stackpop · aram356 · May 19, 2026 · May 19, 2026 · May 19, 2026 · May 19, 2026
diff --git a/.claude/agents/code-architect.md b/.claude/agents/code-architect.md
@@ -16,7 +16,7 @@ architectural principles:
 
 3. **Thin adapters**: each adapter translates platform types to/from core types.
    Business logic never lives in adapters. The adapter file structure is:
-   `context.rs`, `request.rs`, `response.rs`, `proxy.rs`, `logger.rs`, `cli.rs`.
+   `context.rs`, `request.rs`, `response.rs`, `outbound.rs`, `logger.rs`, `cli.rs`.
 
 4. **Contract testing**: every adapter has `tests/contract.rs` that validates
    request/response mapping. New adapters must follow this pattern.

diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
@@ -34,7 +34,7 @@ jobs:
 
       - name: Retrieve Rust version
         id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Set up rust toolchain
@@ -114,7 +114,7 @@ jobs:
 
       - name: Retrieve Rust version
         id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Set up Rust tool chain
@@ -144,7 +144,7 @@ jobs:
       - name: Retrieve Node.js version
         id: node-version
         working-directory: .
-        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "node-version=$(grep '^nodejs ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Use Node.js
@@ -162,3 +162,10 @@ jobs:
 
       - name: Run Prettier (check)
         run: npm run format
+
+      - name: Check outbound documentation contract
+        working-directory: .
+        run: node scripts/check_outbound_docs_contract.mjs
+
+      - name: Build documentation
+        run: npm run build
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -35,12 +35,13 @@ jobs:
 
       - name: Retrieve Rust version
         id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Set up Rust tool chain
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
+          components: "clippy, rustfmt"
           toolchain: ${{ steps.rust-version.outputs.rust-version }}
 
       - name: Add wasm targets
@@ -55,6 +56,14 @@ jobs:
       - name: No legacy typed reads
         run: ./scripts/check_no_legacy_typed_reads.sh
 
+      # These roots are the active API surface. Historical design and plan
+      # documents under docs/superpowers intentionally remain immutable.
+      - name: No legacy outbound API
+        run: bash scripts/check_outbound_legacy_api.sh
+
+      - name: Outbound documentation contract
+        run: node scripts/check_outbound_docs_contract.mjs
+
       - name: Nested AppConfig audit
         run: cargo run -q --bin check_no_nested_app_config --features nested-app-config-check -- examples/app-demo crates/edgezero-cli/src/templates
 
@@ -68,18 +77,32 @@ jobs:
       - name: Run workspace tests
         run: cargo test --workspace --all-targets
 
+      - name: Run native outbound adapter contracts
+        run: |
+          scripts/run_test_nonzero.sh send_all_preflight_precedence_and_indices cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features axum,test-utils --test contract
+          scripts/run_test_nonzero.sh send_all_preflight_precedence_and_indices cargo test --offline --locked -p edgezero-adapter-cloudflare --no-default-features --features test-utils --test contract
+          scripts/run_test_nonzero.sh send_all_dispatches_every_slot_before_wait cargo test --offline --locked -p edgezero-adapter-fastly --no-default-features --features test-utils --test contract
+          scripts/run_test_nonzero.sh send_all_preflight_precedence_and_indices cargo test --offline --locked -p edgezero-adapter-spin --no-default-features --features test-utils --test contract
+
       # The adapter CLI dispatch (build/deploy/stage/healthcheck/rollback) and
       # its tests live behind the `cli` feature, which the unfeatured
       # `cargo test --workspace` step above does not enable — so none of those
       # tests compile or run there. Exercise them explicitly.
       - name: Adapter CLI dispatch tests
         run: cargo test -p edgezero-adapter-fastly --all-targets --features cli
 
+      - name: Verify exact outbound capability matrices
+        run: |
+          scripts/run_test_nonzero.sh adapter_capability_matrix_matches_contracts cargo test --offline --locked -p edgezero-adapter-axum --no-default-features --features cli --lib adapter_capability_matrix_matches_contracts
+          scripts/run_test_nonzero.sh adapter_capability_matrix_matches_contracts cargo test --offline --locked -p edgezero-adapter-cloudflare --no-default-features --features cli --lib adapter_capability_matrix_matches_contracts
+          scripts/run_test_nonzero.sh adapter_capability_matrix_matches_contracts cargo test --offline --locked -p edgezero-adapter-fastly --no-default-features --features cli --lib adapter_capability_matrix_matches_contracts
+          scripts/run_test_nonzero.sh adapter_capability_matrix_matches_contracts cargo test --offline --locked -p edgezero-adapter-spin --no-default-features --features cli --lib adapter_capability_matrix_matches_contracts
+
       - name: Check feature compilation
         run: cargo check --workspace --all-targets --features "fastly cloudflare spin"
 
       - name: Verify a generated project compiles
-        run: cargo test -p edgezero-cli --test generated_project_builds -- --ignored
+        run: scripts/run_test_nonzero.sh --ignored generated_workspace_compiles cargo test --offline --locked -p edgezero-cli --test generated_project_builds
 
       # `examples/app-demo` is excluded from the root workspace, so
       # `cargo test --workspace` above does not cover it. Run its own
@@ -101,6 +124,13 @@ jobs:
         working-directory: examples/app-demo
         run: cargo test --locked --workspace --all-targets
 
+      - name: Check app-demo wasm targets
+        working-directory: examples/app-demo
+        run: |
+          cargo check --locked -p app-demo-adapter-cloudflare --target wasm32-unknown-unknown --no-default-features --features cloudflare
+          cargo check --locked -p app-demo-adapter-fastly --target wasm32-wasip1 --no-default-features --features fastly
+          cargo check --locked -p app-demo-adapter-spin --target wasm32-wasip2 --no-default-features --features spin
+
   adapter-wasm-tests:
     name: ${{ matrix.adapter }} wasm tests
     runs-on: ubuntu-latest
@@ -112,14 +142,17 @@ jobs:
             target: wasm32-unknown-unknown
             runner_env: CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER
             runner_value: wasm-bindgen-test-runner
+            sentinel: dispatch_runs_router_and_returns_response
           - adapter: fastly
             target: wasm32-wasip1
             runner_env: CARGO_TARGET_WASM32_WASIP1_RUNNER
             runner_value: viceroy run
+            sentinel: dispatch_runs_router_and_returns_response
           - adapter: spin
             target: wasm32-wasip2
             runner_env: CARGO_TARGET_WASM32_WASIP2_RUNNER
-            runner_value: wasmtime run
+            runner_value: wasmtime run -W component-model-async=y -S p3=y -S http=y
+            sentinel: router_dispatches_get_and_returns_response
     steps:
       - uses: actions/checkout@v6
 
@@ -139,7 +172,7 @@ jobs:
 
       - name: Retrieve Rust version
         id: rust-version
-        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
+        run: echo "rust-version=$(grep '^rust ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
         shell: bash
 
       - name: Set up Rust tool chain
@@ -235,7 +268,19 @@ jobs:
       - name: Run ${{ matrix.adapter }} wasm tests
         env:
           ${{ matrix.runner_env }}: ${{ matrix.runner_value }}
-        run: cargo test -p edgezero-adapter-${{ matrix.adapter }} --features ${{ matrix.adapter }} --target ${{ matrix.target }} --test contract
+        run: scripts/run_test_nonzero.sh ${{ matrix.sentinel }} cargo test --offline --locked -p edgezero-adapter-${{ matrix.adapter }} --no-default-features --features ${{ matrix.adapter }},test-utils --target ${{ matrix.target }} --test contract
+
+      - name: Run Fastly outbound concurrency wasm sentinel
+        if: matrix.adapter == 'fastly'
+        env:
+          ${{ matrix.runner_env }}: ${{ matrix.runner_value }}
+        run: scripts/run_test_nonzero.sh send_all_dispatches_every_slot_before_wait cargo test --offline --locked -p edgezero-adapter-fastly --no-default-features --features fastly,test-utils --target wasm32-wasip1 --test contract
+
+      - name: Run Spin WASI HTTP SDK resource tests
+        if: matrix.adapter == 'spin'
+        env:
+          ${{ matrix.runner_env }}: ${{ matrix.runner_value }}
+        run: scripts/run_test_nonzero.sh spin_error_code_table_is_exhaustive cargo test --offline --locked -p edgezero-adapter-spin --no-default-features --features spin,test-utils --target wasm32-wasip2 --test sdk_resources
 
       # The colocated runtime unit tests (config-store resolver, chunk
       # remediation) need the `fastly` feature and only RUN under Viceroy — the
@@ -245,7 +290,8 @@ jobs:
         if: matrix.adapter == 'fastly'
         env:
           ${{ matrix.runner_env }}: ${{ matrix.runner_value }}
-        run: cargo test -p edgezero-adapter-fastly --features fastly --target wasm32-wasip1 --lib
+        working-directory: crates/edgezero-adapter-fastly
+        run: ../../scripts/run_test_nonzero.sh backend_creation_error_table_is_exhaustive cargo test --offline --locked --no-default-features --features fastly,test-utils --lib
 
       - name: Check ${{ matrix.adapter }} wasm target
-        run: cargo check -p edgezero-adapter-${{ matrix.adapter }} --features ${{ matrix.adapter }} --target ${{ matrix.target }}
+        run: cargo check --offline --locked -p edgezero-adapter-${{ matrix.adapter }} --no-default-features --features ${{ matrix.adapter }} --target ${{ matrix.target }}
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -12,7 +12,7 @@ CI workflows under `.github/workflows/`.
 
 ```
 crates/
-  edgezero-core/              # Core: routing, extractors, middleware, proxy, body, errors
+  edgezero-core/              # Core: routing, extractors, middleware, outbound HTTP, body, errors
   edgezero-macros/            # Proc macros: #[action], #[app]
   edgezero-adapter/           # Adapter registry and traits
   edgezero-adapter-fastly/    # Fastly Compute bridge (wasm32-wasip1)
@@ -134,11 +134,13 @@ impl Middleware for MyMiddleware {
 }
 ```
 
-### Proxy
+### Outbound HTTP
 
-Use `ProxyService` with adapter-specific clients (`FastlyProxyClient`,
-`CloudflareProxyClient`, `SpinProxyClient`). Keep proxy logic provider-agnostic
-in core.
+Handlers obtain `HttpClient` from `RequestContext::http_client()`, construct
+`OutboundRequest` values, and consume `OutboundResponse` or per-slot
+`OutboundSlotResult` outcomes. Keep provider transport logic in adapter-specific
+`*OutboundClient` implementations and use the capability matrix for behavioral
+differences.
 
 ### Logging
 
@@ -168,7 +170,7 @@ Each adapter follows the same structure:
 - `context.rs` — platform-specific request context
 - `request.rs` — platform request → core request conversion
 - `response.rs` — core response → platform response conversion
-- `proxy.rs` — platform-specific proxy client
+- `outbound.rs` — platform-specific outbound HTTP client
 - `logger.rs` — platform-specific logging init
 - `cli.rs` — adapter dispatch behind the `cli` feature: `build` / `deploy` / `serve` (legacy) plus `Adapter::execute` for `auth` (login/logout/status) and dedicated trait methods `provision` (Stage 6 — platform-resource creation) and `push_config_entries` (Stage 7 — `config push` writeback). Self-registers via `#[ctor]` into the `edgezero-adapter` registry.
 

diff --git a/Cargo.lock b/Cargo.lock