Adapt Mocktioneer to edgezero v0.0.7 (extensible CLI, typed config, introspection, deploy lifecycle)

[aram356]

Closes #115

What this PR does

Adapts Mocktioneer to the released edgezero v0.0.7, which lands the extensible CLI (#269), pluggable introspection routes (#300), and the config-GC + deploy-lifecycle CLI commands. The design spec and implementation plan that opened this PR live under docs/superpowers/; the implementation follows them end to end.

Merged with main (PR #112: Rust 2024 edition + workspace metadata inheritance) — the workspace is now edition 2024.

Changes

• Compat: pin the six edgezero-* git deps to the immutable tag v0.0.7; drop the include_str!(manifest) arg from every adapter run_app; migrate the Spin adapter to spin-sdk ~6.0 / wasm32-wasip2 (Fastly stays wasm32-wasip1). Mocktioneer implements no Adapter trait, so v0.0.5's breaking Adapter::provision change does not apply.
• Typed config: add a validated MocktioneerConfig (bid_cpm, range(exclusive_min = 0.0)), a gitignored mocktioneer.toml with a committed mocktioneer.toml.example template.
• CLI (mocktioneer-cli): mirrors edgezero's generated <name>-cli. Typed config validate/diff/push over MocktioneerConfig, plus every built-in command adopted as edgezero added them:
  • config gc — reclaim orphaned config-store chunks (v0.0.5; untyped, dry-run by default).
  • active-version / healthcheck / rollback — Fastly staging deploy-lifecycle (v0.0.6).
  • auth / build / deploy / provision / serve (new intentionally dropped for an in-repo CLI).
• Runtime (fail-loud): the OpenRTB (/openrtb2/auction) and APS (/e/dtb/bid) handlers read bid_cpm from the bound config store via edgezero's typed AppConfig extractor. A fresh deploy must config push once before those endpoints serve bids — until then they return 503 config_out_of_date. FIXED_BID_CPM = 0.20 is the shipped default, not a runtime fallback. Static/creative/pixel endpoints are unaffected.
• Config storage: config push writes the whole struct as a single canonical-JSON blob envelope (SHA-gated) under the store's key, per adapter (axum local file / cloudflare KV / fastly config store / spin KV).
• Introspection: mount the framework-supplied /_mocktioneer/{manifest,config,routes} routes from edgezero_core::introspection (unauthenticated — restrict at the network/middleware layer; [environment.secrets] redacted). Hardening tracked in Gate unauthenticated introspection routes before sensitive config lands in the manifest #116.
• Tests: config-seeded auction dispatched through the Fastly (Viceroy) and Cloudflare (wasm-bindgen) adapters; CORS preflight + GET-serve coverage for the introspection routes; non-finite bid_cpm guard and template↔FIXED_BID_CPM drift pinned; a clap CLI-definition assertion.
• Plumbing: [stores.config] in the manifest + Spin runtime-config.toml; Dockerfile seeds the default config blob, pins debian:bookworm-slim, and binds 0.0.0.0; docs cover wasip2, fail-loud typed config, introspection, the remote Fastly provision → push → deploy flow, and the new CLI commands; a config validate --strict CI gate + a Docker build/smoke gate that gates the registry push on the smoke test.

Notes

• Deps pin to the immutable tag v0.0.7, so no post-merge re-pin is needed.
• Spin spin up is blocked upstream (tracked in Spin adapter cannot serve: spin-sdk 6 imports wasi:http@0.3.0-rc, unsupported by released Spin runtimes #113): the adapter compiles to wasm32-wasip2 and passes the wasmtime router contract tests, but spin up on current Spin runtimes fails to link because spin-sdk 6.0.0 pulls wasi:http@0.3.0-rc, which no released Spin provides. Fastly / Cloudflare / Axum are unaffected.
• Follow-ups: Cover auction path against real platform config stores (Viceroy config-store, Cloudflare KV) via manifest binding name #114 (auction coverage against real platform config stores), Gate unauthenticated introspection routes before sensitive config lands in the manifest #116 (gate introspection before sensitive config lands), Per-request config-store read on the auction hot path (Cloudflare/Spin KV) — caching? #117 (per-request config-store read on the hot path).

CI

fmt · clippy -D warnings · test --workspace · check --features "fastly cloudflare" · config validate --strict · Docker build + smoke · Playwright · docs ESLint/Prettier — all green.

---

🤖 Generated with Claude Code

[prk-Jr]

PR Review

Summary

Adapts Mocktioneer to edgezero v0.0.4 (extensible CLI, blob-model typed config, pluggable introspection routes). The change is well-scoped, thoroughly tested, and has clearly been through several review rounds. No blocking findings. Verdict is COMMENT — a handful of non-blocking questions, one build-cache cleanup, a design-level footgun to keep in view, and a stale doc line. Inline comments carry the file-specific items.

Findings

♻️ Refactor

• Dockerfile redundant manifest COPYs — six per-crate Cargo.toml copies are superseded by COPY crates ./crates before cargo fetch, so they add no layer caching. Inline at Dockerfile:16.

❓ Questions

• anyhow in core with no src/ usage — likely required by the AppConfig derive; please confirm, else drop. Inline at crates/mocktioneer-core/Cargo.toml:9.
• bid_cpm accepts +Inf — exclusive_min = 0.0 passes infinity; upstream non-finite rejection isn't pinned by a test in this repo. Inline at crates/mocktioneer-core/src/config.rs:15.

🌱 Seeds / 📌 Out of scope

• Unauthenticated introspection on prod adapters — /_mocktioneer/{manifest,config,routes} publicly enumerable on cloudflare/fastly. Documented and safe today; footgun once anything sensitive enters the manifest. Inline at edgezero.toml:15.
• Breaking runtime change — /openrtb2/auction and /e/dtb/bid now return 503 config_out_of_date until an operator runs config push. This is the intended fail-loud behavior and is well documented, but existing deploys that upgrade will start erroring until they push. Please make sure this lands prominently in the release notes / CHANGELOG so it isn't a surprise on rollout.

⛏ Nitpicks

• Stale doc — GET /_/sizes still described "with pricing" though cpm is no longer echoed. Inline at README.md:51.

👍 Praise

• Fail-loud contract is genuinely well tested: assert_config_out_of_date (503 + Retry-After + error.kind = config_out_of_date) exercised at the route level for both OpenRTB and APS, plus config-seeded auction contract tests through the real Fastly (Viceroy) and Cloudflare (wasm-bindgen) runtimes, and a Docker smoke test that gates image publication on an actual live bid. Strong end-to-end coverage of the new config-store path.
• Security hygiene from the base is preserved throughout: constant-time token comparison, hostname / path-injection validation on ts_domain, log sanitization, and #[serde(deny_unknown_fields)] on the typed config.

CI Status

Verified locally on the branch head:

• fmt: PASS
• clippy (--workspace --all-targets --all-features -D warnings): PASS
• tests (--workspace --all-targets, host targets): PASS

Full remote CI (wasm adapter matrix, Playwright, Docker build + smoke, docs ESLint/Prettier) reported green.

[ChristianPavilonis]

Summary

Reviewed PR #110 against main. All reported CI checks pass, including Rust, adapter WASM, Docker smoke, Playwright, docs, and CodeQL. I found two non-blocking P2 issues; the CORS issue is inline.

The typed-config runtime wiring otherwise looks coherent, and I found no P0/P1 issues.

Additional P2 finding (not inline)

Trusted Server full-flow guide starts Axum without seeding typed config — docs/integrations/trusted-server.md:242-243

This standalone flow starts Axum directly, but it never copies mocktioneer.toml.example or runs config push. On a fresh checkout, the OpenRTB request in the later bidstream step now returns 503 config_out_of_date, so the documented flow cannot reach its verification step. Please add the config-copy and cargo run -p mocktioneer-cli -- config push --adapter axum --yes steps before starting the server. This was folded into the review body because the documentation file is unchanged in this PR and GitHub rejected an inline position for it.

[prk-Jr]

PR Review

Summary

Adapts Mocktioneer to edgezero v0.0.4: manifest arg dropped from every run_app, Spin moved to spin-sdk 6 / wasm32-wasip2, bid_cpm lifted out of a compile-time constant into a validated MocktioneerConfig blob read through the fail-loud AppConfig extractor, a new mocktioneer-cli for typed config validate/diff/push, and framework introspection routes. 60 files, +3731/−1161.

I read every changed file and re-ran the gates locally. No correctness defect found in the Rust changes. The fail-loud migration is the risky part of this PR and it is handled carefully: the contract is asserted at the core-router level and driven end-to-end through the real Fastly and Cloudflare dispatch paths, the Docker image seeds the blob so the container still works out of the box, and the "push before you serve" prerequisite is documented on the README, both API pages, both integration pages and every adapter page.

Everything below is non-blocking. Two questions worth answering, a handful of gaps worth closing, some nits.

Findings

❓ Questions

• Config-store read on the auction hot path — AppConfig calls ConfigStore::get per request with no caching in the extractor; the Cloudflare backend is a bare store.get(key).text() with no cacheTtl. Each auction is now a billable KV read plus cold-read latency where it used to be a constant. Axum (loads once at startup) and Fastly (edge-resident config store) are unaffected. Inline on routes.rs.
• Docker publish step rebuilds rather than repushing — the step comment claims it publishes the exact smoke-tested image; labels are added only in that step and the guarantee depends on a gha cache hit. Inline on docker.yml.

🤔 Thoughts

• Retag instead of rebuild to make the publish gate literal — inline on docker.yml.
• Introspection is on by default, on all four adapters, behind Access-Control-Allow-Origin: * — nothing sensitive today, but MOCKTIONEER_PULL_TOKEN becomes world-readable the day someone files it under [environment.variables]. Inline on edgezero.toml.

♻️ Refactor / test coverage

• examples/openrtb_request.sh and examples/aps_request.sh were missed. Both POST to now-fail-loud endpoints and default to http://127.0.0.1:7676 (Fastly), so on a fresh checkout they return 503 config_out_of_date with no hint why. Every other surface in the repo got the "push the config first" note — these two didn't. A comment near the top pointing at config push --adapter fastly --local, or a preflight that checks the status and prints the fix, would finish the sweep. (Not in the diff, so no inline anchor.)
• Introspection GET routes have no test — only the OPTIONS preflight is asserted. Inline on endpoints.rs.
• mocktioneer.toml.example isn't pinned to FIXED_BID_CPM — inline on the template.
• mocktioneer-cli has no tests — Args::command().debug_assert() is one line. Inline on main.rs.

⛏ Nitpicks

• @types/node ^26 vs Node 24.12.0 in .tool-versions; eslint 9 → 10 is unrelated scope. Inline on docs/package.json.
• CLAUDE.md gate 5 documents a different invocation than test.yml runs. Inline.
• what-is-mocktioneer.md row still labeled "Fixed pricing". Inline.
• config.rs non-finite test uses fixed-name files in the shared temp dir. Inline.

📌 Out of scope

• spin up is blocked upstream (spin-sdk 6.0.0 imports wasi:http@0.3.0-rc, no released Spin provides it). The adapter builds and passes the wasmtime contract tests, and the limitation is documented in three places — but edgezero.toml still ships a serve command that cannot work on any current runtime. Worth a tracking issue so it doesn't quietly become permanent.

👍 Praise

• assert_config_out_of_date asserts status and Retry-After and error.kind — the compatibility contract, not a status code that could match by accident. Inline.
• loader_rejects_non_finite_bid_cpm pins an upstream guarantee the bid_cpm doc comment leans on. inf > 0.0 is true and TOML can express bid_cpm = inf, so without edgezero's loader guard an operator could serve infinite-priced bids. Testing someone else's invariant is usually a smell; here it's the right call, and the comment says why. Inline.
• The Fastly and Cloudflare contract tests drive a seeded blob through the real dispatch path (FastlyService / CloudflareService + with_config_handle), not just the core router — so the config-store binding at the adapter boundary is covered, which is exactly where this migration could have silently broken.
• The Docker smoke test both gates publication and proves the 0.0.0.0 bind by hitting the mapped host port — a loopback bind would fail it. Nice touch, and it catches the class of bug that only shows up in a container.

CI Status

Verified locally against 2e697d1:

• cargo fmt --all -- --check — PASS
• cargo clippy --workspace --all-targets --all-features -- -D warnings — PASS
• cargo test --workspace --all-targets — PASS (170 tests: 150 + 12 + 8, 0 failed)

All GitHub checks green: cargo fmt, cargo test, fastly/cloudflare/spin wasm tests, playwright, format-docs, Docker build & push, CodeQL.