October release candidate (DO NOT MERGE)

.claude/commands/check-ci.md

@@ -1,7 +1,7 @@
 Run all CI checks locally, in order. Stop and report if any step fails.
 
 1. `cargo fmt --all -- --check`
-2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare`
+2. `cargo clippy-fastly && cargo clippy-axum && cargo clippy-cloudflare && cargo clippy-cloudflare-wasm && scripts/lint-wasm-clock.sh`
 3. `cargo test-fastly && cargo test-axum && cargo test-cloudflare`
 4. `cargo check-cloudflare` (wasm32-unknown-unknown target check, mirrors CI)
 5. `cd crates/trusted-server-js/lib && npx vitest run`

.claude/skills/deploying-trusted-server-to-fastly/SKILL.md

@@ -40,9 +40,18 @@ accounts and harmless for single-service ones, so prefer it by default.
 - **Always `ts config push --dry-run` first.** It prints the exact target
   physical store; confirm it is the service-scoped one, not a shared default,
   before writing.
-- **Always pass `--service-id=<SID>`** to `fastly compute publish`. A checked-in
-  `fastly.toml` may pin a different (or dead) `service_id`; without the flag,
-  publish targets that one.
+- **Never deploy with `fastly compute publish`.** This app declares Config, KV,
+  and Secret Stores, and only EdgeZero's managed deploy links each selected
+  physical store to the service version under its logical ID. Publishing with
+  the Fastly CLI clones the active version's links, so the new version is
+  missing the links the runtime opens: app config fails to load and every
+  publisher route returns 500 while `/health` still answers 200. Deploy with
+  `ts deploy --adapter fastly --service-id=<SID> --application-release <root>`,
+  with `EDGEZERO_MANIFEST` set to the release's `edgezero.toml`, or EdgeZero's
+  `deploy-fastly` action.
+- **Always pass `--service-id=<SID>`** to any deploy or publish command. A
+  checked-in `fastly.toml` may pin a different (or dead) `service_id`; without
+  the flag, the command targets that one.
 - **`ts config push` only upserts entries**; the target store must already exist
   (`fastly config-store create`) before pushing.
 - **Verify a shared store stayed untouched** by recording its `updated`

.github/actions/setup-integration-test-env/action.yml

@@ -34,16 +34,23 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Retrieve Rust version
-      id: rust-version
-      shell: bash
-      run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
     - name: Retrieve Node.js version
       id: node-version
       shell: bash
       run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
+    # Pin Node before anything compiles trusted-server-core: its dependency on
+    # trusted-server-js runs the TSJS build with the `npm` on PATH. That covers
+    # the Rust builds below and the callers' later cargo steps, and callers use
+    # this Node directly too (e.g. `npm install -g wrangler`), so keep the step
+    # unconditional.
+    - name: Use Node.js for the TSJS build
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ steps.node-version.outputs.node-version }}
+        cache: npm
+        cache-dependency-path: crates/trusted-server-js/lib/package-lock.json
+
     - name: Retrieve Viceroy version
       id: viceroy-version
       if: ${{ inputs.install-viceroy == 'true' }}
@@ -52,11 +59,15 @@ runs:
       run: echo "viceroy-version=$(grep '^viceroy ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
     - name: Set up Rust toolchain
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: ./.github/actions/setup-rust
       with:
-        toolchain: ${{ steps.rust-version.outputs.rust-version }}
         target: wasm32-wasip1
-        cache-shared-key: cargo-${{ runner.os }}
+        # Restore the axum job's main cache: it builds the same axum debug and
+        # Fastly release WASM artifacts. Restore only: test-axum owns this key,
+        # and rust-cache never replaces an exact-match key, so a partial cache
+        # saved by a workflow_dispatch run on main would stick.
+        cache-key: cargo-axum
+        save-cache: "false"
 
     - name: Cache Viceroy binary
       if: ${{ inputs.install-viceroy == 'true' }}
@@ -96,8 +107,11 @@ runs:
     - name: Build WordPress test container
       if: ${{ inputs.build-test-images == 'true' }}
       shell: bash
+      # Docker's official ECR mirror avoids Docker Hub anonymous pull limits.
       run: |
-        docker build -t test-wordpress:latest \
+        docker build \
+          --build-arg DOCKER_LIBRARY=public.ecr.aws/docker/library \
+          -t test-wordpress:latest \
           crates/trusted-server-integration-tests/fixtures/frameworks/wordpress/
 
     - name: Build Next.js test container
@@ -106,6 +120,7 @@ runs:
       run: |
         docker build \
           --build-arg NODE_VERSION=${{ steps.node-version.outputs.node-version }} \
+          --build-arg DOCKER_LIBRARY=public.ecr.aws/docker/library \
           -t test-nextjs:latest \
           crates/trusted-server-integration-tests/fixtures/frameworks/nextjs/
 

.github/actions/setup-rust/action.yml

@@ -0,0 +1,45 @@
+name: Set up pinned Rust
+description: Install the .tool-versions Rust toolchain with a per-job cache that only main saves.
+
+inputs:
+  cache-key:
+    description: Per-job rust-cache key prefix; the runner OS is appended.
+    required: true
+  target:
+    description: Comma-separated extra targets.
+    required: false
+    default: ""
+  components:
+    description: Comma-separated extra components.
+    required: false
+    default: ""
+  save-cache:
+    description: Set to "false" for restore-only callers.
+    required: false
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - name: Retrieve Rust version
+      id: rust-version
+      shell: bash
+      run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+    - name: Remove runner-image Rust toolchain
+      # rust-cache hashes every installed toolchain into its key, so the image's
+      # preinstalled stable would rotate the key on each runner-image rollout.
+      # Unsetting the default stops rustup from silently reinstalling stable
+      # when cargo runs outside the checkout.
+      shell: bash
+      run: if command -v rustup >/dev/null; then rustup toolchain uninstall stable && rustup default none; fi
+
+    - name: Set up Rust toolchain
+      uses: actions-rust-lang/setup-rust-toolchain@v1
+      with:
+        toolchain: ${{ steps.rust-version.outputs.rust-version }}
+        target: ${{ inputs.target }}
+        components: ${{ inputs.components }}
+        cache-shared-key: ${{ inputs.cache-key }}-${{ runner.os }}
+        # PR caches are scoped to their ref and only evict main's shared caches.
+        cache-save-if: ${{ inputs.save-cache == 'true' && github.ref == 'refs/heads/main' }}

.github/workflows/deploy-docs.yml

@@ -32,12 +32,12 @@ jobs:
         id: node-version
         run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
 
+      # No dependency cache: the docs-proposal workflow runs generated content
+      # on the main ref, where it could save a poisoned entry under this key.
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: ${{ steps.node-version.outputs.node-version }}
-          cache: "npm"
-          cache-dependency-path: docs/package-lock.json
 
       - name: Setup Pages
         uses: actions/configure-pages@v4

.github/workflows/docs-proposal.yml

@@ -0,0 +1,187 @@
+name: Documentation proposal
+
+# Proposes documentation edits with Copilot CLI after code merges to main and
+# opens one reviewable pull request per merge. See
+# docs/superpowers/specs/2026-10-01-docs-proposal-automation-design.md.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "crates/**"
+      - "trusted-server.example.toml"
+      - "edgezero.toml"
+      - "fastly.toml"
+      - ".cargo/config.toml"
+      - "scripts/**"
+      - "!scripts/docs-proposal/**"
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: Full SHA of a commit on main to propose documentation for
+        required: true
+        type: string
+      base:
+        description: >-
+          Full SHA of main before the push that added the commit, when that
+          push added several commits; defaults to the commit's first parent
+        required: false
+        type: string
+
+permissions: {}
+
+# Sequential merges are proposed one at a time, in order. The default queue
+# keeps only one pending run and cancels older ones, so keep them all. Every
+# job has a timeout so a hung run cannot hold the queue for hours.
+concurrency:
+  group: docs-proposal
+  cancel-in-progress: false
+  queue: max
+
+# Each job runs the proposal scripts from the workflow's own revision in
+# `tools/` against a checkout of the merge commit in `source/`, so retrying a
+# merge that predates this tooling, or a later fix to it, still works. A push
+# that adds several commits is inspected from the previous main head; a manual
+# retry of such a push needs that head as its `base` input.
+env:
+  MERGE_SHA: ${{ inputs.sha || github.sha }}
+  BASE_SHA: ${{ github.event_name == 'push' && github.event.before || inputs.base }}
+
+jobs:
+  # Copilot runs here with a read-only token; it cannot push or open PRs.
+  # Copilot can write files that later steps execute, so treat this job as
+  # untrusted: it uses no dependency cache that later runs would restore.
+  propose:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      copilot-requests: write
+    steps:
+      - name: Checkout tools
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.workflow_sha }}
+          path: tools
+          persist-credentials: false
+
+      - name: Checkout merge commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.MERGE_SHA }}
+          path: source
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Retrieve Node.js version
+        id: node-version
+        run: echo "node-version=$(grep '^nodejs ' tools/.tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.node-version.outputs.node-version }}
+
+      - name: Install Copilot CLI
+        run: npm install -g @github/copilot@1.0.90
+
+      - name: Propose documentation edits
+        working-directory: source
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: ../tools/scripts/docs-proposal/propose.sh "$MERGE_SHA" .docs-proposal "$BASE_SHA"
+
+      - name: Upload proposal
+        uses: actions/upload-artifact@v4
+        with:
+          name: docs-proposal
+          path: source/.docs-proposal/
+          include-hidden-files: true
+          if-no-files-found: error
+
+  # VitePress executes Vue in Markdown during the build, so the docs gates run
+  # here with no write token, persisted credentials, or dependency cache.
+  validate:
+    needs: propose
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout tools
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.workflow_sha }}
+          path: tools
+          persist-credentials: false
+
+      - name: Checkout merge commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.MERGE_SHA }}
+          path: source
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Retrieve Node.js version
+        id: node-version
+        run: echo "node-version=$(grep '^nodejs ' tools/.tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.node-version.outputs.node-version }}
+
+      - name: Download proposal
+        uses: actions/download-artifact@v4
+        with:
+          name: docs-proposal
+          path: source/.docs-proposal
+
+      - name: Validate proposal
+        working-directory: source
+        run: ../tools/scripts/docs-proposal/validate.sh "$MERGE_SHA" .docs-proposal
+
+  # Copilot does not run here, and neither does any proposal content: this job
+  # re-checks the path allowlist on a fresh checkout and publishes the patch.
+  publish:
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout tools
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.workflow_sha }}
+          path: tools
+          persist-credentials: false
+
+      - name: Checkout merge commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.MERGE_SHA }}
+          path: source
+          fetch-depth: 0
+
+      - name: Retrieve Node.js version
+        id: node-version
+        run: echo "node-version=$(grep '^nodejs ' tools/.tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.node-version.outputs.node-version }}
+
+      - name: Download proposal
+        uses: actions/download-artifact@v4
+        with:
+          name: docs-proposal
+          path: source/.docs-proposal
+
+      - name: Publish proposal pull request
+        working-directory: source
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: ../tools/scripts/docs-proposal/publish.sh "$MERGE_SHA" .docs-proposal