Remove legacy entry point; add streaming publisher path and cross-adapter admin 501 parity

[prk-Jr]

Summary

• Deletes legacy_main, route_request, HandlerOutcome, and all canary flag-reading machinery (edgezero_enabled / edgezero_rollout_pct) now that EdgeZero has reached full functional parity and the cutover canary (PR19) is merged.
• Removes the error module, the legacy route_tests file, and unused compat functions that only existed to support the old code path.
• Simplifies main to a direct trampoline into edgezero_main, removing ~710 lines of dead code and the two config-store keys from fastly.toml.
• Rewrites the Fastly publisher path onto handle_streaming_publisher_request: origin responses stream chunk-by-chunk via StreamingBodyReader, full-document HTML is buffered only up to publisher.max_buffered_body_bytes, and Content-Length is stripped on the processable Stream route (recomputed only after buffered rewrites). This is a distinct publisher-streaming feature that landed in this branch, not cleanup.
• Brings the Cloudflare and Spin adapters to parity with Axum by returning 501 Not Implemented for /_ts/admin/keys/* key-management routes (admin_key_management_not_supported), since those runtimes have no KV-backed key store. Adds route tests.

Changes

File	Change
crates/trusted-server-adapter-fastly/src/main.rs	Delete legacy_main, route_request, HandlerOutcome, flag constants, and all associated imports (~710 lines removed)
crates/trusted-server-adapter-fastly/src/error.rs	Delete entire module (only used by legacy path)
crates/trusted-server-adapter-fastly/src/route_tests.rs	Delete legacy route test file
crates/trusted-server-adapter-fastly/src/compat.rs	Remove legacy-only compat functions; keep Fastly↔EdgeZero conversion helpers
crates/trusted-server-adapter-fastly/src/platform.rs	Remove build_runtime_services (legacy-only)
crates/trusted-server-adapter-fastly/src/app.rs	Remove runtime_services_for_consent_route and build_state (legacy-only); wire publisher path to handle_streaming_publisher_request; add streaming runtime services + regression tests
crates/trusted-server-adapter-fastly/src/middleware.rs	Clean up unused imports left behind by legacy removal
crates/trusted-server-core/src/publisher.rs	Add StreamingBodyReader + handle_streaming_publisher_request: chunked origin streaming, bounded full-document buffering, Content-Length handling for the Stream route
crates/trusted-server-core/src/settings.rs	Add publisher.max_buffered_body_bytes buffer cap
crates/trusted-server-adapter-cloudflare/src/app.rs	Return 501 for /_ts/admin/keys/* (parity with Axum's admin_not_supported); add route tests
crates/trusted-server-adapter-spin/src/app.rs	Return 501 for /_ts/admin/keys/* (parity with Axum's admin_not_supported); add route tests
fastly.toml	Remove edgezero_enabled and edgezero_rollout_pct config-store entries
docs/superpowers/plans/2026-05-27-pr20-legacy-cleanup.md	Add plan document for this cleanup

Closes

Closes #501

Test plan

• cargo fmt --all -- --check
• cargo clippy-fastly
• cargo clippy-axum
• cargo test-fastly — 48 tests passed, 0 failed
• cargo test-axum — 20 tests passed, 0 failed
• cargo test-cloudflare — admin key-management 501 route tests pass
• cargo test-spin — admin key-management 501 route tests pass
• JS tests: cd crates/js/lib && npx vitest run — 291 tests passed
• JS format: cd crates/js/lib && npm run format
• Docs format: cd docs && npm run format

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• No secrets or credentials committed

[ChristianPavilonis]

Automated review: I reviewed PR #744 against feature/edgezero-pr19-cutover-canary, focusing on the Fastly post-cutover path, config/test changes, and compatibility risks. Current GitHub checks are green, and I did not find a blocking security, data-loss, authorization, or CI-breaking issue. I did find two compatibility concerns worth addressing or explicitly accepting; details are inline.

[aram356]

Summary

Re-review of the updated head (1e93245). All three blocking findings from the previous pass are resolved and CI is fully green — I verified each fix against the code, not just the check status. One new blocking issue was introduced by this update: fastly.toml no longer declares KV stores the runtime still opens, which breaks local fastly compute serve for EC. Details below.

Resolved since last review

• ✅ cargo test / admin_endpoints_match_fastly_router — test repointed from main.rs to app.rs and the parser updated to the NamedRoute path: format; ADMIN_ENDPOINTS (/_ts/admin/keys/{rotate,deactivate}) now matches the routes in app.rs. Verified passing.
• ✅ integration tests + browser integration tests — root cause was the default viceroy-template.toml not declaring the trusted_server_config store that the EdgeZero entry point opens at startup. Now declared, with a guard test (default_fastly_viceroy_template_defines_trusted_server_config_store).
• ✅ middleware.rs doc — no longer references "the legacy entry point".

Cross-cutting / body-level findings

• 🔧 fastly.toml dropped KV stores the EdgeZero runtime still opens — local fastly compute serve will fail for EC. This update's net diff removes ec_identity_store, counter_store, and opid_store from [local_server.kv_stores] (leaving only creative_store plus a newly-added consent_store). This is the PR's change, not base drift — both the merge-base and the current base tip still declare all three.

  The concrete breakage is ec_identity_store:

  • trusted-server.toml still sets ec_store = "ec_identity_store" (active; not in this PR's diff).
  • The EdgeZero path opens it via open_kv_store (platform.rs, called from app.rs).
  • [local_server.kv_stores] is the only store config Viceroy / fastly compute serve reads.

  So fastly compute serve + any EC identify/batch-sync request → open_kv_store("ec_identity_store") → store-not-found error. The pre-seeded test EC entry used by test-prebid-eids.sh is also gone.

  Why CI stays green: the integration suites use viceroy-template.toml, which still declares counter_store, opid_store, ec_identity_store (with seeds), and ec_partner_store. fastly.toml is never exercised by CI, so the divergence is invisible to the checks. Production is unaffected ([local_server] is Viceroy-only; production stores are provisioned out-of-band).

  This looks unintended (it surfaced through merge mechanics, not an explicit fastly.toml edit in any commit). Suggested fix: restore ec_identity_store (with its test seed) and counter_store to fastly.toml so it matches trusted-server.toml and viceroy-template.toml; or, if a store rename was intended, update all three consistently. Proposed [local_server.kv_stores] shape:

      [local_server.kv_stores]
          [[local_server.kv_stores.counter_store]]
              key = "placeholder"
              data = "placeholder"
  
          [[local_server.kv_stores.creative_store]]
              key = "placeholder"
              data = "placeholder"
  
          [[local_server.kv_stores.ec_identity_store]]
              key = "placeholder"
              data = "placeholder"
  
          # Pre-seeded test EC entry for local script testing (test-prebid-eids.sh).
          [[local_server.kv_stores.ec_identity_store]]
              key = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test01"
              data = '{"v":1,"created":1700000000,"last_seen":1700000000,"consent":{"ok":true,"updated":1700000000},"geo":{"country":"US"}}'
  
          [[local_server.kv_stores.consent_store]]
              key = "placeholder"
              data = "placeholder"

  (opid_store has no runtime or config reference, so dropping it appears safe to leave out.)

CI Status

• cargo fmt: PASS
• cargo test: PASS
• cargo test (axum native): PASS
• cargo test (cross-adapter parity): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• vitest: PASS
• format-typescript: PASS
• format-docs: PASS
• prepare integration artifacts: PASS
• integration tests: PASS
• integration tests (EdgeZero entry point): PASS
• browser integration tests: PASS

No checks are marked required under branch protection; per CLAUDE.md these are still PR gates. The new finding is config-only and not exercised by any check.

[aram356]

Summary

Re-review of head 1e93245 (unchanged since my previous review). The three original blocking findings remain resolved. The one blocking issue from the last pass — fastly.toml dropping KV stores the runtime still opens — is still unaddressed at this head, so the verdict stays REQUEST_CHANGES. This pass also went deeper on the large deletions and the entry point; those results are recorded below as confirmation (no new blocking issues).

Still blocking (unchanged from previous review)

• 🔧 fastly.toml dropped ec_identity_store / counter_store / opid_store from [local_server.kv_stores]. trusted-server.toml still sets ec_store = "ec_identity_store" and the EdgeZero path opens it via open_kv_store, so fastly compute serve + any EC identify/batch-sync request fails with a store-not-found error; the pre-seeded test EC entry used by test-prebid-eids.sh is also gone. This is the PR's change (both merge-base and base tip still declare all three stores). CI stays green only because the integration suites use viceroy-template.toml (which still declares them), not fastly.toml. Production is unaffected ([local_server] is Viceroy-only). Restore ec_identity_store (with its seed) and counter_store to fastly.toml, or if a rename was intended, update trusted-server.toml and viceroy-template.toml to match. (opid_store has no runtime/config reference and can stay removed.)

Deep-pass verification (no action needed — recorded for confidence)

• 📝 route_tests.rs deletion (1867 lines) loses no coverage. All 43 deleted tests import route_request/HandlerOutcome (the removed legacy router). The scenarios are re-covered by the EdgeZero app.rs test module (asset-route fallthrough, tester-cookie enable/disable, legacy_admin_aliases_denied_locally_not_proxied_to_publisher, dispatch_unregistered_method_returns_405_at_router_level, consent-store fail-closed) plus behavior-level tests in core.
• 📝 compat.rs removal of the Body::Stream debug_assert is benign. app.rs buffers streaming publisher/asset bodies to Body::Once (buffer_publisher_response / buffer_asset_body, bounded by publisher.max_buffered_body_bytes) before the response leaves the router, so the Stream arm in to_fastly_response is unreachable by design; the warn! log remains as a safety net.
• 📝 main.rs entry point is correct — config-store open, forwarded-header sanitization, TLS-scheme re-injection, EC finalize, and geo application are all sound; streaming responses are buffered before the Fastly conversion.

Resolved (confirmed still fixed)

• ✅ admin_endpoints_match_fastly_router — repointed to app.rs + NamedRoute parser; passes.
• ✅ integration/browser suites — default viceroy-template.toml now declares trusted_server_config, with a guard test.
• ✅ middleware.rs doc — no longer references "the legacy entry point".

CI Status

All 13 checks PASS (cargo fmt, cargo test, cargo test axum native, cross-adapter parity, cloudflare check, spin check/build/test, vitest, format-typescript, format-docs, prepare integration artifacts, integration tests, integration tests (EdgeZero entry point), browser integration tests). The open finding is config-only and not exercised by any check.

[aram356]

Summary

Re-review of head 1e93245 (unchanged) — findings now anchored as inline comments. Verdict stays REQUEST_CHANGES for the one open blocking issue (fastly.toml KV stores). The three original findings remain resolved, and the deep-pass items are confirmations, not action items.

Blocking

🔧 wrench

• fastly.toml dropped KV stores the runtime still opens — see inline at fastly.toml:30 (carries a one-click suggestion).

Non-blocking

📝 note

• compat.rs Body::Stream debug_assert removal is benign — see inline at crates/trusted-server-adapter-fastly/src/compat.rs:20.

Deep-pass confirmations (no inline anchor — whole-file / deleted-file)

• route_tests.rs deletion (−1867) loses no coverage — all 43 tests were legacy route_request/HandlerOutcome; scenarios re-covered by app.rs EdgeZero tests + core behavior tests.
• main.rs entry point verified correct — config-store open, header sanitization, TLS-scheme re-injection, EC finalize, geo application all sound.

Resolved (confirmed still fixed)

• ✅ admin_endpoints_match_fastly_router — repointed to app.rs + NamedRoute parser; passes.
• ✅ integration/browser suites — viceroy-template.toml now declares trusted_server_config, with a guard test.
• ✅ middleware.rs doc — no longer references "the legacy entry point".

CI Status

All 13 checks PASS. The open finding is config-only and not exercised by any check.

[ChristianPavilonis]

Review Summary

Approved. I reviewed PR #744 against main with senior-review focus on correctness, compatibility, CI coverage, and adapter behavior. The current GitHub checks are green; I left non-blocking CREG notes inline for follow-up.

📝 CI / existing-review context: GitHub currently reports the branch as conflicting with current main, so it still needs a rebase/merge conflict resolution before it can land. Existing reviews already cover the fastly.toml local KV-store drift and the Fastly streaming-size compatibility concern; I did not duplicate those inline.

Resubmitting this review as a non-blocking comment instead of approval.

[ChristianPavilonis]

Review Summary

Resubmitting the previous review as a non-blocking COMMENT rather than an approval. I reviewed PR #744 against main with senior-review focus on correctness, compatibility, CI coverage, and adapter behavior. The current GitHub checks are green.

📝 CI / existing-review context: GitHub currently reports the branch as conflicting with current main, so it still needs a rebase/merge conflict resolution before it can land. Existing reviews already cover the fastly.toml local KV-store drift and the Fastly streaming-size compatibility concern; I did not duplicate those inline.

🌱 Non-blocking findings noted in the dismissed review's inline comments:

• .github/workflows/format.yml:41 — Cloudflare wasm production code is not clippy-gated; the missing wasm clippy command currently fails with -D warnings.
• crates/trusted-server-adapter-cloudflare/src/app.rs:342 — Cloudflare exposes authenticated admin key-management routes even though platform store writes/deletes are unsupported.
• crates/trusted-server-adapter-spin/src/app.rs:647 — Spin exposes authenticated admin key-management routes even though platform store writes/deletes are unsupported.

[aram356]

Summary

Re-review of head cd172cfd (base re-targeted to main). The previously-blocking fastly.toml finding is resolved — counter_store and both ec_identity_store entries (including the pre-seeded test seed) are restored, consent_store kept, opid_store correctly dropped. I deep-reviewed the new streaming publisher work and cross-adapter changes and found no correctness issues: StreamingBodyReader chunked reads, full-document buffering bounded by max_buffered_body_bytes, Content-Length stripped on the Stream route (publisher.rs:863), and skeleton + stream_to_client with mid-stream error handling. CI is 19/19 green.

Approving on code correctness. The two items below are must-resolve scope/description issues, not code defects — see inline comments.

Must resolve

• 📌 New streaming feature bundled into a cleanup PR — see inline at crates/trusted-server-core/src/publisher.rs:636.
• 📌 Cross-adapter 501 key-management change undocumented — see inline at crates/trusted-server-adapter-cloudflare/src/app.rs:196.

Resolved since last review

• ✅ fastly.toml KV stores restored (counter_store, ec_identity_store + test seed); consent_store kept. Local fastly compute serve EC path no longer breaks.

CI Status

All 19 checks PASS: cargo fmt, cargo test, cargo test (axum native), cargo test (ts CLI native), cross-adapter parity, cargo check (cloudflare), cargo check/build/test (spin), vitest, format-typescript, format-docs, integration tests, browser integration tests, integration tests (Fastly EC lifecycle), prepare integration artifacts, CodeQL, Analyze (rust), Analyze (javascript-typescript), Analyze (actions).