Remove legacy entry point, canary routing, and flag plumbing

[prk-Jr]

Summary

• Deletes legacy_main, route_request, HandlerOutcome, and all canary flag-reading machinery (edgezero_enabled / edgezero_rollout_pct) now that EdgeZero has reached full functional parity and the cutover canary (PR19) is merged.
• Removes the error module, the legacy route_tests file, and unused compat functions that only existed to support the old code path.
• Simplifies main to a direct trampoline into edgezero_main, removing ~710 lines of dead code and the two config-store keys from fastly.toml.

Changes

File	Change
crates/trusted-server-adapter-fastly/src/main.rs	Delete legacy_main, route_request, HandlerOutcome, flag constants, and all associated imports (~710 lines removed)
crates/trusted-server-adapter-fastly/src/error.rs	Delete entire module (only used by legacy path)
crates/trusted-server-adapter-fastly/src/route_tests.rs	Delete legacy route test file
crates/trusted-server-adapter-fastly/src/compat.rs	Remove legacy-only compat functions; keep Fastly↔EdgeZero conversion helpers
crates/trusted-server-adapter-fastly/src/platform.rs	Remove build_runtime_services (legacy-only)
crates/trusted-server-adapter-fastly/src/app.rs	Remove runtime_services_for_consent_route and build_state (legacy-only); update imports
crates/trusted-server-adapter-fastly/src/middleware.rs	Clean up unused imports left behind by legacy removal
fastly.toml	Remove edgezero_enabled and edgezero_rollout_pct config-store entries
docs/superpowers/plans/2026-05-27-pr20-legacy-cleanup.md	Add plan document for this cleanup

Closes

Closes #501

Test plan

• cargo fmt --all -- --check
• cargo clippy-fastly
• cargo clippy-axum
• cargo test-fastly — 48 tests passed, 0 failed
• cargo test-axum — 20 tests passed, 0 failed
• JS tests: cd crates/js/lib && npx vitest run — 291 tests passed
• JS format: cd crates/js/lib && npm run format
• Docs format: cd docs && npm run format

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses log macros (not println!)
• No secrets or credentials committed

[ChristianPavilonis]

Automated review: I reviewed PR #744 against feature/edgezero-pr19-cutover-canary, focusing on the Fastly post-cutover path, config/test changes, and compatibility risks. Current GitHub checks are green, and I did not find a blocking security, data-loss, authorization, or CI-breaking issue. I did find two compatibility concerns worth addressing or explicitly accepting; details are inline.

[ChristianPavilonis]

Automated review: P1 compatibility — removing the fallback makes the known streaming gap apply to all Fastly traffic. This line now sends every non-health request through EdgeZero, but the EdgeZero fallback still materializes publisher responses via buffer_publisher_response (app.rs:719) and asset-route responses via buffer_asset_body (app.rs:781). The code comments acknowledge that legacy streamed asset bodies uncapped, while the EdgeZero path buffers them until the streaming cutover (app.rs:757-763), and the Fastly platform client rejects non-streamed origin responses over 10 MiB before publisher processing. That means large publisher pages/assets that legacy could stream can now fail once rollback/canary is removed. Suggested fix: either land the EdgeZero streaming seam before deleting the legacy fallback, or make this an explicit accepted compatibility break with targeted tests/docs covering the new size limits for publisher and asset responses.

[ChristianPavilonis]

Automated review: P2 compatibility — local Fastly config dropped stores that the default app config still uses. The root fastly.toml now defines only creative_store and consent_store, but trusted-server.toml still sets ec.ec_store = "ec_identity_store", and the Fastly batch-sync limiter still opens counter_store via RATE_COUNTER_NAME. The integration fixtures keep these stores, so CI stays green, but fastly compute serve with the repo defaults can fail EC identity or batch-sync operations because the local Viceroy config no longer provisions the referenced stores. Suggested fix: restore placeholder [[local_server.kv_stores.ec_identity_store]] and [[local_server.kv_stores.counter_store]] entries in root fastly.toml (remove only the canary config-store keys intended by this PR).

[aram356]

Summary

Re-review of the updated head (1e93245). All three blocking findings from the previous pass are resolved and CI is fully green — I verified each fix against the code, not just the check status. One new blocking issue was introduced by this update: fastly.toml no longer declares KV stores the runtime still opens, which breaks local fastly compute serve for EC. Details below.

Resolved since last review

• ✅ cargo test / admin_endpoints_match_fastly_router — test repointed from main.rs to app.rs and the parser updated to the NamedRoute path: format; ADMIN_ENDPOINTS (/_ts/admin/keys/{rotate,deactivate}) now matches the routes in app.rs. Verified passing.
• ✅ integration tests + browser integration tests — root cause was the default viceroy-template.toml not declaring the trusted_server_config store that the EdgeZero entry point opens at startup. Now declared, with a guard test (default_fastly_viceroy_template_defines_trusted_server_config_store).
• ✅ middleware.rs doc — no longer references "the legacy entry point".

Cross-cutting / body-level findings

• 🔧 fastly.toml dropped KV stores the EdgeZero runtime still opens — local fastly compute serve will fail for EC. This update's net diff removes ec_identity_store, counter_store, and opid_store from [local_server.kv_stores] (leaving only creative_store plus a newly-added consent_store). This is the PR's change, not base drift — both the merge-base and the current base tip still declare all three.

  The concrete breakage is ec_identity_store:

  • trusted-server.toml still sets ec_store = "ec_identity_store" (active; not in this PR's diff).
  • The EdgeZero path opens it via open_kv_store (platform.rs, called from app.rs).
  • [local_server.kv_stores] is the only store config Viceroy / fastly compute serve reads.

  So fastly compute serve + any EC identify/batch-sync request → open_kv_store("ec_identity_store") → store-not-found error. The pre-seeded test EC entry used by test-prebid-eids.sh is also gone.

  Why CI stays green: the integration suites use viceroy-template.toml, which still declares counter_store, opid_store, ec_identity_store (with seeds), and ec_partner_store. fastly.toml is never exercised by CI, so the divergence is invisible to the checks. Production is unaffected ([local_server] is Viceroy-only; production stores are provisioned out-of-band).

  This looks unintended (it surfaced through merge mechanics, not an explicit fastly.toml edit in any commit). Suggested fix: restore ec_identity_store (with its test seed) and counter_store to fastly.toml so it matches trusted-server.toml and viceroy-template.toml; or, if a store rename was intended, update all three consistently. Proposed [local_server.kv_stores] shape:

      [local_server.kv_stores]
          [[local_server.kv_stores.counter_store]]
              key = "placeholder"
              data = "placeholder"
  
          [[local_server.kv_stores.creative_store]]
              key = "placeholder"
              data = "placeholder"
  
          [[local_server.kv_stores.ec_identity_store]]
              key = "placeholder"
              data = "placeholder"
  
          # Pre-seeded test EC entry for local script testing (test-prebid-eids.sh).
          [[local_server.kv_stores.ec_identity_store]]
              key = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test01"
              data = '{"v":1,"created":1700000000,"last_seen":1700000000,"consent":{"ok":true,"updated":1700000000},"geo":{"country":"US"}}'
  
          [[local_server.kv_stores.consent_store]]
              key = "placeholder"
              data = "placeholder"

  (opid_store has no runtime or config reference, so dropping it appears safe to leave out.)

CI Status

• cargo fmt: PASS
• cargo test: PASS
• cargo test (axum native): PASS
• cargo test (cross-adapter parity): PASS
• cargo check (cloudflare native + wasm32-unknown-unknown): PASS
• cargo check/build/test (spin native + wasm32-wasip1): PASS
• vitest: PASS
• format-typescript: PASS
• format-docs: PASS
• prepare integration artifacts: PASS
• integration tests: PASS
• integration tests (EdgeZero entry point): PASS
• browser integration tests: PASS

No checks are marked required under branch protection; per CLAUDE.md these are still PR gates. The new finding is config-only and not exercised by any check.

[aram356]

Summary

Re-review of head 1e93245 (unchanged since my previous review). The three original blocking findings remain resolved. The one blocking issue from the last pass — fastly.toml dropping KV stores the runtime still opens — is still unaddressed at this head, so the verdict stays REQUEST_CHANGES. This pass also went deeper on the large deletions and the entry point; those results are recorded below as confirmation (no new blocking issues).

Still blocking (unchanged from previous review)

• 🔧 fastly.toml dropped ec_identity_store / counter_store / opid_store from [local_server.kv_stores]. trusted-server.toml still sets ec_store = "ec_identity_store" and the EdgeZero path opens it via open_kv_store, so fastly compute serve + any EC identify/batch-sync request fails with a store-not-found error; the pre-seeded test EC entry used by test-prebid-eids.sh is also gone. This is the PR's change (both merge-base and base tip still declare all three stores). CI stays green only because the integration suites use viceroy-template.toml (which still declares them), not fastly.toml. Production is unaffected ([local_server] is Viceroy-only). Restore ec_identity_store (with its seed) and counter_store to fastly.toml, or if a rename was intended, update trusted-server.toml and viceroy-template.toml to match. (opid_store has no runtime/config reference and can stay removed.)

Deep-pass verification (no action needed — recorded for confidence)

• 📝 route_tests.rs deletion (1867 lines) loses no coverage. All 43 deleted tests import route_request/HandlerOutcome (the removed legacy router). The scenarios are re-covered by the EdgeZero app.rs test module (asset-route fallthrough, tester-cookie enable/disable, legacy_admin_aliases_denied_locally_not_proxied_to_publisher, dispatch_unregistered_method_returns_405_at_router_level, consent-store fail-closed) plus behavior-level tests in core.
• 📝 compat.rs removal of the Body::Stream debug_assert is benign. app.rs buffers streaming publisher/asset bodies to Body::Once (buffer_publisher_response / buffer_asset_body, bounded by publisher.max_buffered_body_bytes) before the response leaves the router, so the Stream arm in to_fastly_response is unreachable by design; the warn! log remains as a safety net.
• 📝 main.rs entry point is correct — config-store open, forwarded-header sanitization, TLS-scheme re-injection, EC finalize, and geo application are all sound; streaming responses are buffered before the Fastly conversion.

Resolved (confirmed still fixed)

• ✅ admin_endpoints_match_fastly_router — repointed to app.rs + NamedRoute parser; passes.
• ✅ integration/browser suites — default viceroy-template.toml now declares trusted_server_config, with a guard test.
• ✅ middleware.rs doc — no longer references "the legacy entry point".

CI Status

All 13 checks PASS (cargo fmt, cargo test, cargo test axum native, cross-adapter parity, cloudflare check, spin check/build/test, vitest, format-typescript, format-docs, prepare integration artifacts, integration tests, integration tests (EdgeZero entry point), browser integration tests). The open finding is config-only and not exercised by any check.

[aram356]

Summary

Re-review of head 1e93245 (unchanged) — findings now anchored as inline comments. Verdict stays REQUEST_CHANGES for the one open blocking issue (fastly.toml KV stores). The three original findings remain resolved, and the deep-pass items are confirmations, not action items.

Blocking

🔧 wrench

• fastly.toml dropped KV stores the runtime still opens — see inline at fastly.toml:30 (carries a one-click suggestion).

Non-blocking

📝 note

• compat.rs Body::Stream debug_assert removal is benign — see inline at crates/trusted-server-adapter-fastly/src/compat.rs:20.

Deep-pass confirmations (no inline anchor — whole-file / deleted-file)

• route_tests.rs deletion (−1867) loses no coverage — all 43 tests were legacy route_request/HandlerOutcome; scenarios re-covered by app.rs EdgeZero tests + core behavior tests.
• main.rs entry point verified correct — config-store open, header sanitization, TLS-scheme re-injection, EC finalize, geo application all sound.

Resolved (confirmed still fixed)

• ✅ admin_endpoints_match_fastly_router — repointed to app.rs + NamedRoute parser; passes.
• ✅ integration/browser suites — viceroy-template.toml now declares trusted_server_config, with a guard test.
• ✅ middleware.rs doc — no longer references "the legacy entry point".

CI Status

All 13 checks PASS. The open finding is config-only and not exercised by any check.

[aram356]

🔧 wrench — This PR drops ec_identity_store, counter_store, and opid_store from [local_server.kv_stores], leaving only creative_store + the new consent_store. But trusted-server.toml still sets ec_store = "ec_identity_store" and the EdgeZero path opens it via open_kv_store, so fastly compute serve + any EC identify/batch-sync request fails with a store-not-found error (the pre-seeded test-prebid-eids.sh EC entry is gone too). Both the merge-base and current base tip still declare these stores; CI stays green only because the integration suites use viceroy-template.toml (which keeps them), not fastly.toml. Restore the stores the runtime opens (opid_store has no runtime/config reference, so it's left out here):

Suggested change

	[[local_server.kv_stores.consent_store]]
	key = "placeholder"
	data = "placeholder"
	[[local_server.kv_stores.ec_identity_store]]
	key = "placeholder"
	data = "placeholder"
	# Pre-seeded test EC entry for local script testing (test-prebid-eids.sh).
	# Matches the TEST_EC_ID used in that script.
	[[local_server.kv_stores.ec_identity_store]]
	key = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.test01"
	data = '{"v":1,"created":1700000000,"last_seen":1700000000,"consent":{"ok":true,"updated":1700000000},"geo":{"country":"US"}}'
	[[local_server.kv_stores.counter_store]]
	key = "placeholder"
	data = "placeholder"
	[[local_server.kv_stores.consent_store]]
	key = "placeholder"
	data = "placeholder"

(Apply manually if you instead intend a store rename — then also update trusted-server.toml and viceroy-template.toml to match. Config-only change; not compile-verifiable, but the resulting TOML was validated to parse.)

[ChristianPavilonis]

Review Summary

Approved. I reviewed PR #744 against main with senior-review focus on correctness, compatibility, CI coverage, and adapter behavior. The current GitHub checks are green; I left non-blocking CREG notes inline for follow-up.

📝 CI / existing-review context: GitHub currently reports the branch as conflicting with current main, so it still needs a rebase/merge conflict resolution before it can land. Existing reviews already cover the fastly.toml local KV-store drift and the Fastly streaming-size compatibility concern; I did not duplicate those inline.

Resubmitting this review as a non-blocking comment instead of approval.

[ChristianPavilonis]

Review Summary

Resubmitting the previous review as a non-blocking COMMENT rather than an approval. I reviewed PR #744 against main with senior-review focus on correctness, compatibility, CI coverage, and adapter behavior. The current GitHub checks are green.

📝 CI / existing-review context: GitHub currently reports the branch as conflicting with current main, so it still needs a rebase/merge conflict resolution before it can land. Existing reviews already cover the fastly.toml local KV-store drift and the Fastly streaming-size compatibility concern; I did not duplicate those inline.

🌱 Non-blocking findings noted in the dismissed review's inline comments:

• .github/workflows/format.yml:41 — Cloudflare wasm production code is not clippy-gated; the missing wasm clippy command currently fails with -D warnings.
• crates/trusted-server-adapter-cloudflare/src/app.rs:342 — Cloudflare exposes authenticated admin key-management routes even though platform store writes/deletes are unsupported.
• crates/trusted-server-adapter-spin/src/app.rs:647 — Spin exposes authenticated admin key-management routes even though platform store writes/deletes are unsupported.