[prk-Jr]

Summary

• Add a shared hook before method/path lookup, router state injection and ordinary middleware, including for unregistered methods delivered by a runtime.
• Expose bounded request-ingress metadata with explicit target, origin and header-preservation limits, and redacted diagnostic output.
• Verify runtime boundaries through adapter contracts and a locked baseline of raw HTTP observations. Preserve manifest metadata when documenting manual Hooks integration.

Changes

Crate / File	Change
edgezero-core	Add PreDispatchHook, value/Arc builder registration with duplicate-registration rejection, and public ingress metadata types. Provide bounded target/origin capture, validated header overrides, redacted Debug and shared authority comparison.
Fastly adapter	Capture before native extension callbacks, retain explicit ingress snapshots and client provenance, validate Host consistency, and report conservative header fidelity after evaluating original-name/count APIs.
Cloudflare adapter	Preserve runtime extension-method tokens. Continue copying runtime header strings as UTF-8; classify invalid method/header conversion as bounded bad-request errors. Capture the runtime URL once while retaining existing primary-URI parsing semantics.
Axum / Spin adapters	Attach conservative runtime metadata; share authority comparison and keep Spin's pure helper host-testable.
Fixtures / runner	Pin SDKs/tools, test exact UTF-8 behavior, compare per-case observations, supervise child cleanup and diagnostics, validate absolute wasm-bindgen/esbuild overrides, and reject silent tool-download fallbacks.
CI / scripts	Guard exact fixture pins with a committed Bash mutation suite; lint isolated fixtures; cache the exact worker-build executable independently and verify its version after restore.
Documentation / macro tests	Explain hook lifecycle and fidelity limits; demonstrate/test delegation of stores, logging, name and configuration plus explicit preservation of state, middleware, routes and manifest introspection.

The hook follows adapter conversion and existing buffering/store bootstrap. It can terminate ordinary router processing; outer application/adapter finalizers may still run. Runtime authority describes the client's requested host and does not establish operator approval.

Every adapter dispatch entry point must reach RouterService::oneshot or Service::call before producing router-generated 404/405 responses, preserving hook execution before method/path lookup.

Axum, Cloudflare and Spin report unknown header octets/multiplicity/same-name order and unavailable global order. Fastly reports all four as unknown: its original-name/count APIs expose partial evidence without associating original fields with converted values. Aggregate count equality cannot prove per-header preservation. Fastly SDK 0.13.1 still has no safe original-target accessor. Workerd normalization/coalescing/replacement and pre-invocation runtime rejection remain capability limits.

Invalid Cloudflare runtime methods/headers produce bounded EdgeError::bad_request values for direct converter callers. Standard runners surface a Worker error, which the fetch wrapper returns as HTTP 500.

The unrelated cache-seed hardening is removed from this diff and tracked in #435 (closes #433). Deploy release jobs remain independent of cache probes in both PRs. Optional hook registration directly through app! is tracked in #434; this PR documents and tests the full manual workaround instead of expanding the macro API.

Release notes

• Continuing pre-dispatch hooks must preserve the method and URI path. A change returns an internal error before lookup, state or middleware; headers, extensions, body and query changes remain supported. Terminal responses may still follow mutations. Ingress metadata lives at edgezero_core::ingress.
• Cloudflare preserves unknown method tokens instead of coercing them to GET. For example, PROPFIND /x no longer reaches a GET /x handler; when the runtime delivers the request, ordinary routing returns 404/405 instead. A runtime may reject the method before Worker invocation.
• Invalid Cloudflare header values now produce EdgeError::bad_request rather than EdgeError::internal for direct converter callers. Standard runners still surface these conversion failures through the Worker fetch wrapper as HTTP 500.
• New Fastly public APIs: capture_request_ingress and dispatch_with_registries_and_ingress. Snapshot conversion helpers remain crate-private. These allow ingress capture before native shortcuts or mutation and retention of an explicit snapshot through conversion and dispatch.

Closes

Closes #402

Test plan

Fresh local verification at f6d0ed68 with Rust 1.98.1 and Node 24.20.0:

• cargo test --workspace --all-targets — 1,550 passed, zero failed, one ignored.
• cargo clippy --workspace --all-targets --all-features -- -D warnings.
• Workspace and both isolated fixture formatting checks.
• cargo check --workspace --all-targets --features "fastly cloudflare spin".
• cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin.
• Isolated fixture strict locked Clippy for Fastly, Cloudflare and Spin WASM targets.
• Runner strict locked Clippy and tests — 20 passed, zero failed, one ignored runtime test; its no-hook routing scenarios also run through the HTTP probes below.
• All 56 source-built raw HTTP cases match the checked-in baseline: Fastly 20, Cloudflare 19, Spin 17, including direct-workerd no-hook routing regressions.
• Adapter runtime contracts: Fastly 7 plus 97 runtime unit tests under Viceroy; Cloudflare 13 under CI-pinned Chrome 154.0.8037.92; Spin 12 under Wasmtime 48.0.1.
• Continued method/path changes fail through both service APIs before lifecycle work; allowed mutations and terminal responses remain covered. Continuation probes send GET /ordinary without rewriting, preserving the output baseline.
• Delegation tests use the scaffold-default App as ManifestApp alias, pin logging fixture values, check terminal interception on a matched route, call build_app(), compare manifest JSON byte for byte with the generated app, and preserve stores, logging, name, state, middleware and terminal-hook boundaries.
• Removing captured diagnostics or exit status independently causes the strengthened command regression to fail. A subprocess regression verifies live stdout/stderr ordering and failure status.
• Diagnostic regressions cover command/argument context, nonzero stdout/stderr, invalid UTF-8/error kinds and separate successful stdout; resolver coverage includes executable PATH selection and explicit override precedence/rejection.
• Shared-pin guard and 91 Bash regression cases with diagnostic assertions, including validator/Spin-major branches, workspace locks and valid metadata comments.
• Shell syntax, ShellCheck and whitespace checks. The pin harness covers comments, unrelated-section decoys, duplicate keys/declarations and numeric feature names before the version key.
• Docs lint, formatting and build.

Raw probes used Viceroy 0.21.0, Spin 4.1.0, worker-build 0.8.5 and wasm-bindgen 0.2.128. Local tests do not certify production-wire preservation. Worker-build 0.8.5 has no official Linux prebuilt; CI caches its exact compiled executable, compiling only on a cold/mismatched cache. Eager ingress capture remains separate performance work.

Checklist

• Changes follow CLAUDE.md conventions.
• No Tokio dependencies added to core or adapter crates.
• Route parameters use {id} syntax.
• Portable application types come from edgezero_core.
• Store registry metadata remains preserved in the documented integration.
• Behavior changes have focused regression tests.
• Test harness additions use Rust and Bash; no Python files added.
• No secrets, credentials or bylines included.

[ChristianPavilonis]

Reviewed base 683202c against head 965d482. Requesting changes for the confirmed compatibility regression documented inline as R1.

Verification included fresh locked Cloudflare WASM builds and raw loopback requests through CloudflareService::dispatch in pinned workerd 1.20260415.1 at both revisions. Native runner tests and additional assertion checks passed, as did formatting, shell syntax and whitespace checks. Exact-head CI is green; unchanged earlier checks were reused rather than independently repeated. This was a single-agent review. Spin runtime execution remains CI-only, and production ingress and Trusted Server integration remain unverified.

[dhruv8sh]

PR Review

Summary

Adds an optional PreDispatchHook on RouterBuilder and adapter-populated RequestIngress metadata (captured target, validated origin, per-axis header fidelity) across all four adapters, plus isolated raw-HTTP runtime fixtures and CI wiring. The core hook design is clean and well tested; findings are mostly about consistency, API ergonomics and scope.

😃 Praise

• The hook is a single Option check at the top of RouterInner::dispatch — zero cost when absent, and existing routing is untouched.
• Ordering tests are thorough: no state clone, no introspection, no middleware, extension methods, 404/405 paths, and both Service::call and oneshot error semantics.
• Atomic bounded target capture (no truncated prefix, byte-counted) and the deliberate absence of Debug/Display/serialization on confidential metadata.
• Fastly snapshot-before-native-mutation design, with a test proving a scratch-extension collision cannot replace the adapter snapshot.
• The fixture runner's owned process-group cleanup and cancellation handling are careful and tested.

Findings

Blocking

• ❓ Spin runner flag change is unexplained (.github/workflows/test.yml:165) — see inline.
• 🔧 Contributor-local absolute paths in the spec (docs/superpowers/specs/2026-10-05-pre-dispatch-request-fidelity-design.md:25) — see inline.

Non-blocking

• 🤔 InboundOrigin authority is not canonical and differs across adapters (crates/edgezero-adapter-fastly/src/request.rs:632, crates/edgezero-adapter-axum/src/request.rs:122) — see inline.
• ♻️ Axum Content-Length override is a no-op (crates/edgezero-adapter-axum/src/request.rs:96) — see inline.
• ♻️ RequestIngress::new fallibility and duplicated fidelity defaults (crates/edgezero-core/src/request.rs:294) — see inline.
• 🤔 Fastly public API growth: this adds capture_request_ingress, into_core_request_with_ingress, dispatch_with_registries_and_ingress, into_core_request_with_registries_and_ingress and FastlyService::with_request_ingress. Five new public entry points for one concept is a lot of surface to maintain. Could the _with_registries_and_ingress variants be the only ones (with the non-ingress versions delegating, as they already do), or could the snapshot be passed through the existing extend callback / a single options struct?
• ⛏ Doc placement (docs/guide/adapters/axum.md:293) — see inline; applies to six guide pages.
• ⛏ Spin helper placement: capture_request_ingress lives in crates/edgezero-adapter-spin/src/context.rs, but per the adapter pattern conversion helpers belong in request.rs (context.rs holds the platform context type). The cfg-gated imports also sit directly against the struct doc comment, and mod ingress_tests has no blank line after the preceding }.
• 📝 Cloudflare behavior changes worth a release note: unknown methods are no longer coerced to GET (they now keep their token, so a GET route no longer matches them); invalid header values are now a 400 at conversion rather than a 500 from the request builder; and conversion error messages no longer include parse detail. All reasonable, but user-visible.
• 🤔 Scope and size: ~10k lines, including two Cargo.locks, a package-lock.json, a 1.4k-line observations.json, and ~680 lines of spec/plan that lean heavily on an external consumer (Trusted Server approvals, F0/F4 tasks, consumer acceptance gates). Consider trimming consumer-specific narrative from the in-repo spec, and possibly splitting the hook from the ingress-metadata work. Also, the fixture README says 56 probes while the PR body says 54.
• 🌱 CI cost and supply chain: the Cloudflare job now installs Chrome, Node, and builds worker-build from source on every run (cargo install ... --force); the Spin CLI tarball is downloaded without checksum verification (consistent with the existing wasmtime step, but worth tightening for both). Caching worker-build and pinning SHA-256s would help.

📌 Out of Scope

• #[app]-macro-generated apps have no way to register a pre-dispatch hook; only a hand-written Hooks::routes() can. Worth a follow-up issue if the hook is meant to be broadly usable.

CI Status

• fmt: PASS
• clippy: PASS
• tests: PASS (workspace, including the new Axum raw-TCP ingress test)
• feature check (fastly cloudflare spin): PASS
• spin wasm32-wasip2 check: PASS
• GitHub checks on the PR: all green

[ChristianPavilonis]

😃 Approved with non-blocking comments. The explicit ingress-fidelity limits clearly distinguish runtime-visible facts from information already lost.

♻️ The inline feedback focuses on sharing the conservative header-fidelity baseline, removing Axum’s redundant override, and tightening documentation: reflect the 56-case checked-in baseline without implying a fresh 56-probe run, replace contributor-local references, and keep Next Steps as the closing guide section.

[aram356]

PR Review

Summary

Reviewed c0a90d62 against main (85d933b8). The hook and ingress code itself is unchanged by the merge and passes Rust 1.98.1's stricter lints. However, the merge left the isolated request-fidelity fixture on the previous toolchain, and all three wasm test jobs now fail. One design question about Fastly's original-header APIs bears on the fidelity contract, and a few docs and test-accuracy issues need fixing before merge.

Findings

Blocking

• 🔧 The main merge left the fixture toolchain stale; all three wasm jobs fail. The fixture's exact pins (fastly 0.12.1, spin-sdk 6.0.0, worker 0.8.3, wasm-bindgen 0.2.122) no longer match the adapters. A verified pin bump, the CI tool versions and a Spin baseline re-record are needed (tests/fixtures/request-fidelity/Cargo.toml:32).
• ❓ Fastly's original-header APIs were never evaluated. get_original_header_names() and get_original_header_count() contradict global_field_order: Unavailable on Fastly (crates/edgezero-adapter-fastly/src/request.rs:615).
• 🔧 The Cloudflare "400" claim is wrong for the standard runners, which return 500 (docs/guide/adapters/cloudflare.md:375).
• 🔧 The runner's UTF-8 regression test passes for the wrong reason (tests/fixtures/request-fidelity-runner/src/main.rs:1168).
• 🔧 One contributor-local path remains (docs/superpowers/plans/2026-10-05-pre-dispatch-request-fidelity.md:342).

Non-blocking

• 🤔 RuntimeUri and the guides overstate how trustworthy the origin is (crates/edgezero-core/src/request.rs:251).
• ♻️ Split RequestIngress::new so the zero-override path can't fail (crates/edgezero-core/src/request.rs:306).
• ♻️ Add a Debug that prints no values, following the store-handle pattern (crates/edgezero-core/src/request.rs:279).
• ♻️ The authority comparison is duplicated across Fastly and Axum (crates/edgezero-adapter-fastly/src/request.rs:621).
• 🤔 Hook registration: Arc-only, and a second registration silently replaces the first (crates/edgezero-core/src/router.rs:207).
• 🤔 The overview implies Cloudflare-specific header fidelity (docs/guide/adapters/overview.md:189).
• 📝 Document the hook's limits (docs/guide/routing.md:218).
• ♻️ A baseline mismatch prints no diff (tests/fixtures/request-fidelity-runner/src/main.rs:431).
• 🌱 CI cost and supply chain (.github/workflows/test.yml:339).
• ⛏ Cloudflare reads the URL across the JS boundary twice (crates/edgezero-adapter-cloudflare/src/request.rs:258).
• ⛏ Spin #[path] module placement (crates/edgezero-adapter-spin/src/lib.rs:11).
• ⛏ Fastly capture-before-bootstrap doesn't change behavior (crates/edgezero-adapter-fastly/src/lib.rs:157).
• ⛏ InboundOrigin limit, port and default-baseline details (crates/edgezero-core/src/request.rs:188).
• ♻️ The spec and plan contradict the final code and read like a session log.
  • Stale content:
    • The Fastly signature still includes EnvConfig/env (spec:141, plan:145).
    • Cloudflare fidelity is called "transformed"/"unavailable" (spec:152, :154), but the code uses Unknown.
    • Spin runner flags are still listed (plan:195), though CI uses plain wasmtime run.
    • The Spin helper is placed in context.rs (plan:292).
    • Case counts appear as 47 (plan:294, :321, :352), 54 and 56.
  • Session-log content:
    • Approval logs ("the user authorized/approved/rejects/requested", spec:214, :224 and plan:20, :319, :346, :373).
    • Agent-tool instructions ("Use this instruction with EdgeZero's Codex", plan:259; "Independent Claude audit follow-up", plan:358).
    • F0/F4/F5 consumer labels that are never defined (spec:191-193, :240).
  • The consumer-negotiation sentence "EdgeZero does not approve a weaker consumer contract" also leaks into the public guide (overview.md:212).
  • Suggest updating the stale lines or adding a "superseded by §…" banner (main's 2026-09-15-reusable-app-lifecycle-design.md does this), condensing the review history into a short decision log, and defining or dropping the consumer labels.
• ⛏ Runner nits:
  • cargo metadata --locked --no-deps (main.rs:259-265) exits 0 with a stale lock; drop --no-deps or the call.
  • Drop swallows /bin/kill failures and then wait()s, which can hang forever where /bin/kill doesn't exist (main.rs:196-197); call self.child.kill() first.
  • Child processes inherit the runner's stdin (main.rs:151-156), which can stop a TTY-reading child such as wrangler's hotkeys; use Stdio::null().
• 🌱 Ingress capture always runs. Every adapter captures the target, parses the origin and allocates Arc<str> on every request, even when no hook or consumer is installed. It's cheap, but it adds per-request CPU on edge platforms. Worth making it lazy or opt-in later.

CI Status

At c0a90d62, run locally on Rust 1.98.1:

• fmt: PASS
• clippy: PASS
• tests: PASS (1,544 passed, 0 failed, 1 ignored)
• feature check (fastly cloudflare spin): PASS
• spin wasm32-wasip2 check: PASS
• check_shared_dep_pins.sh: PASS (it does not cover this fixture)

GitHub at c0a90d62:

• spin wasm tests, cloudflare wasm tests, fastly wasm tests: FAIL at "Lint isolated ingress fixture" (stale fixture Cargo.lock).
• All other checks pass.

[dhruv8sh]

PR Review

Summary

Re-review at d6e3f4cc. Every blocking item from the Oct 9 and Oct 16 reviews has been addressed: the fixture toolchain pins, Fastly's original-header APIs, the Cloudflare 500 docs, the runner's UTF-8 test and the contributor-local paths. So have most of the non-blocking ones: the shared authority comparison, a constructor that can't fail, a redacted Debug, duplicate-hook rejection, reading the Cloudflare URL once, Spin's ingress.rs, the baseline diff, Stdio::null(), cleanup order, the checksummed Spin download, and the cleaned-up spec and plan. The remaining findings are non-blocking.

😃 Praise

• The Axum raw-TCP ingress test runs real hyper parsing: duplicate and conflicting Content-Length, TE+CL, non-UTF-8 cookie bytes, %2e/../ paths, and the hook's stop, continue and error paths. It also checks that middleware runs only on the continued request.
• The trust rules per adapter match what each runtime guarantees. No adapter trusts Forwarded/X-Forwarded-*, and the tests send spoofed versions of them.
• The 16 KiB target cap either stores the whole value or nothing, and the compile_fail doctest proves callers can't bypass the bound.
• Runtime limitations are recorded as pinned, explicitly reported outcomes in observations.json (56 = 20 + 19 + 17 cases, consistent with the README and runner), not quietly skipped.

Findings

Non-blocking

• 🤔 Fastly global field order is Unknown; the other adapters say Unavailable (crates/edgezero-adapter-fastly/src/request.rs:611) — see inline.
• 🤔 Ingress dispatch variants have no in-tree caller (crates/edgezero-adapter-fastly/src/request.rs:393, :444) — see inline.
• 🤔 Consider #[non_exhaustive] on the new public enums (crates/edgezero-core/src/request.rs:289) — see inline.
• ⛏ Cloudflare invalid header value → 400 path is untested (crates/edgezero-adapter-cloudflare/src/request.rs:284) — see inline.
• 📝 Cloudflare unknown-method behavior change needs a changelog line (crates/edgezero-adapter-cloudflare/src/request.rs:257) — see inline.
• ⛏ The runner's log read can hide the real error (tests/fixtures/request-fidelity-runner/src/main.rs:1021) — see inline.
• ⛏ The README's "existing" pins claim is stale (tests/fixtures/request-fidelity/README.md:21) — see inline.
• ⛏ Blank line (crates/edgezero-core/src/request.rs:356) — see inline.
• 🌱 Fixture pins are not drift-checked. fastly =0.13.1, worker =0.8.5 and wasm-bindgen =0.2.128 match the workspace lock today, but check_shared_dep_pins.sh only compares spin-sdk's major version. worker-build 0.8.5 is also hard-coded in test.yml:340, the runner (main.rs:266) and the README. A workspace cargo update could leave the fixture testing an older SDK while the public matrix in overview.md names the wrong versions. Suggest moving worker-build into [package.metadata.request-fidelity] and extending the pin check to the fixture's = pins.
• 🌱 Fixture build output isn't cached in CI. Neither the tests/fixtures/request-fidelity/target/ nor the request-fidelity-runner/target/ directory is cached (test.yml:32, :181). Clippy and the runner use different target directories, so each wasm job compiles the fixture twice from scratch.

CI Status

• fmt: PASS
• clippy: PASS (on the pinned Rust 1.98.1)
• tests: PASS
• GitHub checks: all green, including the fastly, cloudflare and spin wasm test jobs

[aram356]

PR Review

Summary

Re-reviewed ca252139 against main (fc4ccba0). The fixes in d6e3f4cc and 52121d95 resolve every blocking item from the previous review, and nearly all the non-blocking ones, and each fix has a test. I verified them against the code.

Two blocking items remain:

• The newest commit, ca252139, changes main's cache-seed CI. That is outside this PR's scope, and it couples every deploy smoke job to the cache probes.
• The routing guide's hook workaround for app! apps silently drops store registries.

The rest are smaller docs, tooling and test follow-ups.

Findings

Blocking

• ❓ ca252139 changes main's cache-seed CI; please move it to its own PR. Every deploy smoke now depends on the cache probes (.github/workflows/deploy-action.yml:274).
• 🔧 The app! hook workaround silently drops stores, logging config and app name (docs/guide/routing.md:248).

Non-blocking

• ♻️ The fixture pin-guard negative tests mentioned in the reply aren't committed or run in CI (scripts/check_shared_dep_pins.sh:111).
• 🤔 The new top-level CHANGELOG.md starts a repo-wide convention, and its entry leaves out the new public API and the runner-500 nuance (CHANGELOG.md:10).
• ⛏ middleware.md:61 contradicts the new line 233 (docs/guide/middleware.md:233).
• ♻️ Committed docs record one-off run evidence that will go stale (docs/guide/adapters/overview.md:202).
• ⛏ The spec misstates Cloudflare's header-copy baseline (docs/superpowers/specs/2026-10-05-pre-dispatch-request-fidelity-design.md:13).
• ⛏ Local setup instructions don't match worker-build's tool lookup (tests/fixtures/request-fidelity/README.md:14).
• ⛏ Runner error messages leave out the program, the actual version, the tool name, or a non-UTF-8 log (tests/fixtures/request-fidelity-runner/src/main.rs:258).
• ⛏ Leftover "trusted" rustdoc wording (crates/edgezero-core/src/request.rs:160).
• ⛏ Spec lines 143 and 192 contradict "Implemented" and the overview (docs/superpowers/specs/2026-10-05-pre-dispatch-request-fidelity-design.md:143).
• 🏕 Older Fastly versions in a guide this PR edits. docs/guide/adapters/fastly.md:438 ("SDK 0.12.1 exposes…") and :445 ("Viceroy 0.17.0 pinned for the fixtures") predate this PR, but they now contradict its own "Fastly SDK 0.13.1" text at :608 and the Viceroy 0.21.0 pin in .tool-versions. Please update both while you're in this guide.

The prebuilt worker-build install that the author deferred (thread left open) is not repeated here.

CI Status

At ca252139, run locally on Rust 1.98.1:

• fmt: PASS
• clippy: PASS
• tests: PASS (1,546 passed, 0 failed, 1 ignored)
• feature check (fastly cloudflare spin): PASS
• spin wasm32-wasip2 check: PASS
• check_shared_dep_pins.sh: PASS
• fixture clippy (fastly, cloudflare, spin): PASS
• runner tests (11 passed, 1 ignored) and runner clippy: PASS

GitHub: all 28 checks pass.

[aram356]

PR Review

Summary

Re-reviewed 7b6f913a against main (fc4ccba0). The previous review's findings are all resolved:

• 251a4725 moves the cache-seed work out of this PR (now #435), and the diff no longer touches deploy-action.yml or the cache action.
• 7b6f913a adds the app! delegation guide with a compiled integration test, a 57-case pin-guard harness in CI, runner tool-version checks that block silent downloads, and the remaining docs fixes.

I verified each fix against the code. None of the items below is a correctness defect in the hook or ingress code. Requesting changes so the guide's integration recipe, the runner diagnostics and the release notes are tightened before merge.

Findings

• ♻️ The guide's app! line drops the user's existing arguments (owns_logging, state), and the block isn't copy-paste complete (docs/guide/routing.md:258).
• 🤔 The manual workaround parses and serializes the manifest on every request on Fastly, Cloudflare and Spin (docs/guide/routing.md:272).
• ♻️ Runner errors for non-zero exits and non-UTF-8 output don't name the command (tests/fixtures/request-fidelity-runner/src/main.rs:172).
• ⛏ Tool setup is hidden in run_command; the PATH lookup accepts a non-executable file, is untested, and one test message overstates its coverage (tests/fixtures/request-fidelity-runner/src/main.rs:290).
• ⛏ The integration test bypasses build_app(), and its manifest check is a contains (crates/edgezero-macros/tests/hooked_app.rs:133).
• ⛏ The fixture's method = "GET" is silently ignored (crates/edgezero-macros/tests/fixtures/hooked_app.toml:7).
• ⛏ One "trusted" remains in the rustdoc, plus spec and plan (crates/edgezero-core/src/request.rs:281).
• ⛏ The spec contradicts the #434 follow-up (docs/superpowers/specs/2026-10-05-pre-dispatch-request-fidelity-design.md:104).
• ⛏ PR-history phrasing and branch lines in committed docs (docs/superpowers/specs/2026-10-05-pre-dispatch-request-fidelity-design.md:220).
• ⛏ Pin-guard harness and CI details (.github/workflows/test.yml:77).
• 📝 The PR description is now the only place for release notes. With the changelog removed, please add:
  • Cloudflare unknown method tokens are no longer coerced to GET, so a request like PROPFIND /x no longer reaches a GET /x handler and gets 404/405 instead.
  • Invalid Cloudflare header values moved from EdgeError::internal to bad_request. Standard runners still return HTTP 500.
  • The new Fastly public API: capture_request_ingress, into_core_request_with_ingress, FastlyService::with_request_ingress, dispatch_with_registries_and_ingress and into_core_request_with_registries_and_ingress.
• 🏕 A cross-reference now points at removed text. tests/fixtures/reusable-app/README.md:151-152 says "Raising --max-requests cannot extend the pinned Viceroy's per-guest request ceiling (see the Fastly guide)". The guide no longer states a ceiling, and docs/guide/adapters/fastly.md:447 still says "Neither local ceiling…". Suggest "Local request ceilings depend on the Viceroy version; check them when pins change (see the Fastly guide)" and "Neither local runtime…".
• ⛏ tests/fixtures/request-fidelity/README.md:14 repeats four tool versions (Viceroy, Spin, worker-build, wasm-bindgen CLI) that no guard checks. Pointing readers to .tool-versions, the fixture metadata and the fixture lock would keep them from drifting.

CI Status

At 7b6f913a, run locally on Rust 1.98.1:

• fmt: PASS
• clippy: PASS
• tests: PASS (1,548 passed, 0 failed, 1 ignored), including hooked_app (2/2)
• feature check (fastly cloudflare spin): PASS
• spin wasm32-wasip2 check: PASS
• check_shared_dep_pins.sh: PASS
• test_shared_dep_pins.sh: 57/57 PASS, worktree left clean
• fixture clippy (fastly, cloudflare, spin): PASS
• runner tests (16 passed, 1 ignored), clippy and fmt: PASS
• ./scripts/test-request-fidelity.sh fastly on Viceroy 0.21.0: 20/20 cases match the baseline

GitHub: all 28 checks pass.

[prk-Jr]

Addressed this review in 83b7fae and replied to/resolved all 10 inline conversations.

The PR description now includes the three requested release notes: preserved Cloudflare extension methods and 404/405 routing, the invalid-header error classification with standard-runner HTTP 500 behavior, and all five new Fastly public ingress APIs. The fixture README now points to authoritative tool-version sources; the reusable-app/Fastly guide cross-reference now describes version-dependent local runtime ceilings consistently.

Fresh local verification passed: 1,548 workspace tests (zero failures, one ignored), 19 runner tests (one ignored runtime test), 85 diagnostic-asserting pin cases, all 56 source-built runtime observations against the unchanged baseline, workspace/runner strict Clippy, workspace feature and Spin WASM checks, three isolated WASM fixture Clippy checks, formatting, ShellCheck, actionlint, and docs lint/format/build. Rust 1.98.1 and Node 24.20.0 were selected explicitly.

Independent runner, CI/pin and guide reviews plus a broader hook/adapter boundary audit and build-validation handoff found no further correctness findings in the audited scope. The chosen fix retains the existing macro API; #434 remains the direct-registration/compile-time-literal follow-up. Manifest initialization costs and runtime fidelity limits remain explicit. GitHub CI for the new commit has 27 successful checks and no failures; the CodeQL aggregate is neutral and only Rust CodeQL analysis is still pending. Both Fastly and Cloudflare runtime jobs passed.

[aram356]

PR Review

Summary

Re-reviewed 34750022 against main (e3695e54). 83b7fae4 resolves the previous review's findings, and the two later main merges don't touch PR-owned files. Since the last review, the core and adapter source changed by one rustdoc line.

Verified as fixed:

• The app! delegation guide keeps the user's arguments and caches the manifest JSON in a LazyLock.
• hooked_app now goes through build_app() and compares the manifest JSON byte for byte with the macro's.
• Runner diagnostics name the command and include its captured output.
• The wasm-bindgen resolver is explicit and checks the execute bit.
• The pin harness has 85 cases with case-specific diagnostics, gated to the workspace suite.
• Docs, spec, plan and PR description are cleaned up.

Changes requested for the items below. The two ♻️ items are worth fixing before merge: a regression test that can't fail, and a guide step that breaks scaffolded projects.

Findings

• ♻️ The command-diagnostics regression test passes vacuously; its assertions match the echoed command line (tests/fixtures/request-fidelity-runner/src/main.rs:1286).
• ♻️ "Move your app! invocation unchanged" breaks scaffolded projects, whose app! call defines App, not ManifestApp (docs/guide/routing.md:250).
• ⛏ Leftover "trustworthy runtime binding" (docs/superpowers/specs/2026-10-05-pre-dispatch-request-fidelity-design.md:168).
• ⛏ Two hooked_app assertions can't fail: middleware absence on an unmatched route, and logging compared only with ManifestApp (crates/edgezero-macros/tests/hooked_app.rs:179).
• ⛏ The caching note and the combined example need corrections: which hosts benefit, the Spin P3 defaults, and the edits needed when pasting both blocks (docs/guide/routing.md:313).
• ⛏ The runner's non-capture output path reorders stdout after stderr and can mask failures (predates this PR) (tests/fixtures/request-fidelity-runner/src/main.rs:305).
• ⛏ Plan and spec wording and formatting (docs/superpowers/plans/2026-10-05-pre-dispatch-request-fidelity.md:63).
• ⛏ Hard-coded Wrangler version (tests/fixtures/request-fidelity/README.md:23).
• 🌱 The runner is a single 1,724-line main.rs. A follow-up could split it into modules: process supervision, the HTTP probe client, tool resolution and observation diffing. Some complexity that predates this PR could go at the same time:
  • an unreachable _ => return Vec::new() (:927);
  • a runtime cases.len() == 17 check (:1187) that duplicates the unit test at :1583;
  • a second --repo-root parse for the first position (:36-50), which the wrapper never uses;
  • an #[ignore] test (:1505) that CI never runs and that repeats the baselined Cloudflare routing probes.
• 🏕 Older issues next to code this PR touches:
  • In scripts/check_shared_dep_pins.sh:37 and :85, head -1 lets a second, drifted validator or spin-sdk declaration in the same file pass.
  • spin_major_in takes the first integer on the line, so spin-sdk = { features = ["wasi7"], version = "8" } reads as major 7. Failing when more than one line matches, and reading the major from the version key, would close both.
  • docs/guide/adapters/spin.md:352-354 still says "pinned SDK 6" and "spin-sdk 6 requires Spin 3.7", while the workspace locks spin-sdk 7.0.0.

CI Status

At 34750022, run locally on Rust 1.98.1:

• fmt: PASS
• clippy: PASS
• tests: PASS (1,548 passed, 0 failed, 1 ignored), including hooked_app (2/2)
• feature check (fastly cloudflare spin): PASS
• spin wasm32-wasip2 check: PASS
• check_shared_dep_pins.sh: PASS
• test_shared_dep_pins.sh: 85/85 PASS; worktree left clean
• fixture clippy (fastly, cloudflare, spin): PASS
• runner tests (19 passed, 1 ignored), clippy and fmt: PASS
• ./scripts/test-request-fidelity.sh fastly on Viceroy 0.21.0: matches the baseline

GitHub: all 28 checks pass.

[aram356]

PR Review

Summary

Follow-up at 34750022. It covers three choices in this PR's own contract that are cheaper to settle before merge, because the open request-lifecycle work (#275) changes the same areas: routing order, the Fastly conversion path, and core ingress types. None of these items requires waiting for #275. Each one can be done or decided here. The findings from the previous review on this head still apply.

Findings

• ❓ Decide whether Ok(None) may change the method or path. Either record it as a consumer requirement or narrow the contract and guard it (docs/superpowers/specs/2026-10-05-pre-dispatch-request-fidelity-design.md:96).
• ♻️ Keep the three Fastly ingress entry points with no outside callers crate-private (crates/edgezero-adapter-fastly/src/request.rs:259).
• ♻️ Name the metadata module ingress rather than request (crates/edgezero-core/src/lib.rs:36).
• 📝 State the hook's integration assumption in the PR description. The hook runs inside RouterService dispatch (RouterService::oneshot / Service::call), and every adapter entry point is expected to keep reaching it there, before any 404/405 is produced. Saying so makes the guarantee visible to anyone who adds or rewrites an adapter dispatch path. The request-fidelity probes would catch a regression at runtime in CI, but a sentence in the description is cheaper.

CI Status

Head unchanged since the previous review (34750022). Locally on Rust 1.98.1, fmt, clippy, tests (1,548 passed, 1 ignored), feature check, spin wasm32-wasip2 check, pin guard, pin harness (85/85), fixture clippy and runner checks all pass. GitHub: all 28 checks pass.

[prk-Jr]

Addressed the latest two reviews in f6d0ed68.

• Request routing: Hooks are application callbacks that run before route selection. A hook that lets processing continue must now preserve the request method and path; changing either returns an internal error before route lookup or middleware. This follows the selected restriction on rerouting. Headers, extensions, body and query changes remain supported, and hooks that return a response immediately are exempt.
• Regression protection: Tests now independently check command output and exit status, configured logging values, and interception of an existing route before middleware. Removing diagnostics or exit-status reporting makes the command regression fail. Runner output streams live, and dependency-pin parsing rejects duplicate declarations and numeric-feature decoys.
• API and integration guidance: Core request metadata is named ingress; Fastly retains the two demonstrated public snapshot APIs. Scaffold guidance now uses the generated application type correctly, covers all adapter entry points, and corrects cache-lifetime and tool-version references.

The recorded local verification includes the required suites and 56 source-built runtime observations against the unchanged baseline. All checks currently reported for the linked commit pass, and GitHub marks it Verified. The full verification inventory is in the PR description; each of the 11 addressed inline conversations has a commit/evidence reply and is resolved.

Runner modularization remains an optional follow-up. These local-runtime results do not establish production-wire preservation or validate consumer integration.

[aram356]

PR Review

Summary

Re-reviewed 1d1ad914 against main (bc4aeb85). f6d0ed68 resolves all findings from the previous two reviews, and I verified each against the code:

• Ok(None) must now preserve the method and path, enforced by a router guard with tests through both service APIs.
• The metadata module is renamed to edgezero_core::ingress.
• Fastly's public snapshot surface is down to capture_request_ingress and dispatch_with_registries_and_ingress.
• The runner streams output live, its regression tests can now fail, and the scaffold guidance is corrected.

The items below are small: docs wording, the pin guard's error path, runner comments and the PR description. Requesting changes so they're cleaned up before merge.

Findings

• ♻️ The middleware guide still says a continuing hook passes all its mutations to middleware; method or path changes now return a 500 first (docs/guide/middleware.md:237).
• ♻️ The pin guard crashes with a raw awk error and exit 2 when a pinned file is missing, instead of reporting a violation with exit 1. The parser-parity comment above it is stale (scripts/check_shared_dep_pins.sh:36).
• ⛏ The guide's entry-point list leaves out Fastly's _with_* variants and custom serve_custom callbacks, and the Axum wording at :321 is misleading (docs/guide/routing.md:315).
• ⛏ Missing request:: prefix (docs/guide/adapters/fastly.md:617).
• ⛏ Stale runner comment, and an eprint! panic path (tests/fixtures/request-fidelity-runner/src/main.rs:324).
• 📝 The PR description still has process wording:
  • The changes table says "Remove the new repo-wide changelog and one-off run evidence from guides". Relative to main there is nothing to remove, so the sentence can go.
  • "Continuation probes now send GET /ordinary…" can just say they send it.
  • The checklist item "Independent runner, pin/CI and guide reviews, broader core/adapter boundary audit, and build-validation handoff" describes the review process rather than a check. Drop it, or replace it with the concrete commands that ran.

CI Status

At 1d1ad914, run locally on Rust 1.98.1:

• fmt: PASS
• clippy: PASS
• tests: PASS (1,550 passed, 0 failed, 1 ignored), including the 9 pre_dispatch router tests and hooked_app (2/2)
• feature check (fastly cloudflare spin): PASS
• spin wasm32-wasip2 check: PASS
• check_shared_dep_pins.sh: PASS
• test_shared_dep_pins.sh: 91/91 PASS; worktree left clean
• fixture clippy (fastly, cloudflare, spin): PASS
• runner tests (20 passed, 1 ignored), clippy and fmt: PASS
• ./scripts/test-request-fidelity.sh fastly: matches the baseline

GitHub: all 28 checks pass.

[prk-Jr]

Addressed this review in 0f7ff3bb.

The dependency-pin checker previously stopped with a raw awk error and exit 2 when a shared-pin file was missing. It now reports the missing pin, finishes the remaining checks and exits 1. Three regressions cover the validator-pin file locations and require the final violation summary; the first failed before the fix and all 94 cases now pass.

The guides now describe continuing-hook mutation limits, include adapter _with_* and custom callback paths, name Axum’s entry point accurately, and qualify the Fastly dispatch function with request::. Runner comments explain version-output capture and the existing eprint! trade-off without changing behavior. The three requested PR-description wording edits are also applied.

Fresh local verification on Rust 1.98.1 passed: 1,550 workspace tests (zero failed, one ignored), 20 runner tests (zero failed, one ignored), required workspace/runner formatting and strict Clippy, the combined feature check, Spin WASM check, pin guard and 94-case harness, Bash syntax, ShellCheck, and docs lint/format/build. Docs checks used Node 24.12.0. All 28 hosted checks pass for this commit, and GitHub marks it Verified. This cycle relies on CI for runtime probes; local unit/compile checks do not establish production-wire fidelity.

All five inline conversations have a commit/evidence reply and are resolved.

[aram356]

PR Review

Summary

Re-reviewed 9620d6c2 against main (7bc8c98c). 0f7ff3bb resolves all seven findings from the previous review, and the later main merge doesn't touch PR-owned files.

Verified fixed:

• The middleware guide limits continuing-hook changes to headers, extensions, body and query, and states that method or path changes return an internal error before route lookup.
• check_shared_dep_pins.sh reports a missing pinned file as a violation and exits 1, instead of aborting with a raw awk error. Three harness cases cover the pinned files and require the final summary. The stale parser-parity comment is removed.
• The routing guide's entry-point list now includes the _with_* variants and custom serve_custom/run_custom callbacks, and names Axum's run_app and Fastly's serve_app accurately.
• The Fastly guide uses request::dispatch_with_registries_and_ingress(...).
• The runner comments describe the --version capture and the eprint! trade-off.
• The PR description's process wording is cleaned up.

Findings

No new findings.

CI Status

At 9620d6c2, run locally on Rust 1.98.1:

• fmt: PASS
• clippy: PASS
• tests: PASS (1,550 passed, 0 failed, 1 ignored)
• feature check (fastly cloudflare spin): PASS
• spin wasm32-wasip2 check: PASS
• check_shared_dep_pins.sh: PASS
• test_shared_dep_pins.sh: 94/94 PASS; worktree left clean
• shellcheck: PASS
• fixture clippy (fastly, cloudflare, spin): PASS
• runner tests (20 passed, 1 ignored), clippy and fmt: PASS
• ./scripts/test-request-fidelity.sh fastly and spin: both match the baseline

GitHub: all 28 checks pass.