Adapt Mocktioneer to edgezero v0.0.4 (extensible CLI, typed config, introspection routes)

[aram356]

Closes #115

What this PR does

Adapts Mocktioneer to the released edgezero v0.0.4, which lands the extensible CLI (stackpop/edgezero#269) and the pluggable introspection routes (#300). The design spec and implementation plan that opened this PR are included under docs/superpowers/; the implementation now follows them end to end.

Changes

• Compat: pin the six edgezero-* git deps to the immutable tag v0.0.4; drop the include_str!(manifest) arg from every adapter run_app; migrate the Spin adapter to spin-sdk ~6.0 / wasm32-wasip2 (Fastly stays wasm32-wasip1).
• Typed config: add a validated MocktioneerConfig (bid_cpm, range(exclusive_min = 0.0)), a gitignored mocktioneer.toml with a committed mocktioneer.toml.example template, and a mocktioneer-cli crate mirroring edgezero's generated <name>-cli (config validate/diff/push, auth/build/deploy/provision/serve).
• Runtime (fail-loud): the OpenRTB (/openrtb2/auction) and APS (/e/dtb/bid) handlers read bid_cpm from the bound config store via edgezero's typed AppConfig extractor. A fresh deploy must config push once before those endpoints serve bids — until then they error. FIXED_BID_CPM = 0.20 is the shipped default value, not a runtime fallback. Other endpoints (static/creative/pixel) are unaffected.
• Config storage: config push writes the whole struct as a single canonical-JSON blob envelope (SHA-gated for drift detection) under the store's key, per adapter (axum local file / cloudflare KV / fastly config store / spin KV).
• Introspection: mount the framework-supplied /_mocktioneer/{manifest,config,routes} routes from edgezero_core::introspection (unauthenticated — restrict at the network/middleware layer; [environment.secrets] are redacted).
• Plumbing: [stores.config] in the manifest + Spin runtime-config.toml; Dockerfile seeds the default config blob and binds 0.0.0.0; docs (wasip2, fail-loud typed config, introspection, edgezero-cli-vs-mocktioneer-cli); a config validate --strict --app-config mocktioneer.toml.example CI gate + a Docker smoke test.

Notes

• Base is main, which already carries the strict-clippy + edgezero PR #257 adaptation (via PR Adopt edgezero strict-clippy gate and PR #257 API #108).
• Deps pin to the released tag v0.0.4 (immutable), so no post-merge re-pin is needed.
• Spin spin up is blocked upstream: the adapter compiles to wasm32-wasip2 and passes the wasmtime router contract tests, but spin up on current Spin runtimes fails to link because spin-sdk 6.0.0 pulls wasi:http@0.3.0-rc, which no released Spin provides. This is a spin-sdk/runtime ABI mismatch to resolve upstream; Fastly / Cloudflare / Axum are unaffected.

CI

fmt · clippy -D warnings · test --workspace · check --features "fastly cloudflare" · config validate --strict · Docker build + smoke · Playwright · docs ESLint/Prettier — all green.

[ChristianPavilonis]

Summary

Reviewed PR #110 (feature/edgezero-extensible-cli) against main. The typed-config wiring is mostly coherent and CI is green, but I found two blocking deployment/runtime compatibility issues plus two medium follow-ups. Details are inline.

[prk-Jr]

PR Review

Summary

Adapts Mocktioneer to the breaking edgezero #269 (extensible CLI): typed MocktioneerConfig with runtime bid_cpm resolution via the fail-loud AppConfig extractor, a mocktioneer-cli crate, a new Spin adapter (wasm32-wasip2), introspection routes, [stores.config] plumbing, and a workspace-wide clippy-restriction gate. All local CI gates pass. Solid, well-tested work — the only merge-relevant question is the edgezero dependency pin target.

Note: the PR description still reads "docs-only — design + plan, no implementation code yet." The branch now carries the full implementation (~6.5k insertions). Worth updating the body so reviewers see the real scope.

Findings

❓ Questions

• edgezero dep pin (Cargo.toml:32): pinned to worktree-feature+introspection-routes rather than the feature/extensible-cli the docs describe. Reproducible today (Cargo.lock locks the SHA), fragile if that branch moves. See inline.

🌱 Seeds / 📌 Out of scope

• Env-var security on Workers (routes.rs): MOCKTIONEER_TS_DOMAINS open-redirect allowlist and MOCKTIONEER_PULL_TOKEN resolve-auth are std::env::var-gated, so both no-op on Cloudflare. Pre-existing; candidate to fold into the new [stores.config]. See inline.
• Stale PR description: says docs-only; is a full implementation.

⛏ Nitpicks

• Dockerfile base drift (Dockerfile:39): runtime debian:stable-slim (rolling) vs builder bookworm (pinned). Pin bookworm-slim to match. Docker build not exercised by the local Rust CI.

🤔 Thoughts

• The clippy-restriction mechanical sweep (literal suffixes, struct-field reordering, as _ imports, to_owned) is interleaved with the substantive logic changes, which makes the real diff harder to isolate. Future gate adoptions could land the reformat as its own commit/PR.

👍 Praise

• Mediation is now deterministic: HashMap → BTreeMap plus unwrap() → let-else, with first-bidder-wins tie-break preserved (mediation.rs:160).
• Constant-time bearer comparison over SHA-256 digests (avoids length leak); thorough is_valid_hostname rejecting IP literals / path / auth / port / fragment injection, with matching tests.
• CI seeds a non-default bid_cpm and asserts it round-trips through config push — catches wiring regressions a default-value test would miss.
• Spin adapter correctly gated to wasm32 with a #[expect(...)]-documented unsafe_code allowance, plus a wasip2 contract test in the CI matrix.

CI Status (run locally on this branch)

• fmt: PASS
• clippy (--workspace --all-targets --all-features -D warnings): PASS
• tests (cargo test --workspace --all-targets): PASS

[prk-Jr]

PR Review

Summary

Solid adaptation to edgezero #269: typed MocktioneerConfig with fail-loud AppConfig wiring on the OpenRTB/APS paths, a thin mocktioneer-cli over the edgezero-cli library, the Spin wasip2 migration, Docker config seeding + smoke test, and CI config gates — with the docs updated everywhere the fail-loud model is user-visible. No blocking code issues; the remaining asks are PR metadata and small polish (4 inline comments below).

Findings

📝 Notes

• Stale PR title/body — please update before merge: the body still says "no implementation code yet… This PR is docs-only", but the branch now ships the full implementation (typed config + fail-loud AppConfig wiring, the mocktioneer-cli crate, Spin wasip2 migration, Docker config seeding + smoke test, CI config gates, introspection routes). Reviewers and the audit trail read the description first — please rewrite the title/body to describe what actually merges.

📌 Out of Scope

• Re-pin tracking: the worktree-feature+introspection-routes pin is acknowledged as intentional (introspection routes only exist there). Suggest opening a tracking issue to re-pin to edgezero main once #269 + the introspection branch land, so a throwaway-named branch doesn't rot underneath a merged main (Cargo.toml:26-31).

🌱 Seeds

• Introspection auth: /_mocktioneer/{manifest,config,routes} are unauthenticated by design and the docs warn about it correctly. A future option: a shared-token middleware for public deployments, so the route block can stay bound in edgezero.toml without a network-layer prerequisite.

👍 Praise

• Fail-loud test coverage: seeded-cpm + missing-config tests on both the OpenRTB and APS paths, a CI step that round-trips a non-default 0.35 into the blob envelope, and a Docker smoke test that proves the 0.0.0.0 bind and an out-of-the-box auction. This is the right shape of evidence for a behavior-changing config model.
• Docs discipline: the config-push prerequisite is surfaced on every quickstart, adapter, API, and integration page, and the MOCKTIONEER__* env-overlay semantics (applied at push time, not runtime) are spelled out precisely.

CI Status

• fmt: PASS (verified locally)
• clippy: PASS (per CI)
• tests: PASS (per CI)

[ChristianPavilonis]

Summary

Reviewed PR #110 at 0bd3e152 against main. The core typed-config and pricing flow is coherent, but this review found one high-risk release-workflow problem and three medium test/documentation gaps. Current CI is green; the previously identified Spin runtime ABI incompatibility also remains a known operational limitation.

[ChristianPavilonis]

Summary

Approved. The typed-config pricing path, adapter bindings, Docker behavior, and CLI wiring are coherent, and all current CI checks pass. I left two non-blocking P2 notes inline: preserving the existing public builder signatures and completing the Fastly remote config deployment instructions.

The previously documented Spin runtime ABI limitation remains an acknowledged operational constraint.

[prk-Jr]

PR Review

Summary

Adapts Mocktioneer to edgezero v0.0.4 (extensible CLI, blob-model typed config, pluggable introspection routes). The change is well-scoped, thoroughly tested, and has clearly been through several review rounds. No blocking findings. Verdict is COMMENT — a handful of non-blocking questions, one build-cache cleanup, a design-level footgun to keep in view, and a stale doc line. Inline comments carry the file-specific items.

Findings

♻️ Refactor

• Dockerfile redundant manifest COPYs — six per-crate Cargo.toml copies are superseded by COPY crates ./crates before cargo fetch, so they add no layer caching. Inline at Dockerfile:16.

❓ Questions

• anyhow in core with no src/ usage — likely required by the AppConfig derive; please confirm, else drop. Inline at crates/mocktioneer-core/Cargo.toml:9.
• bid_cpm accepts +Inf — exclusive_min = 0.0 passes infinity; upstream non-finite rejection isn't pinned by a test in this repo. Inline at crates/mocktioneer-core/src/config.rs:15.

🌱 Seeds / 📌 Out of scope

• Unauthenticated introspection on prod adapters — /_mocktioneer/{manifest,config,routes} publicly enumerable on cloudflare/fastly. Documented and safe today; footgun once anything sensitive enters the manifest. Inline at edgezero.toml:15.
• Breaking runtime change — /openrtb2/auction and /e/dtb/bid now return 503 config_out_of_date until an operator runs config push. This is the intended fail-loud behavior and is well documented, but existing deploys that upgrade will start erroring until they push. Please make sure this lands prominently in the release notes / CHANGELOG so it isn't a surprise on rollout.

⛏ Nitpicks

• Stale doc — GET /_/sizes still described "with pricing" though cpm is no longer echoed. Inline at README.md:51.

👍 Praise

• Fail-loud contract is genuinely well tested: assert_config_out_of_date (503 + Retry-After + error.kind = config_out_of_date) exercised at the route level for both OpenRTB and APS, plus config-seeded auction contract tests through the real Fastly (Viceroy) and Cloudflare (wasm-bindgen) runtimes, and a Docker smoke test that gates image publication on an actual live bid. Strong end-to-end coverage of the new config-store path.
• Security hygiene from the base is preserved throughout: constant-time token comparison, hostname / path-injection validation on ts_domain, log sanitization, and #[serde(deny_unknown_fields)] on the typed config.

CI Status

Verified locally on the branch head:

• fmt: PASS
• clippy (--workspace --all-targets --all-features -D warnings): PASS
• tests (--workspace --all-targets, host targets): PASS

Full remote CI (wasm adapter matrix, Playwright, Docker build + smoke, docs ESLint/Prettier) reported green.