aram356 · May 27, 2026 · May 27, 2026 · May 27, 2026 · May 27, 2026 · May 27, 2026
diff --git a/.claude/agents/code-architect.md b/.claude/agents/code-architect.md
@@ -16,7 +16,7 @@ architectural principles:
 
 3. **Thin adapters**: each adapter translates platform types to/from core types.
    Business logic never lives in adapters. The adapter file structure is:
-   `context.rs`, `request.rs`, `response.rs`, `proxy.rs`, `logger.rs`, `cli.rs`.
+   `context.rs`, `request.rs`, `response.rs`, `outbound.rs`, `logger.rs`, `cli.rs`.
 
 4. **Contract testing**: every adapter has `tests/contract.rs` that validates
    request/response mapping. New adapters must follow this pattern.

diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
@@ -37,7 +37,7 @@ jobs:
 
       - name: Retrieve Rust version
         id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Set up rust toolchain
@@ -84,28 +84,41 @@ jobs:
         working-directory: examples/app-demo
         run: cargo clippy --workspace --all-targets --all-features -- -D warnings
 
-  adapter-wasm-clippy:
-    name: ${{ matrix.adapter }} wasm clippy
+  adapter-clippy:
+    name: ${{ matrix.check_name }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         include:
           - adapter: cloudflare
             target: wasm32-unknown-unknown
-            features: cloudflare
+            check_name: cloudflare wasm clippy
+            feature_sets: |-
+              cloudflare
+              cloudflare,test-utils
           - adapter: fastly
             target: wasm32-wasip1
-            features: fastly
-          # The `cli` feature is a valid wasip1 build combination (the CLI host
-          # code compiled for the guest target); gate it so a dead-code or
-          # portability regression there is caught, not only in the fastly-only build.
-          - adapter: fastly
-            target: wasm32-wasip1
-            features: fastly cli
+            check_name: fastly wasm clippy
+            # The `cli` feature is valid on wasip1. Lint it independently so
+            # feature unification cannot mask target-specific cfg mistakes.
+            feature_sets: |-
+              fastly
+              fastly,cli
+              fastly,test-utils
+              fastly,cli,test-utils
           - adapter: spin
             target: wasm32-wasip2
-            features: spin
+            check_name: spin wasm clippy
+            feature_sets: |-
+              spin
+              spin,test-utils
+          - adapter: axum
+            target: native
+            check_name: axum native clippy
+            feature_sets: |-
+              axum
+              axum,test-utils
     steps:
       - uses: actions/checkout@v6
         with:
@@ -126,7 +139,7 @@ jobs:
 
       - name: Retrieve Rust version
         id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Set up Rust tool chain
@@ -136,17 +149,46 @@ jobs:
           components: clippy
 
       - name: Add wasm target
+        if: matrix.target != 'native'
         run: rustup target add ${{ matrix.target }}
 
       - name: Fetch dependencies (locked)
         run: cargo fetch --locked
 
-      - name: Clippy ${{ matrix.adapter }} (${{ matrix.features }}) on ${{ matrix.target }}
-        run: cargo clippy -p edgezero-adapter-${{ matrix.adapter }} --features "${{ matrix.features }}" --target ${{ matrix.target }} --all-targets -- -D warnings
+      - name: Clippy ${{ matrix.adapter }} feature combinations on ${{ matrix.target }}
+        env:
+          ADAPTER: ${{ matrix.adapter }}
+          FEATURE_SETS: ${{ matrix.feature_sets }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          target_args=()
+          if [[ "${TARGET}" != "native" ]]; then
+            target_args=(--target "${TARGET}")
+          fi
+
+          while IFS= read -r features; do
+            echo "==> edgezero-adapter-${ADAPTER} ${TARGET} features=[${features}]"
+            cargo clippy \
+              --package "edgezero-adapter-${ADAPTER}" \
+              --no-default-features \
+              --features "${features}" \
+              "${target_args[@]}" \
+              --all-targets \
+              -- \
+              -D warnings
+          done <<<"${FEATURE_SETS}"
 
       - name: Clippy ${{ matrix.adapter }} lifecycle fixture
-        if: matrix.features != 'fastly cli'
-        run: cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-${{ matrix.adapter }} --target ${{ matrix.target }} --all-targets -- -D warnings
+        env:
+          ADAPTER: ${{ matrix.adapter }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          target_args=()
+          if [[ "${TARGET}" != "native" ]]; then
+            target_args=(--target "${TARGET}")
+          fi
+          cargo clippy --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml \
+            -p "fixture-${ADAPTER}" "${target_args[@]}" --all-targets -- -D warnings
 
   format-docs:
     runs-on: ubuntu-latest
@@ -162,7 +204,7 @@ jobs:
       - name: Retrieve Node.js version
         id: node-version
         working-directory: .
-        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Use Node.js
@@ -180,3 +222,10 @@ jobs:
 
       - name: Run Prettier (check)
         run: npm run format
+
+      - name: Check outbound documentation contract
+        working-directory: .
+        run: node scripts/check_outbound_docs_contract.mjs
+
+      - name: Build documentation
+        run: npm run build
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -48,14 +48,18 @@ jobs:
       - name: Set up Rust tool chain
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
+          components: "clippy, rustfmt"
           toolchain: ${{ steps.rust-version.outputs.rust-version }}
 
       - name: Install wasm targets for generated-project checks
-        if: matrix.suite == 'cli'
+        if: matrix.suite == 'cli' || matrix.suite == 'workspace' || matrix.suite == 'app-demo'
         run: rustup target add wasm32-wasip1 wasm32-wasip2 wasm32-unknown-unknown
 
       - name: Fetch dependencies (locked)
-        run: cargo fetch --locked
+        run: |
+          cargo fetch --locked
+          cargo fetch --locked --manifest-path examples/app-demo/Cargo.toml
+          cargo fetch --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml
 
       - name: No placeholder pins
         if: matrix.suite == 'workspace'
@@ -65,6 +69,28 @@ jobs:
         if: matrix.suite == 'workspace'
         run: ./scripts/check_no_legacy_typed_reads.sh
 
+      # These roots are the active API surface. Historical design and plan
+      # documents under docs/superpowers intentionally remain immutable.
+      - name: No legacy outbound API
+        run: bash scripts/check_outbound_legacy_api.sh
+
+      - name: Outbound documentation contract
+        run: node scripts/check_outbound_docs_contract.mjs
+
+      - name: Build strict public API documentation
+        env:
+          RUSTDOCFLAGS: -D warnings
+        run: cargo doc --offline --locked --workspace --all-features --no-deps
+
+      - name: Brotli dependency contract
+        run: node scripts/check_brotli_dependency_contract.mjs
+
+      - name: Flate dependency contract
+        run: node scripts/check_flate_dependency_contract.mjs
+
+      - name: Serde JSON map contract
+        run: node scripts/check_serde_json_map_contract.mjs
+
       - name: Nested AppConfig audit
         if: matrix.suite == 'cli'
         run: cargo run -q --bin check_no_nested_app_config --features nested-app-config-check -- examples/app-demo crates/edgezero-cli/src/templates
@@ -75,11 +101,9 @@ jobs:
 
       - name: Lifecycle fixture host tests
         if: matrix.suite == 'workspace'
-        run: >-
-          cargo test --locked
-          --manifest-path tests/fixtures/reusable-app/Cargo.toml
-          -p fixture-harness
-          -p fixture-core
+        run: |
+          cargo test --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-harness -p fixture-core --features fixture-core/qualification
+          node --test scripts/qualify_response_egress.test.mjs
 
       - name: Check Axum lifecycle fixture
         if: matrix.suite == 'axum'
@@ -88,10 +112,38 @@ jobs:
           --manifest-path tests/fixtures/reusable-app/Cargo.toml
           -p fixture-axum
 
+      - name: Check opt-in lifecycle qualification fixtures
+        if: matrix.suite == 'workspace'
+        # These are compile-only identities, never deployed qualification evidence.
+        env:
+          EDGEZERO_QUALIFICATION_REVISION: "0000000000000000000000000000000000000000"
+          EDGEZERO_QUALIFICATION_ARTIFACT: "0000000000000000000000000000000000000000000000000000000000000000"
+        run: |
+          cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-axum --features qualification
+          cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-fastly --features qualification --bin fixture-fastly-qualification --target wasm32-wasip1
+          cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-cloudflare --features qualification --target wasm32-unknown-unknown
+          cargo check --locked --manifest-path tests/fixtures/reusable-app/Cargo.toml -p fixture-spin --features qualification --target wasm32-wasip2
+
       - name: Run workspace tests
         if: matrix.suite == 'workspace'
         run: cargo test --workspace --all-targets
 
+      - name: Bundled demo logging contract
+        if: matrix.suite == 'cli'
+        run: scripts/run_test_nonzero.sh demo_respects_off_without_hiding_terminal_errors cargo test --offline --locked -p edgezero-cli --features demo-example --test demo_logging
+
+      - name: Run native outbound adapter contracts
+        if: matrix.suite == 'workspace'
+        run: |
+          scripts/run_test_nonzero.sh batch_preflight_precedence_and_indices cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum,test-utils --test contract
+          scripts/run_test_nonzero.sh batch_preflight_precedence_and_indices cargo test --offline --locked -p edgezero-adapter-cloudflare --no-default-features --features test-utils --test contract
+          scripts/run_test_nonzero.sh batch_preflight_rejects_streamed_slots_without_poisoning_siblings cargo test --offline --locked -p edgezero-adapter-fastly --no-default-features --features test-utils --test contract
+          scripts/run_test_nonzero.sh batch_preflight_precedence_and_indices cargo test --offline --locked -p edgezero-adapter-spin --no-default-features --features test-utils --test contract
+
+      # The adapter CLI dispatch (build/deploy/stage/healthcheck/rollback) and
+      # its tests live behind the `cli` feature, which the unfeatured
+      # `cargo test --workspace` step above does not enable — so none of those
+      # tests compile or run there. Exercise them explicitly.
       - name: Run EdgeZero CLI tests
         if: matrix.suite == 'cli'
         run: cargo test -p edgezero-cli --all-targets
@@ -108,13 +160,28 @@ jobs:
           --no-default-features
           --features cli
 
+      - name: Verify exact outbound capability matrices
+        if: matrix.suite == 'workspace'
+        run: |
+          scripts/run_test_nonzero.sh adapter_capability_matrix_matches_contracts cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features cli --lib adapter_capability_matrix_matches_contracts
+          scripts/run_test_nonzero.sh adapter_capability_matrix_matches_contracts cargo test --offline --locked -p edgezero-adapter-cloudflare --no-default-features --features cli --lib adapter_capability_matrix_matches_contracts
+          scripts/run_test_nonzero.sh adapter_capability_matrix_matches_contracts cargo test --offline --locked -p edgezero-adapter-fastly --no-default-features --features cli --lib adapter_capability_matrix_matches_contracts
+          scripts/run_test_nonzero.sh adapter_capability_matrix_matches_contracts cargo test --offline --locked -p edgezero-adapter-spin --no-default-features --features cli --lib adapter_capability_matrix_matches_contracts
+
       - name: Check feature compilation
         if: matrix.suite == 'workspace'
         run: cargo check --workspace --all-targets --features "fastly cloudflare spin"
 
+      - name: Check native adapter feature matrices
+        if: matrix.suite == 'workspace'
+        run: |
+          for adapter in axum cloudflare fastly spin; do
+            bash scripts/check_adapter_feature_matrix.sh "${adapter}" native
+          done
+
       - name: Verify a generated project compiles
         if: matrix.suite == 'cli'
-        run: cargo test -p edgezero-cli --test generated_project_builds -- --ignored
+        run: scripts/run_test_nonzero.sh --ignored generated_workspace_compiles cargo test --offline --locked -p edgezero-cli --test generated_project_builds
 
       - name: Run Axum host tests
         if: matrix.suite == 'axum'
@@ -125,6 +192,13 @@ jobs:
         working-directory: examples/app-demo
         run: cargo test --locked --workspace --all-targets
 
+      - name: Check app-demo wasm targets
+        if: matrix.suite == 'app-demo'
+        working-directory: examples/app-demo
+        run: |
+          cargo check --locked -p app-demo-adapter-cloudflare --target wasm32-unknown-unknown --no-default-features --features cloudflare
+          cargo check --locked -p app-demo-adapter-fastly --target wasm32-wasip1 --no-default-features --features fastly
+          cargo check --locked -p app-demo-adapter-spin --target wasm32-wasip2 --no-default-features --features spin
   cargo-test:
     name: cargo test
     needs: host-tests
@@ -147,14 +221,17 @@ jobs:
             target: wasm32-unknown-unknown
             runner_env: CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER
             runner_value: wasm-bindgen-test-runner
+            sentinel: dispatch_runs_router_and_returns_response
           - adapter: fastly
             target: wasm32-wasip1
             runner_env: CARGO_TARGET_WASM32_WASIP1_RUNNER
             runner_value: viceroy run
+            sentinel: dispatch_runs_router_and_returns_response
           - adapter: spin
             target: wasm32-wasip2
             runner_env: CARGO_TARGET_WASM32_WASIP2_RUNNER
-            runner_value: wasmtime run
+            runner_value: wasmtime run -W component-model-async=y -S p3=y -S http=y
+            sentinel: router_dispatches_get_and_returns_response
     steps:
       - uses: actions/checkout@v6
         with:
@@ -257,8 +334,8 @@ jobs:
           echo "$install_dir" >> "$GITHUB_PATH"
           export PATH="$install_dir:$PATH"
           version="$WASMTIME_VERSION"
-          # Compare exact versions so a pin like `44.0.1` does not silently
-          # accept `wasmtime 44.0.10` from a stale cache or runner-provided
+          # Compare exact versions so a pin like `48.0.2` does not silently
+          # accept `wasmtime 48.0.20` from a stale cache or runner-provided
           # binary.
           actual="$(wasmtime --version 2>/dev/null | awk '{print $2}' || true)"
           if [ "$actual" != "$version" ]; then
@@ -279,7 +356,25 @@ jobs:
       - name: Run ${{ matrix.adapter }} wasm tests
         env:
           ${{ matrix.runner_env }}: ${{ matrix.runner_value }}
-        run: cargo test -p edgezero-adapter-${{ matrix.adapter }} --features ${{ matrix.adapter }} --target ${{ matrix.target }} --test contract
+        run: scripts/run_test_nonzero.sh ${{ matrix.sentinel }} cargo test --offline --locked -p edgezero-adapter-${{ matrix.adapter }} --no-default-features --features ${{ matrix.adapter }},test-utils --target ${{ matrix.target }} --test contract
+
+      - name: Run Fastly closed lifecycle wasm sentinel
+        if: matrix.adapter == 'fastly'
+        env:
+          ${{ matrix.runner_env }}: ${{ matrix.runner_value }}
+        run: scripts/run_test_nonzero.sh closed_lifecycle_orders_hooks_and_returns_state_after_delivery cargo test --offline --locked -p edgezero-adapter-fastly --no-default-features --features fastly,test-utils --target wasm32-wasip1 --test contract
+
+      - name: Run Spin WASI HTTP SDK resource tests
+        if: matrix.adapter == 'spin'
+        env:
+          ${{ matrix.runner_env }}: ${{ matrix.runner_value }}
+        run: scripts/run_test_nonzero.sh spin_error_code_table_is_exhaustive cargo test --offline --locked -p edgezero-adapter-spin --no-default-features --features spin,test-utils --target wasm32-wasip2 --test sdk_resources
+
+      - name: Run Cloudflare outbound runtime unit tests
+        if: matrix.adapter == 'cloudflare'
+        env:
+          ${{ matrix.runner_env }}: ${{ matrix.runner_value }}
+        run: scripts/run_test_nonzero.sh streamed_upload_eof_yields_before_final_precedence cargo test --offline --locked -p edgezero-adapter-cloudflare --no-default-features --features cloudflare,test-utils --target wasm32-unknown-unknown --lib
 
       # The colocated runtime unit tests (config-store resolver, chunk
       # remediation) need the `fastly` feature and only RUN under Viceroy — the
@@ -289,8 +384,11 @@ jobs:
         if: matrix.adapter == 'fastly'
         env:
           ${{ matrix.runner_env }}: ${{ matrix.runner_value }}
-        run: cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --lib
+        working-directory: crates/edgezero-adapter-fastly
+        run: ../../scripts/run_test_nonzero.sh backend_creation_error_table_is_exhaustive cargo test --offline --locked --no-default-features --features fastly,test-utils --lib
 
+      - name: Check ${{ matrix.adapter }} wasm feature matrix
+        run: bash scripts/check_adapter_feature_matrix.sh ${{ matrix.adapter }} ${{ matrix.target }}
       - name: Fastly reusable HTTP smoke
         if: matrix.adapter == 'fastly'
         run: ./scripts/smoke_test_reusable_app.sh --adapter fastly --suite smoke
@@ -305,9 +403,6 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
-      - name: Check ${{ matrix.adapter }} wasm target
-        run: cargo check -p edgezero-adapter-${{ matrix.adapter }} --features ${{ matrix.adapter }} --target ${{ matrix.target }}
-
       - name: Check ${{ matrix.adapter }} lifecycle fixture
         run: >-
           cargo check --locked

diff --git a/.tool-versions b/.tool-versions
@@ -1,12 +1,6 @@
 fastly 15.1.0
 nodejs 24.12.0
 rust 1.95.0
-# spin-cli is not pinned by asdf-style version managers (no
-# asdf-spin plugin in widespread use). spin-sdk ~6.0 in the
-# workspace imports wasi:http/types@0.3.0-rc-2026-03-15, which
-# the Spin 3.6.x runtime does not provide; Spin 3.7+ is required
-# for the demo's Spin adapter to boot. Install matching CLI
-# manually (https://spinframework.dev/install) before running
-# smoke_test_config_key_override.sh; otherwise set SKIP_SPIN=1.
-viceroy 0.17.0
-wasmtime 44.0.1
+spin 4.1.0
+viceroy 0.21.0
+wasmtime 48.0.2