[ChristianPavilonis]

Summary

• Move generic request-timing collection into EdgeZero with one portable origin, bounded phase slots, lifecycle marks and application-owned payload.
• Add opt-in, insert-if-absent attachment middleware. Applications retain rendering, header exposure and privacy policy.
• Coordinate adoption with Trusted Server #1261, which supersedes #1121.

Changes

Crate / file	Change
crates/edgezero-core/src/request_timing.rs, src/lib.rs	Generic RequestTimings<N, D>, immutable lock-free origin, snapshots, compound updates, saturating accumulation, drop-time spans and explicit lifecycle marks
crates/edgezero-core/src/middleware.rs	Const-configurable attachment that preserves an existing concrete handle, otherwise installs request-local state unless the exact path is excluded
Core tests and shared adapter fixture	Cover typed facade integration, extension identity/origin, contention, invalid slots, poison recovery, cancellation, clock advancement and attachment
crates/edgezero-core/tests/request_timing_boundary.rs	Five regressions covering boundary-only and pre-dispatch-hook integration, success/error results, 404/405 installation, preserved handles, exclusions and streaming limits
Cloudflare/Fastly/Spin contract tests	Run shared timing coverage in adapter runtime harnesses
crates/edgezero-macros/tests/app_macro.rs	Exercise named-const middleware registration from the manifest
.github/workflows/test.yml, scripts/run_tests.sh, .claude/commands/check-ci.md, CLAUDE.md	Run/document the core doctest gate and align local gate commands
scripts/check_ci_gate_docs.sh, scripts/test_ci_gate_docs.sh	Repository-level ordered gate-list consistency check, derived displayed count and 14 isolated-fixture regressions; replaces the CLI-crate documentation test
tests/fixtures/reusable-app/crates/fixture-harness/src/{net,runners}.rs	Retain the small Fastly abort-race fix from 42f429ad: wait for downstream body observation before origin closure and retain strict partial-response/post-commit-error assertions
Middleware/configuration guides and design/plan	Document contracts, pre-dispatch installation versus boundary marks, adapter limits, deferred after-dispatch observation and coordinated release checkpoints

elapsed() is infallible and does not take the state mutex. TimingError and TimingSnapshot are non-exhaustive. Lifecycle methods are mark_headers_ready(), mark_request_complete() and set_response_bytes().

Callbacks run synchronously under one nonblocking mutex. Panics propagate; poison recovery is best-effort, without rollback or payload validation. Trusted Server retains its phase enum, domain facts, wire names and Server-Timing rendering.

PreDispatchHook can install or reuse the handle on every adapter before route lookup, including 404/405 requests. It cannot observe downstream results. Application boundary middleware marks matched-route results, before handler-error rendering, and does not measure streamed-body completion. The guide covers single-hook composition, manual Hooks integration for app!, and exclusions at every creation site. Existing handles retain their original clock origin.

Verification

Current pushed EdgeZero candidate: 31b66d4b1c48dd0bf4a600837268d7eb7e3fb5b3.

Local checks at this candidate, Rust 1.98.1:

• All six documented CI gates: formatting, strict workspace Clippy, workspace all-target tests, core doctests, fastly cloudflare spin feature check, and Spin wasm32-wasip2 check.
• All five request-timing boundary regressions, including the two new hook scenarios.
• Gate-docs guard and all 14 shell regressions; Bash syntax, ShellCheck 0.11.0 and actionlint 1.7.12.
• Docs ESLint, Prettier and VitePress build.
• Fixture harness/core host suites and native fixture Clippy. The harness has 25 passing tests, including the abort-release regression.
• Full Fastly fixture smoke under pinned Viceroy 0.21.0, including all three custom variants' partial-response and correlated post-commit-error probes. An initial run selected obsolete local Viceroy 0.17.0 and failed at startup on a missing host import; the pinned rerun passed.
• Fresh GitHub checks and complete coordinated consumer validation. See the checks below and linked consumer PR for live status; do not infer candidate validation from older green runs.
• Deployed-provider clock smoke testing. Browser/Viceroy/Wasmtime tests are not evidence of deployed Cloudflare clock semantics. The current browser harness is selected by the CI workflow.

The spec and implementation plan retain design contracts, verification approach and generic release checkpoints. Candidate revisions and validation status live in the coordinated PRs, not those lasting design records.

Coordinated delivery / merge gate

Trusted Server #1261 is now at ee249d363e52227e6fabf134c436e90c6d3df2f8. All six direct EdgeZero dependencies use the IABTechLab URL and pin the candidate above. Its lockfile changes only the eight resolved EdgeZero git-source revisions; metadata confirms one resolved EdgeZero core identity and one common git source.

Local consumer validation passed the 20 timing facade tests; Axum, Cloudflare and Spin adapter suites; Fastly/Viceroy tests in both feature modes, including 3,414 core tests; 28 cross-adapter parity tests; host CLI tests; all eight target-matched Clippy aliases; template build-digest tests/Clippy; the WASM clock lint; formatting and the CI Node pin guard. The full JS suite passed 1,892 tests with one skipped test and no type errors. Exact consumer validation commands and results.

Fresh GitHub jobs, including full runtime/browser integration acceptance, are still running against this pushed pair. The merge gate remains open until candidate-specific joint validation passes; this description does not treat the pin update alone as completion.

Trusted Server must replace temporary revision pins with an approved EdgeZero release tag, regenerate and inspect its lockfile, and pass final tag-backed validation before merging. No merge or release is performed by this follow-up.

Related work

• Current consumer: IABTechLab/trusted-server#1261
• Historical consumer: IABTechLab/trusted-server#1121, closed and superseded by #1261
• Tracking issue: Add a shared request-timing collector and opt-in attachment middleware #446

Closes #446.

[aram356]

PR Review

Summary

Adds a generic per-request timing collector (RequestTimings<N, D>) and opt-in, insert-if-absent attachment middleware to edgezero-core, with a shared runtime scenario in the three WASM adapter contract suites. I found no correctness bugs. I'm requesting changes on two API-shape items that are cheap now but become breaking changes once Trusted Server pins a release tag. Neither touches Trusted Server's call sites at 2791ceb.

Findings

Blocking

• 🔧 TimingError not #[non_exhaustive]: inconsistent with EdgeError/KvError/ConfigStoreError, and adding it after the tag is breaking (request_timing.rs:17)
• 🔧 Hoist t0 out of the mutex: makes elapsed() infallible and the origin structurally immutable; elapsed() currently fails under cross-thread contention (request_timing.rs:100)

Non-blocking

• 🤔 Generic lifecycle names: headers_ready_total / request_elapsed / resp_bytes mirror TS internals (request_timing.rs:51)
• 🤔 Cloudflare clock semantics: workerd's performance.now() advances only across I/O, and the contract test runs in Chromium (docs/guide/middleware.md:169)
• ♻️ Shared fixture via cross-crate #[path], never run natively: Cloudflare/Fastly/Spin tests/contract.rs
• ⛏ RequestTimings lacks Debug; must_use message wording; with_excluded_paths replace semantics undocumented
• ⛏ Guide: show paired type aliases (a generic mismatch silently yields no handle); drop the reference to an internal test file
• ⛏ Spec/plan status lines, unchecked tasks, local paths and "keep the PR draft" text are stale relative to the PR
• 🌱 Contention drop counter for native runtimes; config-driven exclusions; exposing the middleware-created handle to outer layers

Behavioral claims above were checked with throwaway probe tests against 9c03cc59: generic-mismatch silence, elapsed() failing under cross-thread contention, exclusion-list replacement, and no handle on the response.

📌 Out of Scope

• Deployed-provider smoke testing is still unchecked in the test plan. It matters most for Cloudflare, where the local harness doesn't use workerd's clock.
• The Axum adapter has no tests/contract.rs, so the shared timing scenario doesn't run there.

CI Status

• fmt: PASS
• clippy (--all-features -D warnings): PASS
• tests (--workspace --all-targets): PASS (core: 484 unit tests, plus the compile_fail doctest)
• feature check (fastly cloudflare spin): PASS
• Spin wasm32-wasip2 check: PASS
• GitHub: all 22 checks green, including Cloudflare/Fastly/Spin WASM tests

[aram356]

PR Review

Summary

Second pass at 9c03cc59. It covers areas the earlier review didn't reach: registering the middleware from the manifest, how the handle interacts with State<T>, CI coverage of the compile-fail test, how strong the runtime test is, and documentation consistency. I checked each finding against the code or with a throwaway probe. I'm requesting changes so these land together with the two 🔧 items from the earlier review, before the release tag.

Findings

Inline:

• 🤔 edgezero.toml can't register the middleware: a const fn constructor fixes it (middleware.rs:86)
• 🤔 State<RequestTimings<…>> returns a 500 that points at with_state (docs/guide/middleware.md:226)
• 🤔 CI never runs the compile-fail test (request_timing.rs:40)
• 🤔 Overlapping spans on one slot add up past wall-clock time (request_timing.rs:129)
• 🤔 The runtime test can't catch a stopped clock (tests/support/request_timing.rs:37)
• ⛏ span(slot)? in the guide doesn't compile in a handler (docs/guide/middleware.md:233)
• ⛏ The web_time example needs a web-time dependency (docs/guide/middleware.md:27)
• ⛏ Assertions that can't fail (middleware.rs:360, plus four more listed there)
• ⛏ TimingSnapshot lacks the D = () default (request_timing.rs:45)
• 🌱 PhaseSpan has no finish/cancel (request_timing.rs:260)

Not attached to a diff line:

• ⛏ configuration.md now contradicts the corrected middleware guide: docs/guide/configuration.md:49 still says "Manifest-driven middleware are applied in order before routes". This PR corrected the same claim in middleware.md:61-62. Suggest reusing that sentence: "Routes are matched first. Middleware then run in registration order for a matched route; unmatched 404/405 requests bypass the middleware chain."

• 🌱 The middleware fits only two of Trusted Server's four adapters: at 2791ceb, only Cloudflare and Spin register it.

  • Fastly creates its collector before the app is built, so it can time AppBuild (main.rs:128-131).
  • Axum reimplements insert-if-absent plus the /health exclusion as a tower service outside RouterService (timing.rs:78-99). That also covers 404/405 and gives it a final point to render headers.

  This is the gap behind the earlier 🌱 about reaching the middleware-created handle after the router returns. An EdgeZero Service wrapper around RouterService would cover unmatched routes and give every adapter one place to finish timing.

CI Status

• fmt: PASS
• clippy (--all-features -D warnings): PASS
• tests (--workspace --all-targets): PASS
• doctests (--workspace --doc): PASS (1 compile-fail test, 13 ignored)
• feature check (fastly cloudflare spin): PASS
• Spin wasm32-wasip2 check: PASS
• GitHub: 21/21 checks green

[prk-Jr]

😃 Reviewed all 11 changed files at 9c03cc5, including focused collector/API and middleware/adapter reviews. No actionable defects found.

The implementation preserves existing collectors, keeps phase and payload updates under one mutex, and follows the documented contention, cancellation, and explicit lifecycle contracts.

Local verification passed:

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-targets
• cargo test -p edgezero-core: 484 unit tests, two integration tests, and the compile-fail doctest passed; 13 existing doctests ignored
• cargo check --workspace --all-targets --features "fastly cloudflare spin"
• cargo check -p edgezero-adapter-spin --target wasm32-wasip2 --features spin
• Fastly WASM contract suite under Viceroy: all seven tests passed
• Docs lint and formatting

Initial sandbox socket-binding and certificate-store failures cleared on rerun outside the sandbox. All 22 GitHub checks were green at the reviewed commit. Cloudflare/Spin runtime suites and Trusted Server joint validation were not rerun as part of this review.

[aram356]

PR Review

Summary

Re-review at 878be472, which is ab444946 plus the merge of main. Both 🔧 items from the first review are fixed correctly. t0 now sits outside the mutex, so elapsed() is lock-free, and a cross-thread test covers it. TimingError and TimingSnapshot are #[non_exhaustive]. I checked every other claimed fix against the code and each one holds. The deferrals recorded in the spec's "Deferred follow-ups" are reasonable.

I'm requesting changes for the items below. The main ones are the Cloudflare/Spin gap in the guide's advice on where to measure, and the release gate on Trusted Server #1261.

Findings

Inline:

• 🤔 Cloudflare and Spin have no adapter hook for preinstalling a handle (docs/guide/middleware.md:288)
• ⛏ The doctest gate is missing from the local gate scripts and CLAUDE.md (.github/workflows/test.yml:97)
• ⛏ The spec and plan have stale consumer references, the wrong browser name and old evidence counts (spec:8)
• ⛏ Some process and authorization text remains (spec:478)

Not attached to a diff line:

• ⛏ The PR description is stale: it still says Trusted Server migration and joint verification are "complete against this exact candidate". The test plan's counts (484 unit tests; Cloudflare 8, Fastly 7, Spin 13) and the "22 checks … identical to 9c03cc59" note describe the original commit, and the public API has been renamed since then. The Changes table also leaves out .github/workflows/test.yml and the edgezero-macros fixture. Suggest refreshing it and marking joint validation as pending, as the spec's "Remaining release checkpoints" already does.
• 📝 The release gate isn't met yet: Trusted Server #1261 pins all six crates to ab444946. Its Fastly adapter uses edgezero_adapter_fastly::lifecycle::{Sandbox, run_custom}, which comes from #379 and exists on this branch only after the merge. As a result its CI fails to compile (E0433 at trusted-server-adapter-fastly/src/main.rs:125). The spec's checkpoints put renewed joint validation before the EdgeZero merge, and that validation hasn't happened yet. #1261 needs to re-pin to 878be472 or later and pass.

CI Status

• fmt: PASS
• clippy (--all-features -D warnings): PASS
• tests (--workspace --all-targets): PASS
• core doctests (-p edgezero-core --doc): PASS (1 compile-fail test, 13 ignored)
• feature check (fastly cloudflare spin): PASS
• Spin wasm32-wasip2 check: PASS
• GitHub: 28/28 checks green, including Cloudflare (10 tests, headless Firefox), Fastly/Viceroy (9) and Spin/Wasmtime (14)

[ChristianPavilonis]

@aram356 ready for another pass on the EdgeZero changes at 018529795767effa1bf0e5761367f4559aa47b30.

Replied to and resolved the four inline threads. 4dd6bf82 adds the adapter-specific boundary guidance and your outer-middleware pattern with three regression tests, synchronizes the local doctest gates, refreshes the spec/plan records and removes the process narrative. 01852979 fixes Clippy compatibility without changing behavior. All 28 reported GitHub checks are green at the current head.

I also refreshed the PR description, including the missing workflow/macro fixture changes and the verification status. It no longer claims that the original joint validation covers this candidate.

Your non-inline release-gate finding remains open. Trusted Server #1261 still pins all six crates to ab444946, and its current CI has failures. It needs the facade/pins updated to the merged candidate and renewed joint validation before EdgeZero merges. This re-review request does not mark that gate complete. Deployed-provider clock smoke testing and final tag-backed consumer validation also remain pending.

[aram356]

PR Review

Summary

Re-review at 777e8edf: 4dd6bf82 and 01852979 on top of the previous revision, the unrelated harness fix 42f429ad, and three merges of main. All four threads from the last review are fixed correctly:

• The guide now names the boundary each adapter offers and adopts TimingBoundary with its limits, backed by three regression tests.
• The doctest gate is in run_tests.sh, /check-ci and CLAUDE.md.
• The spec and plan cite #1261 and say Firefox.
• The process text is gone.

The refreshed PR description is clear about the open merge gate. I'm requesting changes because that gate is still unmet, and for the smaller items below.

Findings

Inline:

• ♻️ Release status tied to specific commits keeps going stale (plan:30)
• ⛏ stackpop/edgezero links remain after the IABTechLab transfer (spec:452)
• ⛏ The Rust 1.95 compatibility shim on PhaseSpan's Drop is no longer needed (request_timing.rs:287)
• ⛏ An unrelated fixture-harness fix is bundled in (tests/fixtures/reusable-app/crates/fixture-harness/src/net.rs:160)
• ⛏ The /check-ci and CLAUDE.md gate lists disagree (.claude/commands/check-ci.md:1)

Not attached to a diff line:

• 📝 The merge gate is still unmet: Trusted Server #1261 still pins all six crates to ab444946. It hasn't changed since 2026-10-19 and has 4 failing checks. The PR's own gate requires re-pinning to the current candidate and passing joint validation before this merges, so I'm not approving yet.
• ⛏ The PR description has drifted slightly:
  • "Current pushed candidate: 01852979…" should now be 777e8edf.
  • The Changes table leaves out tests/fixtures/reusable-app/crates/fixture-harness/src/{net,runners}.rs.
  • The Clippy line says "Rust 1.95 and 1.98.1", but main targets 1.98.1 only.

CI Status

• fmt: PASS
• clippy (--all-features -D warnings, Rust 1.98.1): PASS
• tests (--workspace --all-targets): PASS, including all 24 request-timing tests
• core doctests (-p edgezero-core --doc): PASS (1 compile-fail test, 13 ignored)
• feature check (fastly cloudflare spin): PASS
• Spin wasm32-wasip2 check: PASS
• reusable-app fixture harness: PASS (25 tests)
• GitHub: 28/28 checks green at 777e8edf

[ChristianPavilonis]

Closes #446. Tracks the shared request-timing collector and opt-in attachment middleware implemented by this PR.

[aram356]

PR Review

Summary

Re-review at 511ce06f: 3b436c76 plus merges of main, including #403 (pre-dispatch hooks). Four of the five threads from the last review are fixed correctly:

• Release status has moved out of the spec and plan, which now link to the PRs instead.
• Every EdgeZero link in both documents points at IABTechLab/edgezero.
• PhaseSpan's Drop uses main's plain #[expect(clippy::missing_trait_methods)].
• /check-ci matches the six documented gates.

The fixture-harness thread has no reply yet; see below. I'm requesting changes because the merge gate is still unmet, and for the items below.

Findings

Inline:

• 🤔 #403's pre-dispatch hook makes the Cloudflare/Spin boundary advice inaccurate (docs/guide/middleware.md:300)
• ♻️ The gate-docs guard sits in the CLI crate and hard-codes the gate count (crates/edgezero-cli/tests/ci_gate_docs.rs:1)

Not attached to a diff line:

• 📝 The merge gate is still unmet: Trusted Server #1261 still pins all six crates to ab444946, through the old stackpop URL. Its head 9654deb7 now conflicts with its own main, so only CodeQL ran there. No joint validation covers this candidate, so I'm not approving yet.
• ⛏ The PR description is stale, and it's now the only status record: since 3b436c76 moved release status out of the spec and plan, the description is where it lives. But:
  • "Current pushed candidate: 018529795767…" should now be 511ce06f.
  • "Clippy compatibility follow-up in 01852979 for Rust 1.95 and 1.98.1" no longer applies: 3b436c76 removed that shim.
  • "Historical local and post-merge verification is recorded separately in the implementation plan" points to records that 3b436c76 deleted.
  • "Its current head, 686826ea…, has failing CI" should now name 9654deb7, which conflicts with its own main.
  • The Changes table leaves out crates/edgezero-cli/tests/ci_gate_docs.rs and the fixture-harness files.
• ⛏ Follow-up on the fixture-harness thread, with a correction: my last review said main's test workflow had passed on every recent run. Main's own branch runs did, but PRs into main do hit the race that 42f429ad fixes. Runs 40543103198 (a docs-only @types/node bump), 41041682390 (sha2) and 41041668912 (tokio) all fail in the /stream-error probe with "not post-commit evidence". That makes the fix worth landing on its own now, rather than waiting behind this PR's release gate.

CI Status

• fmt: PASS
• clippy (--all-features -D warnings, Rust 1.98.1): PASS
• tests (--workspace --all-targets): PASS, including every request-timing test and the new gate-docs test
• core doctests (-p edgezero-core --doc): PASS
• feature check (fastly cloudflare spin): PASS
• Spin wasm32-wasip2 check: PASS
• reusable-app fixture harness: PASS (25 tests)
• GitHub: 28/28 checks green at 511ce06f