests (core, axum, cloudflare, spin, ts CLI, cross-adapter parity): PASS
• integration + browser integration + Fastly EC lifecycle: PASS
• js tests (vitest) / format-typescript / format-docs: PASS
• CodeQL (actions, javascript-typescript, rust): PASS

[prk-Jr]

Summary

Re-review of the three commits added since the last pass (f90f6384, bf47680d, 40dd9b37). Both prior findings are resolved: the six deps moved from a mutable branch = ref to rev = 5f3d648c…, and the unrelated lock downgrades are gone from the diff. Verified independently — 5f3d648c is an ancestor of the branch tip b3e02111 (behind_by: 0), and the v0.0.5 tag is genuinely diverged from the pin (117 behind / 134 ahead), so the "no tag contains it" reasoning holds.

What remains blocking is the upstream merge gate plus one gap in the new staging docs: the documented deploy --staging → healthcheck --staging sequence never mentions the config leg, so following it literally stages a version pointed at a config key nothing wrote.

4 of the inline comments below carry a one-click GitHub suggestion — use Commit suggestion (or Add suggestion to batch) to apply them as commits on the PR branch. The remaining comments describe the fix in prose because the change is "wait for upstream", needs a new test function, or touches files outside this diff.

Blocking

🔧 wrench

• Upstream #316 still open; branch-only reachability and squash-merge consequences — see inline at Cargo.toml:57
• Staged-deploy docs omit the config leg — see inline at docs/guide/cli.md:120-123

Non-blocking

♻️ refactor

• --retry 3 is 3 total attempts, not 3 retries — see inline at docs/guide/cli.md:140-141 and crates/trusted-server-cli/src/run.rs:182
• config_gc_previews_by_default never asserts yes — see inline at crates/trusted-server-cli/src/run.rs:489

🤔 thinking

• secret_fields() comment names a blocker this upgrade removes — see inline at crates/trusted-server-core/src/config.rs:115

⛏ nitpick

• No test for the new top-level --version — see inline at crates/trusted-server-cli/src/run.rs:16

Cross-cutting / body-level findings

• ♻️ 40dd9b37 missed two live v0.0.4 qualifiers. The commit dropped the stale version qualifier across docs/guide/*.md, but two non-archival sites still restate exactly the same claim:

  • trusted-server.example.toml:124 — the operator-facing template: "Keep this leaf present when using the EdgeZero v0.0.4 environment override."
  • crates/trusted-server-cli/tests/config_env_overlay.rs:47 — "EdgeZero v0.0.4 environment overlays cannot create missing TOML leaves, …"

  Neither file is in this diff, so neither can carry a suggestion — apply manually, dropping v0.0.4 the same way the docs did. (docs/superpowers/plans/2026-07-15-gam-ts-cohort-attribution.md:835 also mentions it, but that is a dated archived plan describing a past experiment; leaving it is defensible.)

  Separately, the genericization itself checks out: at the pinned rev apply_env_overlay still only overrides keys already present in the parsed tree, and env_overlay_only_overrides_existing_keys asserts an env var for an absent key is silently ignored. So this is a by-design property, not a v0.0.4 bug, and dropping the version qualifier is the right call.

• 📝 Two syn majors and two toml_edit majors now compile. The lock carries syn 2.0.118 alongside the new syn 3.0.3 (pulled by edgezero-macros), and toml_edit 0.23.10+spec-1.0.0 alongside 0.25.12+spec-1.1.0. Both duplicates are host-build-only — proc-macro expansion and CLI-side TOML editing — with no wasm32-wasip1 runtime exposure, so this is compile-time cost rather than shipped weight. Nothing to change in this PR; it collapses when the rest of the tree catches up.

• 👍 Two things worth keeping. First, the rev pin was done as a scoped lock rebuild — restore main's lock, run the narrow update, then restore the five edges the resolver had needlessly walked back — and verified with cargo metadata --locked rather than asserted. That is exactly the right way to answer "is this lock diff minimal?". Second, the config gc documentation catches a real footgun rather than paraphrasing --help: it spells out that --older-than is a safety assertion about the whole physical store, and that gc's --no-env means something different from every other config subcommand's --no-env (it reselects the target store instead of skipping the app-config overlay). On a destructive command, that distinction is the one an operator would otherwise learn the hard way.

CI Status

All 19 reported checks PASS at 40dd9b37:

• cargo fmt: PASS (required)
• cargo test: PASS (required)
• format-docs: PASS (required)
• format-typescript: PASS (required)
• cargo test (axum native): PASS
• cargo test (cross-adapter parity): PASS
• cargo test (ts CLI, native): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• vitest: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• browser integration tests: PASS
• prepare integration artifacts: PASS
• CodeQL: PASS
• Analyze (rust): PASS
• Analyze (javascript-typescript): PASS
• Analyze (actions): PASS

Verification performed for this review

Every suggestion below was applied in an isolated worktree at 40dd9b37, verified alone and then batched, with a byte-exact pre/post patch snapshot each time:

	cargo fmt --all -- --check	prettier 3.8.1 (docs/node_modules)	clippy -D warnings	tests
each suggestion alone	PASS	PASS	PASS	165 pass
all four batched	PASS	PASS	PASS	165 pass

No drift between the approved patch and the post-verification tree on any run. Scope note: clippy and tests were run as --package trusted-server-cli --target aarch64-apple-darwin rather than the full six-alias chain, because both Rust suggestions are assertion lines inside that crate's own #[cfg(test)] module and cannot reach an adapter target.

[prk-Jr]

Summary

Repoints the six edgezero workspace deps from tag = "v0.0.4" to an immutable rev = "5f3d648c" pin on the unmerged feature/edgezero-deploy-actions branch, wires the new ts lifecycle subcommands, and documents them. The Rust side is in good shape: the lockfile claims in the PR body check out, the SECRET_FIELDS -> secret_fields() migration is behavior-preserving, and no production wire format moved across the 39k-line upstream jump. The remaining blockers are the upstream merge gate and one operator-docs gap that leaves a rollback unreachable.

3 of the inline comments below carry a one-click GitHub suggestion — use Commit suggestion (or Add suggestion to batch for several at once) to apply them as commits on the PR branch. All three are docs/guide/cli.md prose and were verified against the pinned prettier in docs/node_modules (3.8.1), individually and batched, with no drift.

Blocking

🔧 wrench

• Upstream stackpop/edgezero#316 is still open; the pin is immutable but branch-scoped — see inline at Cargo.toml:57
• The documented rollback lifecycle gives an operator no way to obtain --rollback-to — see inline at docs/guide/cli.md:140-153

Non-blocking

♻️ refactor

• config gc's destructive-target warning enumerates --no-env but omits --store — see inline at docs/guide/cli.md:94-100
• deploy passthrough is a breaking change, documented as if it were always the rule — see inline at docs/guide/cli.md:114-118

👍 praise

• The reworded secret_fields() comment is now accurate — see inline at crates/trusted-server-core/src/config.rs:113-116

Cross-cutting / body-level findings

• 📝 Lockfile claims audited and confirmed; the "second lockfile" CI risk does not exist on this branch. All six Cargo.toml deps carry the same rev = "5f3d648c3c6c38fc6e6b22b5c65c66177363aad8". Cargo.lock has 8 matching source lines (the six plus transitive edgezero-adapter and edgezero-macros), all identical, and zero remaining tag= / v0.0.4 references. cargo metadata --locked --offline exits 0, so the lock is consistent with the manifest and needs no re-resolve. The body's "only syn 3.0.3 and toml_edit 0.25.12 are non-edgezero changes" is true — the rest of the lock diff is source-line repointing plus mechanical toml_edit -> toml_edit 0.23.10+spec-1.0.0 / 0.25.12+spec-1.1.0 disambiguation, and every new transitive (winnow 1.0.3, toml_datetime 1.1.1, toml_writer, toml_parser 1.1.2, indexmap 2.14.0) already existed in the lock. The earlier-round windows-sys 0.61.2->0.48.0 and itertools 0.13.0->0.10.5 regressions are gone. On the separate-lockfile concern raised in an earlier round: crates/trusted-server-integration-tests/Cargo.lock does not exist on this branch — the crate is a workspace member using { workspace = true } deps, so it shares the root lock. The only other tracked lockfile is crates/trusted-server-openrtb-codegen/Cargo.lock, which has no edgezero edges, is untouched here, and has no --locked CI gate. No lockfile-mismatch gate is at risk.

• 📝 Production wire formats and runtime behavior are unchanged across the upstream jump. Diffed 9e661ae..5f3d648 directly, since neither the PR body nor CI answers this. Config blob compatibility holds: BlobEnvelope keeps ENVELOPE_VERSION_V1 and the same four fields (only error Display/Debug gained hash redaction), and POINTER_KIND = "fastly_config_chunks", CHUNK_KEY_INFIX = ".__edgezero_chunks.", FASTLY_CONFIG_ENTRY_LIMIT = 8_000, CHUNK_PAYLOAD_TARGET = 7_000 are all unchanged — which matters because crates/trusted-server-core/src/settings_data.rs duplicates those constants in this repo's own resolver. edgezero-core/src/manifest.rs changed only in style and env_config.rs is not in the diff at all, so EnvConfig::store_key("config", ...) still resolves the staging selector a staged deploy redirects. EdgeError::status() maps identically in both revs, so no status-code drift. New surface is additive with no-op defaults (Router::with_state plus a per-request extensions.extend(state_extensions.clone()), empty here; the Fastly dispatch_with_handles extend closure is |_req, _extensions| {} on the default path). One thing deliberately not raised as a finding: edgezero's ConfigOutOfDate error now emits a redacted field_path and a literal <app-cli> placeholder, which would be an operator-visible 503-body regression — except this repo never uses edgezero's AppConfig<C> extractor, loading config through its own config_payload.rs -> BlobEnvelope -> Settings::from_json_value path with TrustedServerError::Configuration. Not reachable.

• 📝 What was and was not verified locally. Run in an isolated worktree at this exact head: cargo fmt --all -- --check clean; pinned prettier 3.8.1 from docs/node_modules (not npx, which resolves a different version and reports false failures) --check . clean at baseline, for each suggestion alone, and for all three batched; cargo metadata --locked --offline exit 0; ./scripts/test-cli.sh exit 0; cargo test -p trusted-server-cli --target aarch64-apple-darwin --lib 168 passed, 0 failed, with all 14 new run::tests::* present and green. Byte-exact pre/post patch snapshots showed no drift on every verification run. Relied on green CI at this head for the six-alias clippy chain, cargo test-fastly/-axum/-cloudflare/-spin, the parity suite, and vitest — no Rust suggestion is proposed, so none was required for scratch verification. Not verifiable from here at all: the runtime behavior of every lifecycle command (deploy --staging, healthcheck, rollback, active-version, config gc), which needs a live Fastly service and API token. All coverage in this PR and in this review is clap parse-level only.

CI Status

• cargo fmt: PASS (required)
• cargo test: PASS (required)
• format-docs: PASS (required)
• format-typescript: PASS (required)
• cargo test (axum native): PASS
• cargo test (cross-adapter parity): PASS
• cargo test (ts CLI, native): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• vitest: PASS
• integration tests: PASS
• integration tests (Fastly EC lifecycle): PASS
• browser integration tests: PASS
• prepare integration artifacts: PASS
• CodeQL: PASS
• Analyze (rust): PASS
• Analyze (javascript-typescript): PASS
• Analyze (javascript-typescript): PASS
• Analyze (actions): PASS

[ChristianPavilonis]

Summary

Reviewed dd8bcdde7e7c5773ebda09411e37525d877ca2f6 against d97bda69f89b15bc61f30f28ad12cc2767924897. The dependency migration and CLI wiring are otherwise consistent, and the relevant local checks and CI pass. I left one inline P1 finding on the staged-config runtime path.

[aram356]

Need to merge stackpop/edgezero#351 and stackpop/edgezero#352